, 0x0, 0x20000000]}, 0x2c) 03:49:59 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350010000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1696.882113] binder: send failed reply for transaction 5396 to 28998:29008 [ 1696.914642] binder: undelivered TRANSACTION_COMPLETE 03:49:59 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1696.951414] binder: 29037:29045 ioctl c018620b 0 returned -14 [ 1696.963979] binder: 29044:29048 ioctl c018620b 0 returned -14 03:49:59 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a0000fe"}], 0x28}, 0x0) 03:49:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1696.995176] binder: 29037:29045 unknown command 402678540 [ 1697.000837] binder: 29037:29045 ioctl c0306201 20000280 returned -22 [ 1697.041754] binder: 29044:29053 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:49:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c630400"], 0x1, 0x0, &(0x7f0000000040)='+'}) r3 = dup3(r1, r0, 0x0) ioctl$DRM_IOCTL_ADD_CTX(r3, 0xc0086420, &(0x7f0000000000)={0x0}) ioctl$DRM_IOCTL_DMA(r3, 0xc0406429, &(0x7f0000000200)={r4, 0x6, &(0x7f0000000100)=[0x7fff, 0x8, 0x0, 0xab5, 0x6, 0x100000001], &(0x7f0000000140)=[0x7, 0x8], 0x40, 0x1, 0x4, &(0x7f0000000180)=[0x6], &(0x7f00000001c0)=[0x1]}) 03:49:59 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:49:59 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x2c) [ 1697.096998] binder: 29044:29053 BC_FREE_BUFFER u0000000000000000 no match [ 1697.134958] binder: 29044:29053 got reply transaction with bad transaction stack, transaction 5399 has target 29044:0 [ 1697.185917] binder: 29044:29053 transaction failed 29201/-71, size 0-0 line 2756 [ 1697.201541] binder: 29063:29064 ioctl c018620b 0 returned -14 [ 1697.214771] binder: 29044:29053 ioctl c0306201 20000480 returned -14 [ 1697.248676] binder: 29063:29064 unknown command 287500 [ 1697.262449] binder: 29063:29064 ioctl c0306201 20000280 returned -22 03:50:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x74, 0x0, 0x0}) 03:50:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:00 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500fffff000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:00 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a00007f"}], 0x28}, 0x0) 03:50:00 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000]}, 0x2c) 03:50:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0xb9, &(0x7f0000000200)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f00000002c0)={0x1, 0x10, 0xfa00, {&(0x7f00000001c0), r3}}, 0x18) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000180)={r1, 0x0, 0xfff, 0xffffffffffff2e94, 0x1f}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f00000045c0)=ANY=[@ANYBLOB="00805cd53ebcd777042ad8a2228e55eebd68a838f8c7d1cd1fb661404f8cb11210131c9bdef7f4c2237feab6499acbd7aaaf7075e59251cb98e937f536fc6dc435532322cec09c55d3c284d7064ce4d9d5f2e79e4ee507b04599449d"], 0x1, 0x0, &(0x7f0000000040)='+'}) r4 = dup3(r1, r0, 0x0) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') getpeername$packet(r4, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000400)=0x14) recvmmsg(r4, &(0x7f0000004100)=[{{&(0x7f0000000440)=@can={0x1d, 0x0}, 0x80, &(0x7f0000000a40)=[{&(0x7f00000047c0)=""/201, 0xc9}, {&(0x7f00000005c0)=""/255, 0xff}, {&(0x7f00000006c0)=""/110, 0x6e}, {&(0x7f0000000740)=""/227, 0xe3}, {&(0x7f0000000840)=""/142, 0x8e}, {&(0x7f0000000900)=""/237, 0xed}, {&(0x7f0000000a00)=""/43, 0x2b}], 0x7, &(0x7f0000000ac0)=""/80, 0x50}, 0x7}, {{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f0000000b40)=""/232, 0xe8}, {&(0x7f0000000c40)=""/39, 0x27}], 0x0, &(0x7f0000000cc0)=""/64, 0x40}, 0x8}, {{&(0x7f0000000d00)=@nl=@proc, 0x80, &(0x7f0000001280)=[{&(0x7f0000000d80)=""/216, 0xd8}, {&(0x7f0000000e80)=""/137, 0x89}, {&(0x7f0000000f40)=""/246, 0xf6}, {&(0x7f0000001040)=""/163, 0xa3}, {&(0x7f0000001100)=""/227, 0xe3}, {&(0x7f0000001200)=""/107, 0xfd6e}], 0x17c, &(0x7f0000001300)=""/113, 0x71}, 0x81}, {{&(0x7f0000001380), 0x80, &(0x7f0000001700)=[{&(0x7f0000001400)=""/240, 0xf0}, {&(0x7f0000001500)=""/78, 0x4e}, {&(0x7f0000001580)=""/204, 0xcc}, {&(0x7f0000001680)=""/126, 0x7e}], 0x4, &(0x7f0000001740)}, 0x2}, {{&(0x7f0000001780)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000001880)=[{&(0x7f0000004640)=""/116, 0x74}], 0x1, &(0x7f00000018c0)=""/21, 0xbd}, 0x8}, {{&(0x7f0000001900)=@in={0x2, 0x0, @multicast1}, 0x80, &(0x7f0000001a40)=[{&(0x7f0000001980)=""/110, 0x6e}, {&(0x7f0000001a00)=""/45, 0x2d}], 0x2, &(0x7f0000001a80)=""/8, 0x8}, 0x732a727b}, {{&(0x7f0000001ac0)=@un=@abs, 0x0, &(0x7f0000002e40)=[{&(0x7f0000001b40)=""/140, 0x8c}, {&(0x7f0000001c00)}, {&(0x7f0000001c40)=""/201, 0xc9}, {&(0x7f0000001d40)=""/4096, 0x1000}, {&(0x7f0000002d40)=""/102, 0x66}, {&(0x7f0000002dc0)=""/114, 0x72}], 0x6}}, {{&(0x7f0000002ec0), 0x80, &(0x7f0000004080)=[{&(0x7f0000002f40)=""/18, 0xffffffffffffff3f}, {&(0x7f0000002f80)=""/4096, 0x1000}, {&(0x7f0000003f80)=""/102, 0x66}, {&(0x7f0000004000)=""/4, 0x4}, {&(0x7f0000004040)=""/41, 0x29}], 0x5}, 0x100}], 0x8, 0x0, &(0x7f0000004300)={0x77359400}) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000004340)={{{@in=@initdev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@mcast2}}, &(0x7f0000004440)=0xe8) getsockopt$inet_mreqn(r4, 0x0, 0x24, &(0x7f0000004480)={@loopback, @rand_addr, 0x0}, &(0x7f00000044c0)=0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000004500)={'syzkaller1\x00', 0x0}) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000004540)={0x0, @dev, @dev}, &(0x7f0000004580)=0xc) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000004740)={0x0, @multicast2, @local}, &(0x7f0000004780)=0x328) recvmmsg(r2, &(0x7f000000ec80)=[{{&(0x7f0000005940)=@in6, 0x80, &(0x7f0000005b80)=[{&(0x7f00000059c0)=""/202, 0xca}, {&(0x7f0000005ac0)=""/171, 0xab}], 0x2, &(0x7f0000005bc0)=""/48, 0x30}, 0x6}, {{&(0x7f0000005c00)=@l2, 0x80, &(0x7f0000008180)=[{&(0x7f0000005c80)=""/168, 0xa8}, {&(0x7f0000005d40)=""/26, 0x1a}, {&(0x7f0000005d80)=""/42, 0x2a}, {&(0x7f0000005dc0)=""/69, 0x45}, {&(0x7f0000005e40)=""/222, 0xde}, {&(0x7f0000005f40)=""/191, 0xbf}, {&(0x7f0000006000)=""/4096, 0x1000}, {&(0x7f0000007000)=""/105, 0x69}, {&(0x7f0000007080)=""/4096, 0x1000}, {&(0x7f0000008080)=""/221, 0xdd}], 0xa}, 0x7}, {{&(0x7f0000008240)=@hci, 0x80, &(0x7f00000083c0)=[{&(0x7f00000082c0)=""/213, 0xd5}], 0x1, &(0x7f0000008400)=""/146, 0x92}, 0x7f}, {{&(0x7f00000084c0)=@ethernet={0x0, @local}, 0x80, &(0x7f00000099c0)=[{&(0x7f0000008540)=""/121, 0x79}, {&(0x7f00000085c0)=""/4096, 0x1000}, {&(0x7f00000095c0)=""/224, 0xe0}, {&(0x7f00000096c0)=""/199, 0xc7}, {&(0x7f00000097c0)=""/205, 0xcd}, {&(0x7f00000098c0)=""/48, 0x30}, {&(0x7f0000009900)=""/122, 0x7a}, {&(0x7f0000009980)=""/23, 0x17}], 0x8, &(0x7f0000009a40)=""/29, 0x1d}, 0x7}, {{&(0x7f0000009a80)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000afc0)=[{&(0x7f0000009b00)=""/231, 0xe7}, {&(0x7f0000009c00)=""/4096, 0x1000}, {&(0x7f000000ac00)=""/2, 0x2}, {&(0x7f000000ac40)=""/245, 0xf5}, {&(0x7f000000ad40)=""/69, 0x45}, {&(0x7f000000adc0)=""/182, 0xb6}, {&(0x7f000000ae80)=""/189, 0xbd}, {&(0x7f000000af40)=""/117, 0x75}], 0x8, &(0x7f000000b040)=""/107, 0x6b}, 0xff}, {{0x0, 0x0, &(0x7f000000b240)=[{&(0x7f000000b0c0)=""/186, 0xba}, {&(0x7f000000b180)=""/118, 0x76}, {&(0x7f000000b200)=""/10, 0xa}], 0x3, &(0x7f000000b280)=""/239, 0xef}, 0x2}, {{&(0x7f000000b380)=@generic, 0x80, &(0x7f000000d680)=[{&(0x7f000000b400)=""/4096, 0x1000}, {&(0x7f000000c400)=""/61, 0x3d}, {&(0x7f000000c440)=""/9, 0x9}, {&(0x7f000000c480)=""/115, 0x73}, {&(0x7f000000c500)=""/4096, 0x1000}, {&(0x7f000000d500)=""/114, 0x72}, {&(0x7f000000d580)=""/234, 0xea}], 0x7}, 0x1762}, {{&(0x7f000000d700)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f000000d7c0)=[{&(0x7f000000d780)=""/37, 0x25}], 0x1, &(0x7f000000d800)=""/158, 0x9e}, 0x2}, {{0x0, 0x0, &(0x7f000000dc00)=[{&(0x7f000000d8c0)=""/56, 0x38}, {&(0x7f000000d900)=""/247, 0xf7}, {&(0x7f000000da00)=""/204, 0xcc}, {&(0x7f000000db00)=""/47, 0x2f}, {&(0x7f000000db40)=""/149, 0x95}], 0x5, &(0x7f000000dc80)=""/4096, 0x1000}}], 0x9, 0x1, &(0x7f000000eec0)={0x77359400}) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f000000ef00)={0x0, @loopback, @empty}, &(0x7f000000ef40)=0xc) getsockopt$inet6_mreq(r4, 0x29, 0x1c, &(0x7f000000ef80)={@dev, 0x0}, &(0x7f000000efc0)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f000000f000)={{{@in6=@mcast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@empty}}, &(0x7f000000f100)=0xe8) getsockname$packet(r1, &(0x7f000000f180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f000000f1c0)=0x14) accept$packet(r4, &(0x7f000000f900)={0x11, 0x0, 0x0}, &(0x7f000000f940)=0x14) getsockopt$inet_mreqn(r4, 0x0, 0x20, &(0x7f000000f980)={@rand_addr, @empty, 0x0}, &(0x7f000000f9c0)=0xc) getsockname$packet(r0, &(0x7f000000fa00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f000000fa40)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f000000fa80)={'vcan0\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f000000fac0)={{{@in6, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@dev}}, &(0x7f000000fbc0)=0xe8) getsockname$packet(r4, &(0x7f000000fc00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f000000fc40)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f000000fc80)={{{@in6=@mcast1, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@empty}}, &(0x7f000000fd80)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f000000fdc0)={{{@in=@empty, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@multicast1}}, &(0x7f000000fec0)=0xe8) recvmmsg(r4, &(0x7f0000013f00)=[{{&(0x7f0000010040)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, &(0x7f0000011180)=[{&(0x7f00000100c0)=""/12, 0xc}, {&(0x7f0000010100)=""/4096, 0x1000}, {&(0x7f0000011100)=""/48, 0x30}, {&(0x7f0000011140)=""/11, 0xb}], 0x4, &(0x7f00000111c0)=""/193, 0xc1}, 0x40}, {{0x0, 0x0, &(0x7f0000012780)=[{&(0x7f00000112c0)=""/48, 0x30}, {&(0x7f0000011300)=""/210, 0xd2}, {&(0x7f0000011400)=""/70, 0x46}, {&(0x7f0000011480)=""/111, 0x6f}, {&(0x7f0000011500)=""/4096, 0x1000}, {&(0x7f0000012500)=""/139, 0x8b}, {&(0x7f00000125c0)=""/202, 0xca}, {&(0x7f00000126c0)=""/191, 0xbf}], 0x8, &(0x7f0000012800)=""/213, 0xd5}, 0x1}, {{&(0x7f0000012900)=@pptp={0x18, 0x2, {0x0, @initdev}}, 0x80, &(0x7f0000013c00)=[{&(0x7f0000012980)=""/249, 0xf9}, {&(0x7f0000012a80)=""/1, 0x1}, {&(0x7f0000012ac0)=""/252, 0xfc}, {&(0x7f0000012bc0)=""/4096, 0x1000}, {&(0x7f0000013bc0)=""/42, 0x2a}], 0x5, &(0x7f0000013c80)=""/114, 0x72}, 0x5}, {{0x0, 0x0, &(0x7f0000013e00)=[{&(0x7f0000013d00)=""/201, 0xc9}], 0x1, &(0x7f0000013e40)=""/188, 0xbc}, 0x2}], 0x4, 0x20, &(0x7f0000014000)={0x0, 0x1c9c380}) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000014040)={{{@in6, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}}}, &(0x7f0000014140)=0xe8) accept$packet(r4, &(0x7f0000014740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000014780)=0x14) sendmsg$TEAM_CMD_OPTIONS_GET(r4, &(0x7f0000015080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000015040)={&(0x7f00000147c0)={0x848, r5, 0x400, 0x70bd28, 0x25dfdbfd, {}, [{{0x8, 0x1, r6}, {0x16c, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r7}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x6ce}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffeff}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xe3b}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}]}}, {{0x8, 0x1, r10}, {0xbc, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r11}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r12}}}]}}, {{0x8, 0x1, r13}, {0x144, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r14}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r15}}, {0x8}}}, {0x54, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x24, 0x4, [{0xdf8, 0x606, 0x7fffffff, 0x8001}, {0x7, 0x9}, {0x5, 0x1ff, 0x8, 0x10000}, {0x7f, 0x6, 0x10001, 0x1000}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8}}}]}}, {{0x8, 0x1, r16}, {0x1b4, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r17}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xffff}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r18}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r19}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r20}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r21}}}]}}, {{0x8, 0x1, r22}, {0x180, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x1200}}, {0x8, 0x6, r23}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r24}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r25}}, {0x8}}}]}}, {{0x8, 0x1, r26}, {0x164, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r27}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r28}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x1000}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}]}}]}, 0x848}, 0x1, 0x0, 0x0, 0x81}, 0x20000000) getsockname$netrom(r0, &(0x7f0000000340)={{0x3, @null}, [@null, @rose, @bcast, @rose, @default, @netrom, @rose, @netrom]}, &(0x7f0000000300)=0x48) [ 1697.759483] binder: send failed reply for transaction 5399 to 29044:29053 [ 1697.799150] binder: undelivered TRANSACTION_COMPLETE 03:50:00 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:00 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c2235007fffffff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1697.819969] binder: 29082:29083 ioctl c018620b 0 returned -14 [ 1697.836199] binder: 29082:29083 unknown command -715358208 [ 1697.856155] binder: 29082:29083 ioctl c0306201 20000280 returned -22 03:50:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1697.896986] binder: 29088:29091 ioctl c018620b 0 returned -14 [ 1697.957422] binder: 29088:29099 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1697.985282] binder: 29088:29099 BC_FREE_BUFFER u0000000000000000 no match [ 1698.005730] binder: 29088:29099 got reply transaction with bad transaction stack, transaction 5402 has target 29088:0 [ 1698.036219] binder: 29088:29099 transaction failed 29201/-71, size 0-0 line 2756 [ 1698.050535] binder: 29088:29099 ioctl c0306201 20000480 returned -14 03:50:00 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:00 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350091320000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x48, 0x0, 0x0}) 03:50:01 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x2c) 03:50:01 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500ffffffff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00p\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0c0000001dd1a3ac56bc8301a6c99de6a3b3d436b572f50e69654dcab5ab461d54f9c64ec823f7cc6e3aed5961d89ff71a20cb6efc93bea8cf04ba8724e60ad001f2549a6cc8c635e0300725cd8d5e01ad22f0a8483d36431aea2cde51a560aff5b860e794103bfc359b9990f0e2c48327a5ddadfebe9d87639f1efd6fe8f797055230abe8631c11793ef52e613b523f44"], 0x1, 0x0, &(0x7f0000000040)='+'}) dup3(r1, r0, 0x0) [ 1698.692955] binder: send failed reply for transaction 5402 to 29088:29099 [ 1698.728333] binder: undelivered TRANSACTION_COMPLETE [ 1698.765721] binder_release_work: 4 callbacks suppressed [ 1698.765728] binder: undelivered TRANSACTION_ERROR: 29201 [ 1698.783380] binder: 29124:29134 ioctl c018620b 0 returned -14 [ 1698.791646] binder: undelivered TRANSACTION_ERROR: 29189 [ 1698.810314] binder: 29124:29134 unknown command 12 03:50:01 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0xf}, 0x0) 03:50:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000001"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1698.820052] binder: 29133:29137 ioctl c018620b 0 returned -14 [ 1698.830660] binder: 29124:29134 ioctl c0306201 20000280 returned -22 [ 1698.902461] binder: 29133:29142 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1698.921895] binder: 29133:29142 BC_FREE_BUFFER u0000000000000000 no match 03:50:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) dup3(r1, r0, 0x0) [ 1698.951248] binder: 29133:29142 got reply transaction with bad transaction stack, transaction 5405 has target 29133:0 [ 1698.991496] binder: 29133:29142 transaction failed 29201/-71, size 0-0 line 2756 03:50:01 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x23}, 0x0) 03:50:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500f0ffffff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1699.043370] binder: 29133:29142 ioctl c0306201 20000480 returned -14 [ 1699.169421] binder: 29154:29159 ioctl c018620b 0 returned -14 03:50:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0xffffff7f00000000, 0x0, 0x0}) 03:50:01 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}, 0x2c) 03:50:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000008"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:01 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x24}, 0x0) 03:50:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_aout(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="07010302bd5420ac15010000000400049e020000cf820700000000000000000000009e090000007a635348069638f95c52040f5de2a491fcf4e9ac000000000000005ebc7777f5092ad3be974af1931075e14eb208fab926678b7f27762fbcb837dea07b9c8c1ae46a6cbc21fa6384f7b6fb55d125db4bb2b32cfa72f16b9706542536e8a5f6657a02d180225e69eb03d745dbde365437375b2dfd61af2ebdf0f13918451d5806a72dc097d85a7582237239e3ed8a5a915b232e06e3c4f0c9ad5c54570d225b4beb32afb3cc6e5ed6db76a3cbe46b8a702fe87dcf99fd0b1f7931d6fd5bd645b466837fa3a67fc9e9357e9093a7d81ad045bc2c496603a002b0a512c9c12aceccb2a85c80f68d5d89160de680580000000000000000000000000000"], 0x42) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) r3 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x0, 0x80242) r4 = openat$cgroup_type(r3, &(0x7f0000000200)='cgroup.type\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_DEL(r3, 0x2, r4) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x240441, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)) r5 = dup3(r1, r0, 0x0) ioctl$EXT4_IOC_SETFLAGS(r5, 0x40086602, &(0x7f0000000180)) [ 1699.610973] binder: send failed reply for transaction 5405 to 29133:29142 [ 1699.627576] binder: undelivered TRANSACTION_COMPLETE [ 1699.634552] binder: undelivered TRANSACTION_ERROR: 29201 [ 1699.664831] binder: undelivered TRANSACTION_ERROR: 29189 [ 1699.689607] binder: 29171:29175 ioctl c018620b 0 returned -14 03:50:02 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x5000}, 0x0) 03:50:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000010"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1699.783879] binder: 29179:29180 ioctl c018620b 0 returned -14 03:50:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x2000, 0x0) syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x47566ae3, 0x8040) r3 = syz_open_dev$adsp(&(0x7f0000000140)='/dev/adsp#\x00', 0x10001, 0x4000c0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x4) pipe2(&(0x7f0000000180), 0x80000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) write$FUSE_GETXATTR(r2, &(0x7f00000001c0)={0x18, 0x0, 0x3, {0xfffffffffffffff7}}, 0x18) dup3(r1, r0, 0x0) [ 1699.850711] binder: 29179:29180 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1699.866679] binder: 29179:29180 BC_FREE_BUFFER u0000000000000000 no match 03:50:02 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x2c) [ 1699.944954] binder: 29179:29180 got reply transaction with bad transaction stack, transaction 5408 has target 29179:0 [ 1699.962650] binder: 29179:29180 transaction failed 29201/-71, size 0-0 line 2756 03:50:02 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x38}, 0x0) [ 1699.986453] binder: 29179:29180 ioctl c0306201 20000480 returned -14 [ 1699.998592] binder: 29193:29194 ioctl c018620b 0 returned -14 03:50:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x68000000, 0x0, 0x0}) 03:50:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000f00000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1700.073477] binder: send failed reply for transaction 5408 to 29179:29180 [ 1700.105456] binder: undelivered TRANSACTION_COMPLETE [ 1700.108816] binder: 29193:29194 ioctl c018620b 0 returned -14 03:50:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000f0ffff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:02 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x20000228}, 0x0) [ 1700.124558] binder: undelivered TRANSACTION_ERROR: 29201 [ 1700.145527] binder: undelivered TRANSACTION_ERROR: 29189 [ 1700.157788] binder: 29211:29213 ioctl c018620b 0 returned -14 03:50:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x0, 0x0) connect(r1, &(0x7f0000000100)=@llc={0x1a, 0x336, 0x7, 0x0, 0x9, 0x8000, @broadcast}, 0x80) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) r4 = dup3(r2, r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r4, 0x54a0) [ 1700.226086] binder: 29211:29220 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:02 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}, 0x2c) [ 1700.271358] binder: 29211:29220 BC_FREE_BUFFER u0000000000000000 no match [ 1700.295552] binder: 29211:29220 got reply transaction with bad transaction stack, transaction 5411 has target 29211:0 03:50:02 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x7ffffff7}, 0x0) 03:50:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1700.336026] binder: 29211:29220 transaction failed 29201/-71, size 0-0 line 2756 03:50:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\xfe\xff\xff\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1700.386204] binder: 29225:29232 ioctl c018620b 0 returned -14 [ 1700.408431] binder: 29211:29220 ioctl c0306201 20000480 returned -14 03:50:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x1, 0x0) ioctl$RTC_WIE_OFF(r1, 0x7010) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) r2 = dup3(r0, r0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x80000000) dup3(0xffffffffffffffff, r0, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0)='TIPC\x00') perf_event_open$cgroup(&(0x7f00000002c0)={0x1, 0x70, 0x1e, 0x4, 0x0, 0x20, 0x0, 0x3, 0x1101, 0x8, 0xfffffffffffffeff, 0x5, 0x7ff, 0xfffffffffffffffd, 0x0, 0x0, 0x6e2, 0x40, 0x5, 0x101, 0x7, 0xc536, 0xa77, 0x8, 0x2, 0x12f, 0x1, 0x5, 0x800000000, 0xc4, 0x7, 0x8001, 0x5, 0x40, 0x1, 0x3f, 0x8, 0x3, 0x0, 0xa95, 0x1, @perf_bp={&(0x7f0000000140), 0x1}, 0x20200, 0x6, 0x6, 0xf, 0x7f, 0x6, 0x7}, r2, 0xb, r1, 0x9) setsockopt$RDS_CANCEL_SENT_TO(r2, 0x114, 0x1, &(0x7f0000000240)={0x2, 0x4e20, @empty}, 0xfffffffffffffdcf) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x48000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r3, 0x0, 0x70bd28, 0x25dfdbfe, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x1}}, ["", "", ""]}, 0x24}}, 0x10) 03:50:03 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xfc00000000000000}, 0x0) 03:50:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000f0ffff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:03 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0xa000000, 0x0, 0x0}) 03:50:03 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x2c) [ 1700.959430] binder: send failed reply for transaction 5411 to 29211:29220 03:50:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500ffffff9e"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1701.004826] binder: undelivered TRANSACTION_COMPLETE [ 1701.013659] binder: undelivered TRANSACTION_ERROR: 29201 [ 1701.035454] binder: undelivered TRANSACTION_ERROR: 29189 03:50:03 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xff00000000000000}, 0x0) 03:50:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x67b7eb0c4746c291, 0x0) ioctl$KDSETLED(r3, 0x4b32, 0x100000000) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) dup3(r1, r0, 0x0) [ 1701.084214] binder: 29261:29268 ioctl c018620b 0 returned -14 03:50:03 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1701.147361] binder: 29261:29273 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1701.163001] binder: 29261:29273 BC_FREE_BUFFER u0000000000000000 no match [ 1701.197431] binder: 29261:29273 got reply transaction with bad transaction stack, transaction 5414 has target 29261:0 03:50:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350032910000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1701.256645] binder: 29261:29273 transaction failed 29201/-71, size 0-0 line 2756 [ 1701.279834] binder: 29277:29282 ioctl c018620b 0 returned -14 [ 1701.291720] binder: 29261:29273 ioctl c0306201 20000480 returned -14 03:50:03 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xfec00000}, 0x0) 03:50:03 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:03 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000]}, 0x2c) 03:50:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) r3 = dup3(r1, r0, 0x0) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r3, 0x84, 0x74, &(0x7f0000000000)=""/31, &(0x7f0000000100)=0x1f) ioctl$VIDIOC_S_DV_TIMINGS(r3, 0xc0845657, &(0x7f0000000140)={0x0, @reserved}) [ 1701.576827] binder: 29302:29307 ioctl c018620b 0 returned -14 03:50:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x6800, 0x0, 0x0}) 03:50:04 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xfe80}, 0x0) 03:50:04 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) dup3(r1, r0, 0x0) eventfd(0x5) 03:50:04 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000]}, 0x2c) [ 1701.879042] binder: send failed reply for transaction 5414 to 29261:29273 03:50:04 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x4}, 0x0) [ 1701.920656] binder: undelivered TRANSACTION_COMPLETE [ 1701.933916] binder: undelivered TRANSACTION_ERROR: 29201 [ 1701.954980] binder: undelivered TRANSACTION_ERROR: 29189 [ 1701.964756] binder: 29319:29323 ioctl c018620b 0 returned -14 03:50:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:04 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1702.005186] binder: 29325:29327 ioctl c018620b 0 returned -14 03:50:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500003f0000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6f553d2e79af00740200bab352e90530a2e906a692b97f8b6721e8af5a1902c0d05c185cb04fdd8af9e0fa67d526b63f6f491043167f2e23bdc9fe03774bded361f357eeac4b481f7bf38f62103ea62433d481993a81ddc97825ce7d06c9c0807a91df0f6868b05525"], 0x1, 0x0, &(0x7f0000000040)='+'}) dup3(r1, r0, 0x0) [ 1702.072286] binder: 29325:29334 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1702.136287] binder: 29325:29334 BC_FREE_BUFFER u0000000000000000 no match 03:50:04 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xfc00}, 0x0) [ 1702.207286] binder: 29325:29334 got reply transaction with bad transaction stack, transaction 5417 has target 29325:0 [ 1702.225579] binder: 29343:29344 ioctl c018620b 0 returned -14 [ 1702.260333] binder: 29343:29344 unknown command 775771503 [ 1702.277694] binder: 29325:29334 transaction failed 29201/-71, size 0-0 line 2756 [ 1702.304911] binder: 29343:29344 ioctl c0306201 20000280 returned -22 [ 1702.314828] binder: 29325:29334 ioctl c0306201 20000480 returned -14 03:50:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x7400000000000000, 0x0, 0x0}) 03:50:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:05 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:05 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x2c) 03:50:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="5d3c27deea7a000c000000000000dd00"], 0x1, 0x0, &(0x7f0000000040)='+'}) r3 = dup3(r1, r0, 0x0) modify_ldt$write(0x1, &(0x7f0000000000)={0x0, 0x0, 0x2000, 0x7e, 0xffffffff, 0x2, 0x81, 0x5fe, 0x1000, 0x1}, 0x10) mq_timedsend(r3, &(0x7f0000000100)="a55b8b404177f98915f7378c65f9f10335eb4e5dc955bf7d0c5c392ac265f0bbc495f1a542661d5bfe385beb80317df638c5a8d037c29250fc99f3e31a8a129433a0ea6d1cd0c0918968fe4f4c29933df774e523c253cae428", 0x59, 0x8000, &(0x7f0000000180)) 03:50:05 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x80fe}, 0x0) [ 1702.789886] binder: send failed reply for transaction 5417 to 29325:29334 [ 1702.829333] binder: undelivered TRANSACTION_COMPLETE 03:50:05 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xff00}, 0x0) 03:50:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000002"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1702.887674] binder: 29361:29366 ioctl c018620b 0 returned -14 [ 1702.920734] binder: 29361:29366 unknown command -567853987 [ 1702.944957] binder: 29364:29370 ioctl c018620b 0 returned -14 [ 1702.951033] binder: 29361:29366 ioctl c0306201 20000280 returned -22 03:50:05 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1703.021925] binder: 29364:29377 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c2235000000003f"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$DRM_IOCTL_INFO_BUFS(r2, 0xc0106418, &(0x7f0000000100)={0x3, 0x7, 0x3ff, 0x10001, 0x11, 0x6}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$EXT4_IOC_GROUP_EXTEND(r2, 0x40086607, &(0x7f0000000000)) dup3(r1, r0, 0x0) [ 1703.065421] binder: 29364:29377 BC_FREE_BUFFER u0000000000000000 no match 03:50:05 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x200000000000000}, 0x0) [ 1703.135706] binder: 29364:29377 got reply transaction with bad transaction stack, transaction 5420 has target 29364:0 [ 1703.217608] binder: 29364:29377 transaction failed 29201/-71, size 0-0 line 2756 [ 1703.246401] binder: 29364:29377 ioctl c0306201 20000480 returned -14 [ 1703.247238] binder: 29388:29393 ioctl c018620b 0 returned -14 03:50:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x2000000000000000, 0x0, 0x0}) 03:50:06 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000003291"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:06 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xfec0000000000000}, 0x0) 03:50:06 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x2c) 03:50:06 executing program 0: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rfkill\x00', 0xc040, 0x0) getdents(r0, &(0x7f0000000240)=""/62, 0x3e) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x80000, 0x0) ioctl$EVIOCGREP(r3, 0x80084503, &(0x7f0000000100)=""/203) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)='+'}) dup3(r2, r1, 0x0) [ 1703.711976] binder: send failed reply for transaction 5420 to 29364:29377 [ 1703.755696] binder: undelivered TRANSACTION_COMPLETE 03:50:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500fffffff0"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1703.776791] binder_release_work: 2 callbacks suppressed [ 1703.776798] binder: undelivered TRANSACTION_ERROR: 29201 [ 1703.801161] binder: 29402:29405 ioctl c018620b 0 returned -14 [ 1703.806058] binder: undelivered TRANSACTION_ERROR: 29189 03:50:06 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x2}, 0x0) [ 1703.836352] binder: 29407:29413 ioctl c018620b 0 returned -14 03:50:06 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:06 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000]}, 0x2c) [ 1703.900270] binder: 29407:29419 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1703.908026] binder: 29402:29417 ioctl c018620b 0 returned -14 [ 1703.916295] binder: 29407:29419 BC_FREE_BUFFER u0000000000000000 no match 03:50:06 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xc0fe}, 0x0) 03:50:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a5c1f023c126285719070") r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000780)='veth0_to_bond\x00', 0x10) connect$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000040), 0xfd6c) [ 1703.964953] binder: 29407:29419 got reply transaction with bad transaction stack, transaction 5423 has target 29407:0 [ 1704.028111] binder: 29407:29419 transaction failed 29201/-71, size 0-0 line 2756 [ 1704.093151] binder: 29407:29419 ioctl c0306201 20000480 returned -14 03:50:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x6000000000000000, 0x0, 0x0}) 03:50:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:07 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xfe80000000000000}, 0x0) 03:50:07 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:07 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendto$inet(r1, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) alarm(0x40) syz_open_dev$loop(0x0, 0x0, 0x105082) r2 = fcntl$getown(r1, 0x9) r3 = fcntl$getown(r0, 0x9) setpgid(r2, r3) syz_open_dev$sndpcmp(&(0x7f00000002c0)='/dev/snd/pcmC#D#p\x00', 0x0, 0x8040) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x7, 0x10}, &(0x7f0000000580)=0xc) setsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f0000000b00)) getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, &(0x7f0000000040)) r4 = syz_open_dev$sndseq(&(0x7f0000000c00)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, &(0x7f0000c6afa4)={0x0, 0x0, {0x2}}) 03:50:07 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}, 0x2c) [ 1704.635286] binder: send failed reply for transaction 5423 to 29407:29419 [ 1704.664878] binder: undelivered TRANSACTION_COMPLETE [ 1704.685801] binder: undelivered TRANSACTION_ERROR: 29201 [ 1704.701662] binder: undelivered TRANSACTION_ERROR: 29189 03:50:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:07 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x100000000000000}, 0x0) 03:50:07 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1704.812242] binder: 29449:29457 ioctl c018620b 0 returned -14 03:50:07 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendto$inet(r1, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) alarm(0x40) syz_open_dev$loop(0x0, 0x0, 0x105082) r2 = fcntl$getown(r1, 0x9) r3 = fcntl$getown(r0, 0x9) setpgid(r2, r3) syz_open_dev$sndpcmp(&(0x7f00000002c0)='/dev/snd/pcmC#D#p\x00', 0x0, 0x8040) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x7, 0x10}, &(0x7f0000000580)=0xc) setsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f0000000b00)) getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, 0x0, &(0x7f0000000040)) r4 = syz_open_dev$sndseq(&(0x7f0000000c00)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, &(0x7f0000c6afa4)={0x0, 0x0, {0x2}}) [ 1704.935620] binder: 29449:29465 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1704.958809] binder: 29449:29465 BC_FREE_BUFFER u0000000000000000 no match 03:50:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000fffff0"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:07 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x40000}, 0x0) [ 1704.990234] binder: 29449:29465 got reply transaction with bad transaction stack, transaction 5426 has target 29449:0 [ 1705.084650] binder: 29449:29465 transaction failed 29201/-71, size 0-0 line 2756 [ 1705.145013] binder: 29449:29465 ioctl c0306201 20000480 returned -14 03:50:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x4000000, 0x0, 0x0}) 03:50:07 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}, 0x2c) 03:50:07 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000f0ffff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:07 executing program 0: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='cgroup\x00', 0x0, 0x0) chdir(0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) lstat(0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x0, 0x0) msgsnd(0x0, 0x0, 0x0, 0x0) 03:50:07 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x2000000}, 0x0) [ 1705.619473] binder: send failed reply for transaction 5426 to 29449:29465 [ 1705.646362] binder: undelivered TRANSACTION_COMPLETE 03:50:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:08 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1705.677648] binder: undelivered TRANSACTION_ERROR: 29201 [ 1705.704675] binder: undelivered TRANSACTION_ERROR: 29189 03:50:08 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xff000000}, 0x0) [ 1705.773851] binder: 29496:29499 ioctl c018620b 0 returned -14 [ 1705.835392] binder: 29496:29499 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:08 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000ffffff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1705.890288] binder: 29496:29499 BC_FREE_BUFFER u0000000000000000 no match [ 1705.897654] binder: 29496:29499 got reply transaction with bad transaction stack, transaction 5429 has target 29496:0 03:50:08 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xfe800000}, 0x0) [ 1705.942855] binder: 29496:29499 transaction failed 29201/-71, size 0-0 line 2756 [ 1705.959334] binder: 29496:29499 ioctl c0306201 20000480 returned -14 03:50:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x20000000, 0x0, 0x0}) [ 1706.052744] binder: send failed reply for transaction 5429 to 29496:29499 [ 1706.063990] binder: undelivered TRANSACTION_COMPLETE [ 1706.076361] binder: undelivered TRANSACTION_ERROR: 29201 [ 1706.088972] binder: undelivered TRANSACTION_ERROR: 29189 03:50:08 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}, 0x2c) 03:50:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000100000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:08 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1706.134065] binder: 29525:29527 ioctl c018620b 0 returned -14 [ 1706.202114] binder: 29525:29536 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1706.225241] binder: 29525:29536 BC_FREE_BUFFER u0000000000000000 no match [ 1706.245137] binder: 29525:29536 got reply transaction with bad transaction stack, transaction 5432 has target 29525:0 [ 1706.260384] binder: 29525:29536 transaction failed 29201/-71, size 0-0 line 2756 [ 1706.274099] binder: 29525:29536 ioctl c0306201 20000480 returned -14 03:50:08 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6}]}, 0x10) 03:50:08 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xfc}, 0x0) 03:50:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000ffffff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:08 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:08 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x2c) 03:50:08 executing program 0: semctl$IPC_STAT(0x0, 0x0, 0x2, 0x0) mkdir(0x0, 0x0) clone(0x204200, &(0x7f0000000540), 0xfffffffffffffffe, 0x0, 0x0) 03:50:08 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x3f000000, 0x0, 0x0}) 03:50:09 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xfec0}, 0x0) 03:50:09 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:09 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000200000002000000e00000d903000000000000000800120002000200000000007d220000180000000303000000000300000000000000001f03000000160000000301000000000000000000ff0300000000000000030005000000000002000100000000e10000000000000000"], 0x80}}, 0x0) 03:50:09 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:09 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x2c) [ 1706.939179] binder: send failed reply for transaction 5432 to 29525:29536 [ 1706.969895] binder: undelivered TRANSACTION_COMPLETE [ 1706.982330] binder: undelivered TRANSACTION_ERROR: 29201 03:50:09 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c2235000000f000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:09 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1707.014890] binder: undelivered TRANSACTION_ERROR: 29189 [ 1707.038723] binder: 29585:29586 ioctl c018620b 0 returned -14 03:50:09 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xf7ffff7f00000000}, 0x0) 03:50:09 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = dup2(r0, r0) r2 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) syz_execute_func(&(0x7f0000000040)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e0066420fe2e33e0f1110c442019dccd3196f") r3 = fcntl$dupfd(r2, 0x0, r2) shutdown(r3, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000a00)='./file0\x00', 0x0, 0x0) r4 = open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) vmsplice(r4, &(0x7f0000000280)=[{&(0x7f0000000680)="cb", 0x1}], 0x1, 0x0) [ 1707.105733] binder: 29585:29593 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1707.112731] binder: 29585:29593 BC_FREE_BUFFER u0000000000000000 no match 03:50:09 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000913200"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1707.188264] binder: 29585:29593 got reply transaction with bad transaction stack, transaction 5435 has target 29585:0 03:50:09 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1707.255259] binder: 29585:29593 transaction failed 29201/-71, size 0-0 line 2756 [ 1707.274821] binder: 29585:29593 ioctl c0306201 20000480 returned -14 03:50:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x10000000, 0x0, 0x0}) 03:50:10 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xf7ffff7f}, 0x0) 03:50:10 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000020000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:10 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x2c) 03:50:10 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:10 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000001380)=0x4) recvmmsg(r0, &(0x7f0000003480)=[{{0x0, 0x0, &(0x7f0000002700)=[{&(0x7f0000001240)=""/75, 0x4b}], 0x1}}], 0x1, 0x0, 0x0) shutdown(r0, 0x0) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000300), 0x4) [ 1707.812704] binder: send failed reply for transaction 5435 to 29585:29593 [ 1707.855164] binder: undelivered TRANSACTION_COMPLETE 03:50:10 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:10 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x1000000}, 0x0) 03:50:10 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1707.953237] binder: 29631:29633 ioctl c018620b 0 returned -14 03:50:10 executing program 0: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b0000f4afd7030a7c", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000003140)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 1708.035052] binder: 29631:29641 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1708.047745] binder: 29631:29641 BC_FREE_BUFFER u0000000000000000 no match 03:50:10 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0xfc000000}, 0x0) [ 1708.075788] binder: 29631:29641 got reply transaction with bad transaction stack, transaction 5438 has target 29631:0 03:50:10 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x2c) [ 1708.122575] binder: 29631:29641 transaction failed 29201/-71, size 0-0 line 2756 [ 1708.148497] binder: 29631:29641 ioctl c0306201 20000480 returned -14 03:50:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x700, 0x0, 0x0}) 03:50:11 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:11 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:11 executing program 0: socket(0xe, 0x0, 0x7f) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) write$P9_RLINK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) timer_create(0x0, 0x0, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) getgid() listen(r1, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, 0x0) accept$unix(r1, 0x0, 0x0) connect$unix(r0, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) getpid() 03:50:11 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x4000000000000}, 0x0) 03:50:11 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x2c) [ 1708.745350] binder: send failed reply for transaction 5438 to 29631:29641 [ 1708.765023] binder: undelivered TRANSACTION_COMPLETE 03:50:11 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) [ 1708.788939] binder_release_work: 2 callbacks suppressed [ 1708.788946] binder: undelivered TRANSACTION_ERROR: 29201 [ 1708.823905] binder: undelivered TRANSACTION_ERROR: 29189 [ 1708.871406] binder: 29672:29679 ioctl c018620b 0 returned -14 03:50:11 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:11 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c2235000000f0ff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:11 executing program 0: r0 = syz_open_dev$video(&(0x7f00000000c0)='/dev/video#\x00', 0x5, 0x0) preadv(r0, &(0x7f0000000780)=[{&(0x7f0000000040)=""/109, 0x6d}], 0x1, 0x0) [ 1708.941578] binder: 29672:29685 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1708.952290] binder: 29672:29685 BC_FREE_BUFFER u0000000000000000 no match 03:50:11 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) [ 1709.010489] binder: 29672:29685 got reply transaction with bad transaction stack, transaction 5441 has target 29672:0 03:50:11 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}, 0x2c) [ 1709.061476] binder: 29672:29685 transaction failed 29201/-71, size 0-0 line 2756 [ 1709.094704] binder: 29672:29685 ioctl c0306201 20000480 returned -14 03:50:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x200000000000000, 0x0, 0x0}) 03:50:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:12 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:12 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:12 executing program 0: clone(0x3fe, &(0x7f0000000040), 0xfffffffffffffffe, 0x0, 0x0) 03:50:12 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}, 0x2c) [ 1709.674039] binder: send failed reply for transaction 5441 to 29672:29685 [ 1709.714701] binder: undelivered TRANSACTION_COMPLETE [ 1709.725561] binder: undelivered TRANSACTION_ERROR: 29201 [ 1709.750177] binder: undelivered TRANSACTION_ERROR: 29189 03:50:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000080000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:12 executing program 0: r0 = openat$selinux_create(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/create\x00', 0x2, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x6685) write$selinux_create(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="73797374656d657ca41d4ce11abfd93dab505f753a6f626a6563745f723a706f6c6963795f7372635f743a2073797374656d5f753a73797374656d5f72a98685b596af3048743a733020100000"], 0x4d) socket$netlink(0x10, 0x3, 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) write$UHID_INPUT(r1, &(0x7f0000001880)={0x8, "f5a68ff5b721a5de4ec10d79fbec0b4901c1211903adc48c79a88a78caa6b1ce317171b16fe550b3a3d21c1910284101fca086b01bbfe0526f8d36a43cfe4d60930c8b93bd1c92b7ce9f7d02c98b19ad4607a1159c7f24da24159bd691ff5bf53775a5059d63b6435190efe0a7c84bf22a27abe385c169c0b4b8618f8f444aa225a2bd3adb3c0b45a2152b0db3c0f563a5963d469844868784990f211817606e63b5e2a183762b7668287bcbe6ba640719e26be55240442564737bc8e0b6a395585acb0532134e879bffa6b7a3efa93fb2e5e82998eaa69223dda2bf27015ab80416b215eb1ca4dfde6d3a38675db4755521b43ea238c3eb321f168e53f7cdba28c6249cb8508d49a775e6c63cd82249f77eb73153d23712c1f421622c25b00873cf6d39dfb714c0a27e23a08d3cb95a3baa481cd5f59b385147119eb27c1c797b654efde3c0b84fc1021217377ab7cab850a8eac61d84a8f96587d0e014d2db6b3feebdddc522d8b6e4944cf855fb5f15c738f899500560aca02e0cf029e3b3e4facf16d2757ae178020bf972784421c6a5f09d377a774ba1d0150921dde8590b2ece70b0ac9376d19fe91cb610090d755b9a0220977ea9df341909a179c0e85f63718f66bc9ca38c0c31740820a8be259a6d7f5c0008ac67026840845fc103f73c29fc4fba6de98273e7c1feaf47dc3d952420370bd127c5a8f1a795a8e5420a071a8973fb82391e9f684c36c9c0a0c645c4ff1233c5fb6b67a442365af09fbb0e8cfc9440f4554e024f9ccb3161ce8f0ea301762bb591c92b8e785b10e8a266fcbcc262a49c57103a56f7b42db76eefc4f17a6b7b19cc158761f939b544ac704845600c6cfbd36906df82bdeb5dd39c8c59f16ba1529b80405d5ef2aa232cd18779a7ddea04a833c9b93f34312bdf536baaead5b3c8ea6fafa747f8bfd9d72d5138adb9ca3246eb1fd3df953a8a2f60ac436af0d587b78b6d767b1c110540831a603766d6dacf39cf14c0d1ec6bea100a47f651cf7d515cee9bc0b952c2cd61e2d448bc6745abc192101b0179c366993482c140d642f282919500d85e1daa921f37a79662823a4f4174d762f9affe2475ed6dc9b820e6ac99684903da5f19fb914bf71260ba60fb111f4732df99a284a33825e73ad21832f1c1769d26e966e542248f1e1a0a93fe0464f6d610853ec41a3b5efa2590ce7726c8aaef82e8e0341360aacaf8c4c142fc4d9dd15cff3c2a287a9832447ebcc78a690ca86df3d1a209c538a97f61f419a3e1ea9aac045ed619a34e9d792255f044676bbb51aba745a2688eaa8e0389ec82c7dfc1af899227d63cfecb3e722cac73efb3f36715f66f4f6a203012ad3d9c20b96fd017711b08bb13fa876c37866f68db04eab49f4fe5df21196ccbb1f65367e70e39fd74897251800cc334b3e67bd79c32f9e9d2ce9468a5336ed34c13926bae4b10e26c93062c21573f140b626e694a155022e10e629605532a665badf3dd0e706aab9885b46811a7f71b0d21636352a3a7f3e291dfad9f88df5524548c1ab2c025e50327fb09625b9af041cf3cf0abf99ebb529046dea4ae5a7c5eae6edf73ff73af23ae25f91373dd90f42f29e63e84f8c1fbba4ab7240ed92799cdbf1627353d0a3b83e0460b3b635f112b1fa81c3dfa834f6a5b93dc06f239d0338f463b1b9973bf9a6b371dd409c45a18114e7b0194065bf9db6d36496bc612db328bf5ac9e513ab282c841d6c282ad2e7ef97eac19f34442a28163f1e58b156a4f29a70f361694f3ba90caf6cd35b521a6fbafdfcd13d4a2dbabff3ad6f67b9f054eb7316d8418337bd8d29508f68bd88108e6ca5d1622efae6663882d19e44431832a1c01bb0df119a98c5623a7b7b79b8f9ec7c32c79f96888b1ce0f3cc6cfb4747f531c6a5a7cc6616fe05e2147a6e6211a8b1f4390954632b0f9bd1d2a9110b0c70ef24dba7706334c6e667b630a48d62977d9d3c91e4071f026d398f0ef41482d71649264805e83dc0b49ac40ccbe808dc45b277020c504d529566ef2102f839ef34e80c2138596f2d62b8208475a58f12a9e8253f4aecce1e7cdcd869c145eec4d5d944285225505698dea82da669c979e1a9223ddbb4701ea552477c6d260e419591e521a5c46cf016a07e005aeb7956360e2bdd996231e7584d0bea1a36dda708e57a6fc7817aaca7948222712f501ab99837a8882e6f903a7b53327f83b78b7e1cf312aabc161ebf464a053ac0c8714d1a10bf3d13ac3f821d49d0b1f839dd8c437b6ec4ae8957402c22341a651a6783dee38efe46b94deb3aa35da12946d2b6d8bd696c2688aef0ec97f98fb5bc61831d45c1c0d0b8776d4c22857e85647932371587d865218e741e0ba545393ebd4644623432dfe0bbc606d01cce67041b2aa5e4e6c2a275f7019983e2e00db7d3daea01008f22a454c538a317727cd5765dac13178edc13fbf78c1fdaf8253e3e40e594e8d3c4664df9127b742f18ed1d5a955150323c68365496750966eee9ede9da889adae384cc23b3b3b704ce9d32fd61f7c2810b3f7273adfe9d0ef1f6e6f77ea518169ae6115908c2455b208a1a0fcd435fc50c4bcbc8655e4b22177e791aa2611d4ab0eb3467609cff07d541bbe2b6595c6839c31902ed7f54307ce636beb99d9919849236b6a7d61298f5d8314fc5522b4c8b7019dd43f83b7e3f95fcb418f7b84fc26f0b709f20eb01b2577c7d43ec576c69961aa1d8c7ac4e6871d0ac09c6ac0063720282407af6ec9d2e6073fbfc3e9a59dde69dda814e7ee01fb60f53af4959fda201d8d442a4edfc8e96f8b6917173c3e98abc7b794794e51453138a4df71eadde7125769b13ef7b0c4477673d9ad101952ad8bd1f375c27e532cfc1a76db07f8f0dad43c777f1a0de1ec5f5fbb0f43a00f7844438395c93d1471b129132af4f29bc4f5c07bfe2edb6ccb03ba7073d66f18efff13668bf149a7bc3220b1f14452ae12e0fd1bb612059040affc406d1a7b0f1e4d570e7da813b87ba0e83f2be9a212b661ec7899b1e13ff2c2929651a942139db48ca4741f90081c9776dea49ac1baa85308667bf25bb0419a73ba26465d11e41ca946babca3394869e03297b08992837ebb979a47845fe2427689b5a99bac23ea484856c06f4a23f678afa7553a7b92141383277c5b2c69ecccd0b7fd29ca2fe60cdd25a9a5e01a44e8862422c3b46d6eef0e7dd095e468a2912266c402c529f312bd04d2e385298e9ab707ab1cd5b31b8c9ddae60330fd8b4b86a10267680a73126b775b984a908c7067ad3988ec620276bbab6320a2ef33e2a201ec34b11386f370fe5211c07b255247acb93b4ea916b6555719c21f50114823d5b7c8b8f87931948aa4b0e42de939aaeea5663d4a5989c85a677b428e9b1d1150dfe1ca4c954bbc68b81f50b7dc1313ff000b57a429d8e2577dc13105f0cc732f69577d40fe37ba87f2daec5b67ab476634f9a388eeeb9ac30fd86265aefea6b533e21ac05a74ff9e68abf04a7c1b0821ffcd0716a04c71d8b443844779182c775e56d750d197ca6621db276ef96750ccddede1d321f4bcf84b216db559095e4cbe836dd2f9e9b4f504ed9fa4040d51289ee52aea30a38086d6b9eac4e951835ca48985b35c30738cdbe264263780e0267b2384f54e9e604a404408d6faa487a3ebd234b31a97f009fca852da9312548cded347097c373267af175936eefeff58c60ce8d97b0a2c18d56cef1c6a88232bcda8a38c35f1b0af97869d438da448ee8fb4de828edd1e91987bedf4b8af4806437ba6bf0d114aeb4425eb54714c87ea6f18fa56b78f64d3a1247d6425a1bdb88118695e3e19edcd8d831b9c58a81961e24417f1e0fc6942d7c753034ded2a905745987badd20eb080a89db3dd126db163126abba345c19069bd5f1bbe58bdc73919ff2a583713bcc1d11dc1e1b38e972aeed2fe7d68af799c8469d6958ca10fd55007ec8e9183fc7a63d0e11b8ec3fbc44a08153279f941f621dde03d98f8d997201c9ac7df57f0e7084b50f20737dd5046536b022bc40af0215f4cbe80c8a967a03fa3a32814c09ee110f46bb579198fa4fc3a1b3a3c044b3441e7d0a605ab749bbf046619e5121c06697b67f129269236b3169ea0680b47e21729b4f55282777b17e1f9498982b23a6a20d75bb0343af48e2cb37d109cfd04a010a6b9f94025bdc2110d0ce77d96c0748fac497675813910e38fd2a4927d71b104d50297bfc81f8f717aa857d0be1956ef205f3e0a7222922ec76a3bc7d0d15f7ac7f1126ebcbbb69494869c3e519ac250e83287261eb65afd6112bf0697ad2d846d291ac390ce76c0e9182cbf51ffea17d53c41d4f1f01161608d30eca76aae4cfd24afc2c8cb61a962a351ae847a6957f9691057306e70ed32914578cc0e7644b843d415cb311a7460be240f2b5dd6b9561ccd862dd473398d571e19ad3d861502bdde17feba8e2dde9cc113be35f92a385403a935fa4f1b34d9a5c1f5802ca1fc4817a54a162c01b4ffeba9504fb911cd3b983e54ab2f3178e952852a0415fe332ce78f0881fe0b64e5e5bfb4563b8f0fa612bf4d0e973d1c3925bcea86dcdf17d074441e24c646d440813b181ab53ea91ef02673a7a21d4f993aef4bab0e0e9f6865818518e2a03f11567fecbc25d1c64edc8187b7116e23f8593d62cefee8f1a6ea083e881598174fdf4c89b24a862d878bfc07a8c056bd535a0387a5023705ffcd991a896bbe346e3eb094451e8b5e6ad513d5338705ef2334bb6be49627afb63149702f99c825454e064ae9d058f847dafe039d2f98dc0f37c19495346c45f72ba2d734c101ca1054987c7e1fa1a4c5b9a26106d0c0a6d8ddb7359b1636c3302e9aca519516fb8bca8cc940d11fa8332667ec9d822e2d790adccaaf9b779296e5ffdf944fd25a8da9f1663bf980b3ac45773404bc1945a1ea30f3f53d0c351451875b0c12fd57014c41c2540144d041f7077bd13b64e73d4cc81e30446933fba067a18b889b67d81bec29b6cce569509da0761445951e4fae53848ccdcb8ac08f013e49c91f7b0a76f0fed75dab32681c6b424f6ba56abbe15dbe3bb61f88c446531c97193bff1423181cdd94239743093fbbacb833296f360f82f4bfe57d70d992ce8bc71b8b8b6186552d347f5936dc4fffca2dfbdbe44ce5b4786e3e81120a6bcd7a5e19b008cf88c07eac09a887cc1d93e996218efbfcfb032bca1cc55488826ec3b03264f88662329ef30fa0d3875e093a3ec7a84004969b40858a637d48f2990612e2ed52883539a068f1945f1d12d452cddc2a78a6572eed51fc3e91c34331c2329bb506b4a866ed20756139be8681aa2847d7fcc242c1eff5fd8de8e7411ea8d3f063d3e69c18d74112a4cc3af413d0bc0184ba5d46f13fb4001151e0a522741faa7a030e63aabf1cdc729d7fdc10d687e559a0c76176dab6757ba6ad3b9008953fe6ecf7f978747a5f3d79ebbafbbeb468d439046ec42aec348cfdc48e589e4df7457fef22cca7c5863459f1604ae0faeb14e4c9c45554162626433f1bd71562454aba31d697fefe9bc50c0f12138dd11b6c0a0b562dc3b5b1097520e6a6fea8ca90cdac914121b729879b675db5f5c89f5599b3f146c9c5a2c6d11cf88ea302630df7474e806c997dd13e7b4c90c99feff125131ccb6e0cade9c002f547955398ed7e1123d54d8ef5c2f734254a0183d97393beea447d24e3a68fd388d716c124d2a1898c83930f9e31b350d3dfa0d601696dafb04cb34fd4a98acc19", 0x1000}, 0x1006) r2 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000280)={'bcsh0\x00', &(0x7f0000000080)=@ethtool_wolinfo={0x6, 0x4, 0xefaa, "adefa5747f8f"}}) dup2(r2, r1) fcntl$setstatus(r1, 0x4, 0x44003) dup(r1) io_setup(0x8, &(0x7f00000003c0)=0x0) readv(r1, &(0x7f0000000040)=[{&(0x7f0000000140)=""/197, 0xc5}], 0x1) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x2000}]) 03:50:12 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:12 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) [ 1709.807187] binder: 29717:29725 ioctl c018620b 0 returned -14 03:50:12 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]}, 0x2c) [ 1709.897555] binder: 29717:29725 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1709.930468] binder: 29717:29725 BC_FREE_BUFFER u0000000000000000 no match [ 1709.959802] audit: type=1804 audit(2000001012.320:220): pid=29736 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor0" name="/root/syzkaller-testdir203193030/syzkaller.df0qyo/1955/bus" dev="sda1" ino=18357 res=1 [ 1709.965913] binder: 29717:29725 got reply transaction with bad transaction stack, transaction 5444 has target 29717:0 03:50:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1710.065480] audit: type=1804 audit(2000001012.380:221): pid=29742 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor0" name="/root/syzkaller-testdir203193030/syzkaller.df0qyo/1955/bus" dev="sda1" ino=18357 res=1 [ 1710.114692] binder: 29717:29725 transaction failed 29201/-71, size 0-0 line 2756 [ 1710.154717] binder: 29717:29725 ioctl c0306201 20000480 returned -14 [ 1710.194307] audit: type=1804 audit(2000001012.380:222): pid=29742 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor0" name="/root/syzkaller-testdir203193030/syzkaller.df0qyo/1955/bus" dev="sda1" ino=18357 res=1 03:50:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x4800000000000000, 0x0, 0x0}) 03:50:12 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:12 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:12 executing program 0: 03:50:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1710.256672] binder: send failed reply for transaction 5444 to 29717:29725 [ 1710.264071] binder: undelivered TRANSACTION_COMPLETE [ 1710.294651] binder: undelivered TRANSACTION_ERROR: 29201 03:50:12 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) [ 1710.305327] binder: undelivered TRANSACTION_ERROR: 29189 03:50:12 executing program 0: 03:50:12 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}, 0x2c) 03:50:12 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1710.401080] binder: 29758:29766 ioctl c018620b 0 returned -14 [ 1710.465532] binder: 29758:29771 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1710.472547] binder: 29758:29771 BC_FREE_BUFFER u0000000000000000 no match 03:50:12 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) [ 1710.520850] binder: 29758:29771 got reply transaction with bad transaction stack, transaction 5447 has target 29758:0 03:50:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:12 executing program 0: [ 1710.562902] binder: 29758:29771 transaction failed 29201/-71, size 0-0 line 2756 [ 1710.637207] binder: 29758:29771 ioctl c0306201 20000480 returned -14 03:50:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x74000000, 0x0, 0x0}) 03:50:13 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:13 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000]}, 0x2c) 03:50:13 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:13 executing program 0: 03:50:13 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000ffffff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1711.202070] binder: send failed reply for transaction 5447 to 29758:29771 [ 1711.222345] binder: undelivered TRANSACTION_COMPLETE [ 1711.265048] binder: undelivered TRANSACTION_ERROR: 29201 [ 1711.276241] binder: undelivered TRANSACTION_ERROR: 29189 03:50:13 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:13 executing program 0: 03:50:13 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500007fffff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1711.334144] binder: 29799:29804 ioctl c018620b 0 returned -14 03:50:13 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1711.411937] binder: 29799:29811 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1711.463661] binder: 29799:29811 BC_FREE_BUFFER u0000000000000000 no match 03:50:13 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000329100"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:13 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) [ 1711.523039] binder: 29799:29811 got reply transaction with bad transaction stack, transaction 5450 has target 29799:0 [ 1711.544761] binder: 29799:29811 transaction failed 29201/-71, size 0-0 line 2756 [ 1711.562796] binder: 29799:29811 ioctl c0306201 20000480 returned -14 03:50:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x3000000, 0x0, 0x0}) 03:50:14 executing program 0: 03:50:14 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}, 0x2c) 03:50:14 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:14 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000003f00"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1712.132104] binder: send failed reply for transaction 5450 to 29799:29811 [ 1712.165251] binder: undelivered TRANSACTION_COMPLETE [ 1712.178030] binder: undelivered TRANSACTION_ERROR: 29201 03:50:14 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$jfs(&(0x7f0000000080)='jfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 03:50:14 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000f00000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1712.208745] binder: undelivered TRANSACTION_ERROR: 29189 03:50:14 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1712.258249] binder: 29840:29845 ioctl c018620b 0 returned -14 03:50:14 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500009effff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1712.372463] binder: 29840:29845 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1712.402469] binder: 29840:29845 BC_FREE_BUFFER u0000000000000000 no match 03:50:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1712.461153] binder: 29840:29845 got reply transaction with bad transaction stack, transaction 5453 has target 29840:0 [ 1712.562797] binder: 29840:29845 transaction failed 29201/-71, size 0-0 line 2756 [ 1712.604667] binder: 29840:29845 ioctl c0306201 20000480 returned -14 03:50:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0xfdfdffff, 0x0, 0x0}) 03:50:15 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:15 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/snmp\x00') preadv(r0, &(0x7f0000000480), 0x100000000000004b, 0x0) 03:50:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:15 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}, 0x2c) 03:50:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1712.709400] binder: send failed reply for transaction 5453 to 29840:29845 03:50:15 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000032"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1712.780719] binder: undelivered TRANSACTION_COMPLETE 03:50:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1712.884088] binder: 29890:29891 ioctl c018620b 0 returned -14 [ 1712.945748] binder: 29890:29891 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1712.991641] binder: 29890:29891 BC_FREE_BUFFER u0000000000000000 no match 03:50:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c2235000000f0ff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:15 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='cpuset\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x100020, 0x0) 03:50:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1713.041976] binder: 29890:29891 got reply transaction with bad transaction stack, transaction 5456 has target 29890:0 [ 1713.089314] binder: 29890:29891 transaction failed 29201/-71, size 0-0 line 2756 [ 1713.117000] binder: 29890:29891 ioctl c0306201 20000480 returned -14 03:50:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0xfdfdffff00000000, 0x0, 0x0}) 03:50:15 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:15 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x2c) 03:50:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:15 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x2) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)) [ 1713.218061] binder: send failed reply for transaction 5456 to 29890:29891 [ 1713.227818] binder: undelivered TRANSACTION_COMPLETE 03:50:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:15 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) [ 1713.327692] binder: 29928:29929 ioctl c018620b 0 returned -14 [ 1713.394688] binder: 29928:29938 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1713.434706] binder: 29928:29938 BC_FREE_BUFFER u0000000000000000 no match 03:50:15 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x2c) 03:50:15 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) [ 1713.445492] binder: 29928:29938 got reply transaction with bad transaction stack, transaction 5459 has target 29928:0 03:50:15 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb9b756d6b66732e666174000204010001fe0270fff8", 0x16}], 0x0, 0x0) 03:50:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1713.524799] binder: 29928:29938 transaction failed 29201/-71, size 0-0 line 2756 [ 1713.532725] binder: 29928:29938 ioctl c0306201 20000480 returned -14 [ 1713.613974] FAT-fs (loop0): bogus number of directory entries (766) [ 1713.653857] FAT-fs (loop0): Can't find a valid FAT filesystem [ 1713.731537] FAT-fs (loop0): bogus number of directory entries (766) [ 1713.742403] FAT-fs (loop0): Can't find a valid FAT filesystem 03:50:16 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:16 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:16 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]}, 0x2c) 03:50:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x7a000000, 0x0, 0x0}) 03:50:16 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x2c) [ 1714.103255] binder: send failed reply for transaction 5459 to 29928:29938 [ 1714.129366] binder: undelivered TRANSACTION_COMPLETE [ 1714.150039] binder_release_work: 4 callbacks suppressed [ 1714.150046] binder: undelivered TRANSACTION_ERROR: 29201 [ 1714.181527] binder: undelivered TRANSACTION_ERROR: 29189 03:50:16 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c2235000000ffff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:16 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) [ 1714.210011] binder: 29979:29980 ioctl c018620b 0 returned -14 [ 1714.295521] binder: 29979:29992 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1714.302526] binder: 29979:29992 BC_FREE_BUFFER u0000000000000000 no match 03:50:16 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:16 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c2235000000ffff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1714.375418] binder: 29979:29992 got reply transaction with bad transaction stack, transaction 5462 has target 29979:0 03:50:16 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}, 0x2c) [ 1714.510332] binder: 29979:29992 transaction failed 29201/-71, size 0-0 line 2756 [ 1714.540061] binder: 29979:29992 ioctl c0306201 20000480 returned -14 03:50:16 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000200"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:17 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]}, 0x2c) 03:50:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x7400, 0x0, 0x0}) 03:50:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:17 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:17 executing program 0: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "00000000fe80000000000000a40a000000"}], 0x28}, 0x0) 03:50:17 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}, 0x2c) [ 1715.000834] binder: send failed reply for transaction 5462 to 29979:29992 [ 1715.038406] binder: undelivered TRANSACTION_COMPLETE 03:50:17 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:17 executing program 0 (fault-call:1 fault-nth:0): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1715.063986] binder: undelivered TRANSACTION_ERROR: 29201 [ 1715.085895] binder: undelivered TRANSACTION_ERROR: 29189 [ 1715.089297] binder: 30032:30033 ioctl c018620b 0 returned -14 [ 1715.181158] binder: 30032:30044 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1715.212405] binder: 30032:30044 BC_FREE_BUFFER u0000000000000000 no match [ 1715.220206] FAULT_INJECTION: forcing a failure. [ 1715.220206] name failslab, interval 1, probability 0, space 0, times 0 03:50:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1715.279561] binder: 30032:30044 got reply transaction with bad transaction stack, transaction 5465 has target 30032:0 [ 1715.296172] CPU: 1 PID: 30047 Comm: syz-executor0 Not tainted 4.20.0 #167 [ 1715.303143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1715.312512] Call Trace: [ 1715.315122] dump_stack+0x1d3/0x2c6 [ 1715.318777] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1715.324001] should_fail.cold.4+0xa/0x17 [ 1715.328086] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1715.333212] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1715.338765] ? check_preemption_disabled+0x48/0x280 [ 1715.343800] ? find_held_lock+0x36/0x1c0 [ 1715.347878] ? graph_lock+0x270/0x270 [ 1715.351714] ? find_held_lock+0x36/0x1c0 [ 1715.355813] ? ___might_sleep+0x1ed/0x300 [ 1715.359980] ? arch_local_save_flags+0x40/0x40 [ 1715.364574] ? lock_downgrade+0x900/0x900 [ 1715.368739] ? lock_release+0xa00/0xa00 [ 1715.372760] __should_failslab+0x124/0x180 [ 1715.377036] should_failslab+0x9/0x14 [ 1715.380848] __kmalloc_track_caller+0x2d1/0x760 [ 1715.385549] ? udmabuf_ioctl+0x400/0x560 [ 1715.389632] memdup_user+0x2c/0xa0 [ 1715.393166] udmabuf_ioctl+0x400/0x560 [ 1715.397044] ? udmabuf_create+0xf70/0xf70 [ 1715.401192] ? ___might_sleep+0x1ed/0x300 [ 1715.405348] ? arch_local_save_flags+0x40/0x40 [ 1715.409931] ? udmabuf_create+0xf70/0xf70 [ 1715.414085] do_vfs_ioctl+0x1de/0x1790 [ 1715.417967] ? ioctl_preallocate+0x300/0x300 [ 1715.422370] ? selinux_file_mprotect+0x620/0x620 [ 1715.427133] ? __sb_end_write+0xd9/0x110 [ 1715.431540] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1715.437076] ? fput+0x130/0x1a0 [ 1715.440430] ? do_syscall_64+0x9a/0x820 [ 1715.444411] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1715.449941] ? security_file_ioctl+0x94/0xc0 [ 1715.454352] ksys_ioctl+0xa9/0xd0 [ 1715.457801] __x64_sys_ioctl+0x73/0xb0 [ 1715.461681] do_syscall_64+0x1b9/0x820 [ 1715.465563] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1715.470924] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1715.475859] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1715.480701] ? trace_hardirqs_on_caller+0x310/0x310 [ 1715.485713] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1715.490721] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1715.495731] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1715.500568] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1715.505774] RIP: 0033:0x457759 [ 1715.508960] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 03:50:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1715.527853] RSP: 002b:00007f89432e3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1715.535556] RAX: ffffffffffffffda RBX: 00007f89432e3c90 RCX: 0000000000457759 [ 1715.542929] RDX: 0000000020000080 RSI: 0000000040087543 RDI: 0000000000000003 [ 1715.550219] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1715.557491] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f89432e46d4 [ 1715.564755] R13: 00000000004c1b41 R14: 00000000004d3df8 R15: 0000000000000004 [ 1715.585849] binder: 30032:30044 transaction failed 29201/-71, size 0-0 line 2756 [ 1715.593578] binder: 30032:30044 ioctl c0306201 20000480 returned -14 03:50:18 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x2c) 03:50:18 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:18 executing program 0 (fault-call:1 fault-nth:1): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x300, 0x0, 0x0}) [ 1715.876440] binder: send failed reply for transaction 5465 to 30032:30044 [ 1715.890410] binder: undelivered TRANSACTION_COMPLETE [ 1715.905422] FAULT_INJECTION: forcing a failure. [ 1715.905422] name failslab, interval 1, probability 0, space 0, times 0 [ 1715.934712] binder: undelivered TRANSACTION_ERROR: 29201 [ 1715.940308] binder: undelivered TRANSACTION_ERROR: 29189 [ 1715.957911] binder: 30076:30078 ioctl c018620b 0 returned -14 [ 1715.967658] CPU: 0 PID: 30068 Comm: syz-executor0 Not tainted 4.20.0 #167 [ 1715.974636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 03:50:18 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) 03:50:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1715.984001] Call Trace: [ 1715.986611] dump_stack+0x1d3/0x2c6 [ 1715.990267] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1715.995488] should_fail.cold.4+0xa/0x17 [ 1715.999575] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1716.004712] ? is_bpf_text_address+0xd3/0x170 [ 1716.009230] ? kernel_text_address+0x79/0xf0 [ 1716.013675] ? find_held_lock+0x36/0x1c0 [ 1716.017773] ? ___might_sleep+0x1ed/0x300 [ 1716.021935] ? arch_local_save_flags+0x40/0x40 [ 1716.026537] ? graph_lock+0x270/0x270 [ 1716.030355] ? __x64_sys_ioctl+0x73/0xb0 [ 1716.034548] ? graph_lock+0x270/0x270 [ 1716.036428] binder: 30076:30081 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1716.038364] __should_failslab+0x124/0x180 [ 1716.038383] should_failslab+0x9/0x14 [ 1716.038399] kmem_cache_alloc_trace+0x2d7/0x750 [ 1716.038416] ? find_held_lock+0x36/0x1c0 [ 1716.050046] binder: 30076:30081 BC_FREE_BUFFER u0000000000000000 no match [ 1716.053380] udmabuf_create+0x16f/0xf70 [ 1716.053409] ? lock_release+0xa00/0xa00 [ 1716.053429] ? unmap_udmabuf+0x20/0x20 03:50:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1716.053462] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1716.083159] binder: 30076:30081 got reply transaction with bad transaction stack, transaction 5468 has target 30076:0 [ 1716.086881] ? _copy_from_user+0xdf/0x150 [ 1716.086911] udmabuf_ioctl+0x455/0x560 [ 1716.086929] ? udmabuf_create+0xf70/0xf70 [ 1716.086955] ? ___might_sleep+0x1ed/0x300 [ 1716.086970] ? arch_local_save_flags+0x40/0x40 [ 1716.086995] ? udmabuf_create+0xf70/0xf70 [ 1716.123010] do_vfs_ioctl+0x1de/0x1790 [ 1716.126947] ? ioctl_preallocate+0x300/0x300 03:50:18 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28, 0x0}, 0x0) [ 1716.130960] binder: 30076:30081 transaction failed 29201/-71, size 0-0 line 2756 [ 1716.131369] ? selinux_file_mprotect+0x620/0x620 [ 1716.143674] ? __sb_end_write+0xd9/0x110 [ 1716.147762] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1716.153331] ? fput+0x130/0x1a0 [ 1716.155088] binder: 30076:30081 ioctl c0306201 20000480 returned -14 [ 1716.157872] ? do_syscall_64+0x9a/0x820 [ 1716.157899] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1716.157916] ? security_file_ioctl+0x94/0xc0 [ 1716.157937] ksys_ioctl+0xa9/0xd0 [ 1716.181788] __x64_sys_ioctl+0x73/0xb0 03:50:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1716.185702] do_syscall_64+0x1b9/0x820 [ 1716.189608] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1716.194988] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1716.199931] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1716.204883] ? trace_hardirqs_on_caller+0x310/0x310 [ 1716.209907] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1716.214936] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1716.219979] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1716.224842] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1716.230356] RIP: 0033:0x457759 03:50:18 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xfc) [ 1716.233560] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1716.252475] RSP: 002b:00007f89432e3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1716.260201] RAX: ffffffffffffffda RBX: 00007f89432e3c90 RCX: 0000000000457759 [ 1716.267484] RDX: 0000000020000080 RSI: 0000000040087543 RDI: 0000000000000003 [ 1716.274768] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1716.282174] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f89432e46d4 [ 1716.289456] R13: 00000000004c1b41 R14: 00000000004d3df8 R15: 0000000000000004 03:50:18 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}, 0x2c) 03:50:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c2235000000f0ff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:18 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x100000000000000) 03:50:18 executing program 0 (fault-call:1 fault-nth:2): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1716.545889] FAULT_INJECTION: forcing a failure. [ 1716.545889] name failslab, interval 1, probability 0, space 0, times 0 [ 1716.594642] CPU: 1 PID: 30116 Comm: syz-executor0 Not tainted 4.20.0 #167 [ 1716.601646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1716.611011] Call Trace: [ 1716.613619] dump_stack+0x1d3/0x2c6 [ 1716.617280] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1716.622505] should_fail.cold.4+0xa/0x17 [ 1716.626586] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1716.631714] ? save_stack+0x43/0xd0 [ 1716.635331] ? kasan_kmalloc+0xc7/0xe0 [ 1716.639203] ? kmem_cache_alloc_trace+0x152/0x750 [ 1716.644145] ? udmabuf_create+0x16f/0xf70 [ 1716.648282] ? udmabuf_ioctl+0x455/0x560 [ 1716.652329] ? ksys_ioctl+0xa9/0xd0 [ 1716.655948] ? __x64_sys_ioctl+0x73/0xb0 [ 1716.660004] ? do_syscall_64+0x1b9/0x820 [ 1716.664064] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1716.669419] ? find_held_lock+0x36/0x1c0 [ 1716.673480] ? ___might_sleep+0x1ed/0x300 [ 1716.677614] ? arch_local_save_flags+0x40/0x40 [ 1716.682220] ? rcu_lockdep_current_cpu_online+0x1a4/0x210 [ 1716.687754] __should_failslab+0x124/0x180 [ 1716.691975] should_failslab+0x9/0x14 [ 1716.695764] __kmalloc+0x2e0/0x770 [ 1716.699306] ? kmem_cache_alloc_trace+0x353/0x750 [ 1716.704139] ? find_held_lock+0x36/0x1c0 [ 1716.708191] ? udmabuf_create+0x415/0xf70 [ 1716.712327] udmabuf_create+0x415/0xf70 [ 1716.716295] ? lock_release+0xa00/0xa00 [ 1716.720260] ? unmap_udmabuf+0x20/0x20 [ 1716.724164] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1716.729691] ? _copy_from_user+0xdf/0x150 [ 1716.733830] udmabuf_ioctl+0x455/0x560 [ 1716.737704] ? udmabuf_create+0xf70/0xf70 [ 1716.741843] ? ___might_sleep+0x1ed/0x300 [ 1716.745989] ? arch_local_save_flags+0x40/0x40 [ 1716.750564] ? udmabuf_create+0xf70/0xf70 [ 1716.754701] do_vfs_ioctl+0x1de/0x1790 [ 1716.758578] ? ioctl_preallocate+0x300/0x300 [ 1716.762975] ? selinux_file_mprotect+0x620/0x620 [ 1716.767723] ? __sb_end_write+0xd9/0x110 [ 1716.771773] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1716.777297] ? fput+0x130/0x1a0 [ 1716.780563] ? do_syscall_64+0x9a/0x820 [ 1716.784539] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1716.790072] ? security_file_ioctl+0x94/0xc0 [ 1716.794472] ksys_ioctl+0xa9/0xd0 [ 1716.797924] __x64_sys_ioctl+0x73/0xb0 [ 1716.801801] do_syscall_64+0x1b9/0x820 [ 1716.805678] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1716.811028] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1716.815942] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1716.820772] ? trace_hardirqs_on_caller+0x310/0x310 [ 1716.825784] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1716.830788] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1716.835796] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1716.840633] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1716.845808] RIP: 0033:0x457759 [ 1716.848988] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1716.867959] RSP: 002b:00007f89432e3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1716.875653] RAX: ffffffffffffffda RBX: 00007f89432e3c90 RCX: 0000000000457759 [ 1716.882919] RDX: 0000000020000080 RSI: 0000000040087543 RDI: 0000000000000003 [ 1716.890173] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1716.897435] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f89432e46d4 [ 1716.904687] R13: 00000000004c1b41 R14: 00000000004d3df8 R15: 0000000000000004 03:50:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x5, 0x0, 0x0}) 03:50:19 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:19 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xfe80000000000000) 03:50:19 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x2c) 03:50:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:19 executing program 0 (fault-call:1 fault-nth:3): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1716.948008] binder: send failed reply for transaction 5468 to 30076:30081 [ 1717.004748] binder: undelivered TRANSACTION_COMPLETE [ 1717.014809] binder: undelivered TRANSACTION_ERROR: 29201 [ 1717.020313] binder: undelivered TRANSACTION_ERROR: 29189 [ 1717.039398] FAULT_INJECTION: forcing a failure. [ 1717.039398] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1717.051347] CPU: 1 PID: 30132 Comm: syz-executor0 Not tainted 4.20.0 #167 [ 1717.058280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1717.067641] Call Trace: [ 1717.070248] dump_stack+0x1d3/0x2c6 [ 1717.073888] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1717.079091] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1717.084652] should_fail.cold.4+0xa/0x17 [ 1717.088728] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1717.093845] ? is_bpf_text_address+0xac/0x170 [ 1717.098350] ? lock_downgrade+0x900/0x900 [ 1717.102514] ? mark_held_locks+0x130/0x130 [ 1717.106764] ? rcu_softirq_qs+0x20/0x20 [ 1717.110765] ? rcu_softirq_qs+0x20/0x20 [ 1717.114745] ? unwind_dump+0x190/0x190 [ 1717.118661] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1717.124216] ? check_preemption_disabled+0x48/0x280 [ 1717.129243] ? kernel_text_address+0x79/0xf0 [ 1717.133656] ? debug_smp_processor_id+0x1c/0x20 [ 1717.138349] ? perf_trace_lock_acquire+0x15b/0x800 [ 1717.143306] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1717.148851] ? should_fail+0x22d/0xd01 [ 1717.152754] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1717.157873] __alloc_pages_nodemask+0x366/0xea0 [ 1717.162555] ? save_stack+0x43/0xd0 [ 1717.166201] ? kasan_kmalloc+0xc7/0xe0 [ 1717.170098] ? kmem_cache_alloc_trace+0x152/0x750 [ 1717.174949] ? __alloc_pages_slowpath+0x2df0/0x2df0 [ 1717.179974] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1717.185353] ? find_held_lock+0x36/0x1c0 [ 1717.189460] ? ___might_sleep+0x1ed/0x300 [ 1717.193621] ? trace_hardirqs_off+0xb8/0x310 [ 1717.198041] cache_grow_begin+0x91/0x8c0 [ 1717.202112] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1717.207662] __kmalloc+0x6aa/0x770 [ 1717.211215] ? kmem_cache_alloc_trace+0x353/0x750 [ 1717.216069] ? udmabuf_create+0x415/0xf70 [ 1717.220629] udmabuf_create+0x415/0xf70 [ 1717.224618] ? lock_release+0xa00/0xa00 [ 1717.228604] ? unmap_udmabuf+0x20/0x20 [ 1717.232532] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1717.238078] ? _copy_from_user+0xdf/0x150 [ 1717.242241] udmabuf_ioctl+0x455/0x560 [ 1717.246136] ? udmabuf_create+0xf70/0xf70 [ 1717.250293] ? ___might_sleep+0x1ed/0x300 [ 1717.254444] ? arch_local_save_flags+0x40/0x40 [ 1717.259050] ? udmabuf_create+0xf70/0xf70 [ 1717.263215] do_vfs_ioctl+0x1de/0x1790 [ 1717.267114] ? ioctl_preallocate+0x300/0x300 [ 1717.271536] ? selinux_file_mprotect+0x620/0x620 [ 1717.276295] ? __sb_end_write+0xd9/0x110 [ 1717.280372] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1717.285916] ? fput+0x130/0x1a0 [ 1717.289211] ? do_syscall_64+0x9a/0x820 [ 1717.293206] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1717.298753] ? security_file_ioctl+0x94/0xc0 [ 1717.303196] ksys_ioctl+0xa9/0xd0 [ 1717.306664] __x64_sys_ioctl+0x73/0xb0 [ 1717.310558] do_syscall_64+0x1b9/0x820 [ 1717.314448] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1717.319820] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1717.324759] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1717.329614] ? trace_hardirqs_on_caller+0x310/0x310 [ 1717.334643] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1717.339667] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1717.344697] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1717.349557] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1717.354754] RIP: 0033:0x457759 [ 1717.357955] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1717.376860] RSP: 002b:00007f89432e3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1717.384759] RAX: ffffffffffffffda RBX: 00007f89432e3c90 RCX: 0000000000457759 [ 1717.392035] RDX: 0000000020000080 RSI: 0000000040087543 RDI: 0000000000000003 [ 1717.399307] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 03:50:19 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xfe800000) 03:50:19 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1717.406578] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f89432e46d4 [ 1717.413856] R13: 00000000004c1b41 R14: 00000000004d3df8 R15: 0000000000000004 03:50:19 executing program 0 (fault-call:1 fault-nth:4): r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1717.478977] binder: 30131:30135 ioctl c018620b 0 returned -14 03:50:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:19 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xfc00) 03:50:20 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1717.552951] binder: 30131:30135 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1717.592741] binder: 30131:30135 BC_FREE_BUFFER u0000000000000000 no match [ 1717.634731] binder: 30131:30135 got reply transaction with bad transaction stack, transaction 5471 has target 30131:0 [ 1717.670473] binder: 30131:30135 transaction failed 29201/-71, size 0-0 line 2756 [ 1717.702764] binder: 30131:30135 ioctl c0306201 20000480 returned -14 03:50:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x500000000000000, 0x0, 0x0}) 03:50:20 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x2c) 03:50:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:20 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x7ffffff7) 03:50:20 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x5452, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1717.794933] binder: send failed reply for transaction 5471 to 30131:30135 [ 1717.802172] binder: undelivered TRANSACTION_COMPLETE [ 1717.807427] binder: undelivered TRANSACTION_ERROR: 29201 [ 1717.849080] binder: undelivered TRANSACTION_ERROR: 29189 03:50:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000003291"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:20 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x4000000000000) 03:50:20 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40049409, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1717.947752] binder: 30174:30176 ioctl c018620b 0 returned -14 03:50:20 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x2c) 03:50:20 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xf7ffff7f00000000) [ 1718.033062] binder: 30174:30190 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1718.053921] binder: 30174:30190 BC_FREE_BUFFER u0000000000000000 no match [ 1718.094215] binder: 30174:30190 got reply transaction with bad transaction stack, transaction 5474 has target 30174:0 [ 1718.126693] binder: 30174:30190 transaction failed 29201/-71, size 0-0 line 2756 [ 1718.162606] binder: 30174:30190 ioctl c0306201 20000480 returned -14 03:50:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x300000000000000, 0x0, 0x0}) 03:50:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c2235000000f000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:21 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40086602, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:21 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xfc00000000000000) 03:50:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:21 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x2c) [ 1718.722101] binder: send failed reply for transaction 5474 to 30174:30190 [ 1718.763061] binder: undelivered TRANSACTION_COMPLETE 03:50:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500000000f0"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:21 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x4020940d, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1718.860439] binder: 30217:30219 ioctl c018620b 0 returned -14 03:50:21 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x40000) 03:50:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:21 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x2, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1718.985544] binder: 30217:30230 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1719.015521] binder: 30217:30230 BC_FREE_BUFFER u0000000000000000 no match [ 1719.065103] binder: 30217:30230 got reply transaction with bad transaction stack, transaction 5477 has target 30217:0 [ 1719.115514] binder: 30217:30230 transaction failed 29201/-71, size 0-0 line 2756 [ 1719.154826] binder: 30217:30230 ioctl c0306201 20000480 returned -14 03:50:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x2000000, 0x0, 0x0}) 03:50:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:22 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x1000000) 03:50:22 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0xc0189436, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:22 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000]}, 0x2c) [ 1719.631331] binder: send failed reply for transaction 5477 to 30217:30230 [ 1719.684749] binder: undelivered TRANSACTION_COMPLETE [ 1719.695081] binder_release_work: 2 callbacks suppressed [ 1719.695088] binder: undelivered TRANSACTION_ERROR: 29201 03:50:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:22 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x5450, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:22 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xfec00000) 03:50:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1719.737882] binder: undelivered TRANSACTION_ERROR: 29189 [ 1719.747389] binder: 30254:30258 ioctl c018620b 0 returned -14 [ 1719.814414] binder: 30254:30265 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1719.850293] binder: 30254:30265 BC_FREE_BUFFER u0000000000000000 no match 03:50:22 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000]}, 0x2c) [ 1719.868062] binder: 30254:30265 got reply transaction with bad transaction stack, transaction 5480 has target 30254:0 [ 1719.901079] binder: 30254:30265 transaction failed 29201/-71, size 0-0 line 2756 03:50:22 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x5451, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1719.938231] binder: 30254:30265 ioctl c0306201 20000480 returned -14 03:50:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0xffffff7f, 0x0, 0x0}) 03:50:22 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xff00) 03:50:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00p\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:22 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40187542, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:22 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000]}, 0x2c) [ 1720.540121] binder: send failed reply for transaction 5480 to 30254:30265 [ 1720.590518] binder: undelivered TRANSACTION_COMPLETE 03:50:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1720.614922] binder: undelivered TRANSACTION_ERROR: 29201 [ 1720.619693] binder: 30292:30298 ioctl c018620b 0 returned -14 [ 1720.620428] binder: undelivered TRANSACTION_ERROR: 29189 03:50:23 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c2235000000ffff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:23 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xfec0) 03:50:23 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087602, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1720.715730] binder: 30292:30302 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1720.735775] binder: 30292:30302 BC_FREE_BUFFER u0000000000000000 no match [ 1720.778251] binder: 30292:30302 got reply transaction with bad transaction stack, transaction 5483 has target 30292:0 03:50:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:23 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000007fff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1720.831453] binder: 30292:30302 transaction failed 29201/-71, size 0-0 line 2756 [ 1720.850546] binder: 30292:30302 ioctl c0306201 20000480 returned -14 03:50:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x6, 0x0, 0x0}) 03:50:23 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x2) 03:50:23 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x80086601, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:23 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}, 0x2c) 03:50:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:23 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1721.424364] binder: send failed reply for transaction 5483 to 30292:30302 03:50:23 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xc0fe) [ 1721.474715] binder: undelivered TRANSACTION_COMPLETE [ 1721.490339] binder: undelivered TRANSACTION_ERROR: 29201 [ 1721.490741] binder: 30329:30336 ioctl c018620b 0 returned -14 [ 1721.514928] binder: undelivered TRANSACTION_ERROR: 29189 03:50:23 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c2235000000003f"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:23 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x5460, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1721.618928] binder: 30329:30344 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:24 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x200000000000000) [ 1721.674599] binder: 30329:30344 BC_FREE_BUFFER u0000000000000000 no match [ 1721.681622] binder: 30329:30344 got reply transaction with bad transaction stack, transaction 5486 has target 30329:0 03:50:24 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000009132"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1721.805982] binder: 30329:30344 transaction failed 29201/-71, size 0-0 line 2756 [ 1721.856541] binder: 30329:30344 ioctl c0306201 20000480 returned -14 03:50:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:24 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x80087601, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:24 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}, 0x2c) 03:50:24 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xfec0000000000000) 03:50:24 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000001000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x4, 0x0, 0x0}) [ 1722.297253] binder: send failed reply for transaction 5486 to 30329:30344 [ 1722.310211] binder: undelivered TRANSACTION_COMPLETE [ 1722.345703] binder: undelivered TRANSACTION_ERROR: 29201 [ 1722.351216] binder: undelivered TRANSACTION_ERROR: 29189 03:50:24 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xf7ffff7f) 03:50:24 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000009eff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1722.398693] binder: 30379:30380 ioctl c018620b 0 returned -14 03:50:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:24 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0xc0045878, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1722.487396] binder: 30379:30383 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1722.515459] binder: 30379:30383 BC_FREE_BUFFER u0000000000000000 no match 03:50:24 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xfc000000) [ 1722.568143] binder: 30379:30383 got reply transaction with bad transaction stack, transaction 5489 has target 30379:0 03:50:25 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:25 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x4b47, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:25 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000]}, 0x2c) [ 1722.660279] binder: 30379:30383 transaction failed 29201/-71, size 0-0 line 2756 [ 1722.684683] binder: 30379:30383 ioctl c0306201 20000480 returned -14 03:50:25 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:25 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x5421, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:25 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xfe80) 03:50:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x2000, 0x0, 0x0}) 03:50:25 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c2235000000ffff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:25 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:25 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x4b49, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:25 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x80fe) 03:50:25 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000]}, 0x2c) [ 1723.181182] binder: send failed reply for transaction 5489 to 30379:30383 [ 1723.198910] binder: undelivered TRANSACTION_COMPLETE [ 1723.222396] binder: undelivered TRANSACTION_ERROR: 29201 [ 1723.254558] binder: undelivered TRANSACTION_ERROR: 29189 03:50:25 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0xc020660b, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:25 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xff00000000000000) 03:50:25 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000800"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1723.280128] binder: 30432:30437 ioctl c018620b 0 returned -14 03:50:25 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1723.348314] binder: 30432:30441 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1723.393682] binder: 30432:30441 BC_FREE_BUFFER u0000000000000000 no match 03:50:25 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x2000000) [ 1723.441906] binder: 30432:30441 got reply transaction with bad transaction stack, transaction 5492 has target 30432:0 [ 1723.473026] binder: 30432:30441 transaction failed 29201/-71, size 0-0 line 2756 03:50:25 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0xc0045878, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1723.509066] binder: 30432:30441 ioctl c0306201 20000480 returned -14 03:50:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x1000000000000000, 0x0, 0x0}) 03:50:26 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x2c) 03:50:26 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500000000f0"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:26 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x541b, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:26 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:26 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0xff000000) [ 1724.070360] binder: send failed reply for transaction 5492 to 30432:30441 [ 1724.113414] binder: undelivered TRANSACTION_COMPLETE 03:50:26 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x4) 03:50:26 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x2, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:26 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1724.195447] binder: 30474:30478 ioctl c018620b 0 returned -14 03:50:26 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:26 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) prctl$PR_GET_SECUREBITS(0x1b) 03:50:26 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}, 0x2c) [ 1724.271189] binder: 30474:30485 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1724.310178] binder: 30474:30485 BC_FREE_BUFFER u0000000000000000 no match [ 1724.358371] binder: 30474:30485 got reply transaction with bad transaction stack, transaction 5495 has target 30474:0 [ 1724.390205] binder: 30474:30485 transaction failed 29201/-71, size 0-0 line 2756 [ 1724.415053] binder: 30474:30485 ioctl c0306201 20000480 returned -14 03:50:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x4c000000, 0x0, 0x0}) 03:50:27 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500000000f0"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:27 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x100000000000000, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:27 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x0, 0x2) getsockopt$inet6_tcp_buf(r1, 0x6, 0x1d, &(0x7f0000000140)=""/93, &(0x7f00000001c0)=0x5d) getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 03:50:27 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:27 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x2c) [ 1724.972134] binder: send failed reply for transaction 5495 to 30474:30485 [ 1725.007787] binder: undelivered TRANSACTION_COMPLETE [ 1725.031882] binder_release_work: 2 callbacks suppressed [ 1725.031889] binder: undelivered TRANSACTION_ERROR: 29201 [ 1725.064793] binder: undelivered TRANSACTION_ERROR: 29189 03:50:27 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:27 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:27 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x200000000000000, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1725.084406] binder: 30511:30515 ioctl c018620b 0 returned -14 03:50:27 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="280000000000000029c3000002000000000000000000000000000000b0a6cf32c8c4f94354abbfb3"], 0x28}, 0x0) [ 1725.155075] binder: 30511:30523 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1725.193470] binder: 30511:30523 BC_FREE_BUFFER u0000000000000000 no match 03:50:27 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1725.245969] binder: 30511:30523 got reply transaction with bad transaction stack, transaction 5498 has target 30511:0 03:50:27 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500000000ff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1725.309781] binder: 30511:30523 transaction failed 29201/-71, size 0-0 line 2756 [ 1725.354752] binder: 30511:30523 ioctl c0306201 20000480 returned -14 03:50:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x4c00, 0x0, 0x0}) 03:50:28 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:28 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="28000000000000002900000012000091000000000000800000000000000000407f010000cdf8d8ba2c4f2256b3a057967f9c9d8e2f58470d8c19e3e81c216a159fd8418719163ffdfe7991c05e5c1e043e3c55dd2a34d1daf89bd0163d71c79782a1b71b4c8bf01d7acd5fbe646bb3f2d4bc9c408f581504ecf4c14f3eac0b1f1a610a12f27a90ee5751d2cc917144d8b4037317c8022e67cea54be63fd456db971318cb0b60323c6239670c683b765a233f0a8f1186809f2cd8b38b2657d30f7311e709f40f3e296a1b020ceb48520be7f501e5ec1ae17ddadb7a45d15af3b1115e4d576ce610d933c09cc9b11ee8e6708d1cb1e2d8cc42f0efcd07dbe4c0b9c1fd826d7d67a25b9e6e45287780c263ff15c0"], 0x28}, 0x0) 03:50:28 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x1000000, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:28 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:28 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x2c) [ 1725.865979] binder: send failed reply for transaction 5498 to 30511:30523 [ 1725.873520] binder: undelivered TRANSACTION_COMPLETE [ 1725.928288] binder: undelivered TRANSACTION_ERROR: 29201 [ 1725.952412] binder: undelivered TRANSACTION_ERROR: 29189 03:50:28 executing program 1: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f00000000c0)={0x8, 0x3, 0x200, 0x2, 0x80000000}) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:28 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x2000000, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:28 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500000000f0"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1726.030265] binder: 30555:30562 ioctl c018620b 0 returned -14 03:50:28 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1726.115491] binder: 30555:30562 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1726.164734] binder: 30555:30562 BC_FREE_BUFFER u0000000000000000 no match 03:50:28 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) io_setup(0x40, &(0x7f0000000080)) 03:50:28 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000008"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1726.214479] binder: 30555:30562 got reply transaction with bad transaction stack, transaction 5501 has target 30555:0 [ 1726.293670] binder: 30555:30562 transaction failed 29201/-71, size 0-0 line 2756 [ 1726.330190] binder: 30555:30562 ioctl c0306201 20000480 returned -14 03:50:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x600000000000000, 0x0}) 03:50:28 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x300, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:28 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:28 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x2c) 03:50:28 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500000000f0"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1726.363176] binder: send failed reply for transaction 5501 to 30555:30562 03:50:28 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x118, r1, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfe}]}, @TIPC_NLA_SOCK={0x14, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1000}]}, @TIPC_NLA_LINK={0xe4, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1010}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3de}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffff000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6fd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fffffff}]}]}]}, 0x118}, 0x1, 0x0, 0x0, 0x4004800}, 0x40080) r2 = socket$kcm(0xa, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x406, r2) accept4$ax25(r3, 0x0, &(0x7f0000000080), 0x80800) sendmsg$kcm(r2, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(r3, 0xc008640a, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f0000000100)={r4, 0x0, r3}) [ 1726.414715] binder: undelivered TRANSACTION_COMPLETE [ 1726.426698] binder: undelivered TRANSACTION_ERROR: 29201 [ 1726.450412] binder: undelivered TRANSACTION_ERROR: 29189 03:50:28 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0xffffff1f, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1726.498091] binder: 30596:30602 ioctl c018620b 0 returned -14 03:50:28 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:28 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:28 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x2c) 03:50:29 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x40400, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r2, 0x0, 0x70bd2a, 0x25dfdbff, {{}, 0x0, 0x4107, 0x0, {0x14, 0x18, {0x1, @bearer=@l2={'ib', 0x3a, 'team0\x00'}}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x8004) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000280)=@req={0xffffffff, 0x80000000, 0x3, 0x1}, 0x10) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000240)={0x1, 'rose0\x00'}, 0x18) [ 1726.601399] binder: 30596:30613 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1726.632274] binder: 30596:30613 BC_FREE_BUFFER u0000000000000000 no match 03:50:29 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x2, 0x0, 0x1000000}]}) [ 1726.664713] binder: 30596:30613 got reply transaction with bad transaction stack, transaction 5504 has target 30596:0 [ 1726.705448] binder: 30596:30613 transaction failed 29201/-71, size 0-0 line 2756 03:50:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0xa000000, 0x0}) 03:50:29 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:29 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="28000000006e883c0dfdf5327200000000000000000000a0ffffffffa30a00000000000000000000"], 0x28}, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x400, 0x0) connect$l2tp(r1, &(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @rand_addr=0x7}, 0x2, 0x0, 0x2, 0x2}}, 0x26) 03:50:29 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:29 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x100000000000000, 0x0, 0x1000000}]}) 03:50:29 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x2c) [ 1727.286651] binder: send failed reply for transaction 5504 to 30596:30613 [ 1727.314658] binder: undelivered TRANSACTION_COMPLETE [ 1727.326909] binder: undelivered TRANSACTION_ERROR: 29201 [ 1727.359556] binder: undelivered TRANSACTION_ERROR: 29189 03:50:29 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000002"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:29 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1727.412220] binder: 30643:30651 ioctl c018620b 0 returned -14 03:50:29 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0xfc80, 0x2000) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:29 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x200000000000000, 0x0, 0x1000000}]}) [ 1727.480621] binder: 30643:30651 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:29 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:29 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}, 0x2c) [ 1727.561242] binder: 30643:30651 BC_FREE_BUFFER u0000000000000000 no match [ 1727.614815] binder: 30643:30651 got reply transaction with bad transaction stack, transaction 5507 has target 30643:0 [ 1727.656744] binder: 30643:30651 transaction failed 29201/-71, size 0-0 line 2756 03:50:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x5000000, 0x0}) 03:50:30 executing program 1: r0 = socket$kcm(0xa, 0x5, 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.origin\x00', &(0x7f0000000100)='y\x00', 0x2, 0x3) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:30 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x1000000, 0x0, 0x1000000}]}) 03:50:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500000000ff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1727.739550] binder: send failed reply for transaction 5507 to 30643:30651 [ 1727.749162] binder: undelivered TRANSACTION_COMPLETE [ 1727.800011] binder: undelivered TRANSACTION_ERROR: 29201 [ 1727.825536] binder: undelivered TRANSACTION_ERROR: 29189 03:50:30 executing program 1: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dlm-monitor\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0)='tls\x00', 0x4) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000100)=0x10) r1 = socket$kcm(0xa, 0x2, 0x0) execveat(r0, &(0x7f0000000140)='./file0\x00', &(0x7f00000003c0)=[&(0x7f0000000180)='tls\x00', &(0x7f0000000340)='ppp0+vmnet0\x00', &(0x7f0000000380)='md5sumvmnet0posix_acl_access\x00'], &(0x7f0000000600)=[&(0x7f0000000400)='tls\x00', &(0x7f0000000440)='/dev/dlm-monitor\x00', &(0x7f0000000480)='/dev/dlm-monitor\x00', &(0x7f00000004c0)='tls\x00', &(0x7f0000000500)='/dev/dlm-monitor\x00', &(0x7f0000000540)='tls\x00', &(0x7f0000000580)='tls\x00', &(0x7f00000005c0)='+vmnet0\x00'], 0x1000) sendto$llc(r0, &(0x7f0000000240)="c87f8d57a88c3580fcde8cb8cda0b6692f6f44f6593f076333c11078ed9fccb98a47864ed9f2760d91cd4cd5197d5445eaf7972876aaa8ec958487607054bb6cddc7adaf0a30a97ef1e8e1922290172b227f74bfe088778feb37980fe10debb587fa6dcdd6b4a3bfe91f133106299a412dfeb3a308e5444f5bc7e282e90f916642244c2dcbc6703a5973423c8e12c77637fc97983c6ad002fae493b0e9a3685dc9d45c5ed5c2c454578d918b1e0398f5e93f80674ed08a6c98640cdbcc8c0c7ab501fac0b021fa15b9a9de172b15719c09f733ce92e6d3d3653146d9d72c7d1439b0534ab3c093d31896ee5db8c121", 0xef, 0x8000, &(0x7f0000000080)={0x1a, 0x312, 0x200, 0xffffffffffffff06, 0x7ff, 0x6}, 0x10) sendmsg$kcm(r1, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="28000000000000002900000002000000000000000000000000000000a40a00000000010000000000"], 0x28}, 0x0) 03:50:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1727.892713] binder: 30688:30690 ioctl c018620b 0 returned -14 03:50:30 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x2000000, 0x0, 0x1000000}]}) 03:50:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500000000ff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1727.981339] binder: 30688:30701 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1727.989917] binder: 30688:30701 BC_FREE_BUFFER u0000000000000000 no match [ 1728.018528] binder: 30688:30701 got reply transaction with bad transaction stack, transaction 5510 has target 30688:0 03:50:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:30 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="28000000000000002900000002000000000000000000000000000000a4fdffffff00000000000000"], 0x28}, 0x10) [ 1728.076341] binder: 30688:30701 transaction failed 29201/-71, size 0-0 line 2756 03:50:30 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000]}, 0x2c) 03:50:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x3f00, 0x0}) 03:50:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000091"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:31 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x2, 0x1000000}]}) 03:50:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:31 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) r1 = dup(r0) ioctl$sock_bt_hci(r1, 0x400448e3, &(0x7f0000000240)="e38b19540042264f82d64ee212d899d62d91f954049531d7ce15afb99f90d2f7c7d907e33d139df2b8b14fe5d7cf6b75334744ce3d2363e1c499578606a7a3af9dd81809cf254e22d10c6ebd2743ebcd61d7afad9056c2e0c721169a3f58dad5b0c8f46ac471bbf7d8ec21dc46f3c39e40d5afca23f540042826fca7a41d08443e896dea0794a1e39279ca232d79a64df39ea0ae807cb343f6cf2a9e72971f2c38385af4717941d1fc190a2199f7ae6da89979a7788eccc58500a3a9cfc9057da8455fb710b39418dd410b9be698a0ecbe9fe1c0a7a30a24e46bcf8e0f0e48f2cde4e8ac027053dad9868f6a3c6c056bcbfa9a7fb652445fca0aa8fc8fcce57c49b09985dbbeb502a3556e05f27e730383cb6cac7691595171014b0dc29a5029c2642908361181e65fc8827c8f533392e0e6ed38ea66aede1fb764f3eebc14bbd0fa29c6b84cb4c924e8e58551cc17dd09101b5597e2ecc55acda307fa9213eec7456a5f9633be20a99b7e7470021d2f2c3e598089c709b1e1176d892a167e3037a5e28a96af01bab92921bd57c6181dfee76784151c063ded89ad98b6134c7ab224e47985acfac87ca6237451322bf245cf27b7ad339b1b0d38a500a16965da454d944b838d55452dae14e6f23d570085ecd59b03d7930d26c95a7ffb612c9014405a6216513c481e7cc21809cb702ae84df1922ff8134624eb350f0c09e5e718b5969688e6588f954eedbb98376e390e352afc8104d47780e7937a705d4034588ca46f00314655dc0ab7194e52337301f679f990575fc0ef7a2afc0bee8e60df8a83c2270446c1eff4cf86307d6f41cdf56694c04e12438b7ad0344fd75efb6823651b97be316f9ba9b0b5e09369407fc19a6ff5c80b8c3558551d0543f9e4093421979326bac16231fc4459968bb2777b7320aef991c65311b02764fa76b5f617f137aa643fd7495c47d4dca1e1ae5262d175cf488cc1ea924162cd2c07dcbb3a3aeb28682a73082f15ebf46508a6b0f417b740c4917d6b2956b903fa82958af2d7dc30a4bb2687f0ed88f9a1ae202fb5efdadfca943218491a34b028f7a9624242620b70c9105f2e0ccf06ba768e81925c0e2455abde8f39f8bd859db4177e6eed3aaf161cb2b88b837a12114afed3394c4c120b562bc0ab99c62797440057eaa27c6ae33239467fe46668115a595a7a0939146b6310cb98f05e5315f9b8f2667b41537550b698f97fc2b3c2dbe2c6d5cfdbacf010a371e7b6735030bc2ba5a9c9d08076af6a54b8d5e57139d5d9caf66d0bfd4105da79c724eb006d515cada1422c6c63c3b5ae399601f37cd880c6126c891997299aa5ed634167ef90a8f4bdc168a98e69365c6807b265ea5b341a15bac3b2321a0c8b75b840027296404b927fae67427e4ba78ce6ad801b18807df277edf936e2a9b03489a39c451c6144132f7586d99310d93bbd6b67db1b3d7889faef95a68bd748052fae386c95bcdb15dde09b7a9ad88da31feafadc9e3a04540af0124323427b130a7edb3fa15f3f2d9c639d4f5474a782c4a29298c12d4e497cd1747d2a57257c8ef06f4ef8720ef010911f6cfbf95eb9548895c24e08ee1c63fc4527ecd09e2c74f020f3f6336e6b44d00df346edad280105c583a3be211fa35a28e0369ee57fb5e1d3ff99b5634eb8950f4302f5ce484e556970af1e521336027a7fa64e2f7e6de5d9527740a32b2d03484b06c54355a343d5d03010698e2cb730b41a9f8fb2860df55ecf64693bad4de96df47d3d88ba11d68e240ebbbeb22ea7f908d25c57b44ba8f6d10f976e292151380d2b05f80965457df36fc31688ffbe139a7ea31a9e8b986fb7d777b2752358c01a94065df02314401245b1f3cd1ea42df80502e35d23e57c71282cdc303a95ce69aa33689b03208a5fd0142e077b2e31826cbdc1b774cb8a41247090ac88423e8d8a86324b94abe6dc79046bff35e6cb4b8a325676d9264adacd76db57121262d9a55c22a787016af1c96dbbb757dc631f069846ef299c0a84fba9c49b0d3e5b197d1ecae51df22d58f42f6d87cc017354ce8dbea7a16b6329a185cd548978ca363f48af4120a7b4343e157306daf458ee77acf9c9f37492fcd5b9335fad2ddf1f6e586497f746cb389a5ad647aa8fee476d446273bb7f28ebd1affeea1f926aafb70bf259a8c78076972203f743b97ad2b218683a7055d526e82d857f318d274af7e7aacc0376f3a4d1ed3175275572cda60abf9ef395aa815dd730a1356023789f92e991dd3efefcee1aa3c92a7078771adfbc0c37493deba4e444a38e55c2415ba77b2d1f4fe7c7baae6b80422fce15d68fb5e0830140a2b78fe24b9aaf80a4d82e514171b6c485de2181cc695635a455b867a183c6a3c930f60a1f54a730d7c6895ce881c15e37d3452596108b68b23ffaacbb556beaa067e540ffa739fc6cb388e2473d64b96b18bde8ca9ab1659bd46cbc9f61139ee8a3a95a4314ce3a459ba0aeff8f7718511ef45c8d888d647e04ee0d456bf6df819be8136b57ee92e316b693b7dc2b2e473de4e600659f38b8de3679d832fa3fc11ac24f073f8ebf3f1608bbac104185e58f765a3cafe6a8c6d9a96db8c26145570d0d9a7e5f9549f00a2ec4d07481bab83c1c8a5f482e69f5d5f6473439d40f0e945d44c51a637da37c12e82251b43dadaebb6d4461a1ef41e5764507c58e07bf3e6c238ed90249621b3480d8f5c4138553aa5c00f0c8a786a7bc8b7427ed28edb1bb52bb6238c0e0d8be536ac10d2674de5efe864e86299d958841d1b40c0382a864f2aed84e18f239714541663b4864a5d2e475e67385869f0affbc6d883e87e2f414fbdcfc8b0af7f61443a1cc0567565e61b11f77ed41dee290d79c99fb14fae3906acbe3a7e29ccfd42b37994ed4b0096fe06cca436171d45d35223f55cfcc0b396f792fd578008e779a7fe72f7dd78dc92afb987d37ec0fd2ae20a23e5b9fc3d6076a8f05171e3d4164fe8e99e0b2e454450e4edcb6346da27f509d6c8b683a07a9f1b3dd2001c850effcba4ba7309754877e953630bce54c597727da25da333a9ed188ebe7289042497db933d8ac6fe24be34bcfef6cdad2736e9f45715d844b916113404719904d69b325ea170755847c2cdaafdac094ca8ab4fff8ca5823028cdb10c7854411b660209bd3bd3013e434dda763ef81ee52c942a6de00f4871e7f2466175eb5f14b7072320d1da863c07e5112a0e0c35e97970a4496365e607eb659504fb3cb3bcb1299fad1cf5a1f79a0f53496e6dc488a29972239b6b9f10816196937f6e9541b9b99dcab6d8db5d5d320decba9e5bd2ed9ad1dcfd22631d0ddf836de18d89a0f612539f35c50fc515e94cf0e0a052c83ac5ade0f35c8c550ab34a032f26cc8257eab7ee4aa704e3b6c482a6bbc567aa082e93b7c6569809e94153ed44c3978915c9bfd0d6a9c3470ea847a4fc591954805aac31040e647ee42e02d3cda1e31ab46f52858828de7e394c0cb08163d60c5873dc3337e744b1b9fdfaa7e2ceda8b71b3ff1aca786c567632ecb51adfb8a197bef285a122a54a1be3727097f2301c7478e552c31aa50880e47ccedbe1a4165725e9a1fbfd8fa1f23b611f3789e16c959a530b974945de6cc3c82ede53c0c0c7f1e9c7d79334cce52ef0e26cf572289f065df87de899e66ee8a9fefd600e8108923d7638d61a1b0b2cfabe8c2a0f900cfa5b385253188e3f055e578bcfb6871acfa214ded40e0661d423bb2aad9d957bb45a9b2c03f37a6bd767702a3c7cafd48be004eb0b5a9beb59c1da36c4ace141f6919b853f233aa9a2c9376c15c0b27b1ffd958ac2d723cda7a8a916e03d2fa469444a3c3253a8cfd90bde47147c0b0fbe362b3c1bd9591d5479dec0ade8e50c142886a6316c9d2993415da3a113a022e43191787dbc16439ec1ab27a3d3ed39635220107810d9f850a0716765af57535e7d3c689b6f6e2ea218813074f68aa199848b127145d764bfe66ecb30d68a17e599efb119896e9c1dd040832f7f26d2d1af15aad8c1880abf952fda8bea9ebcc9743df7b66a71d8b55a1fda5c74b5983bc31f50cf1221f02c56f8cac2137910b143be9e486af3e3c41a49943f7c67a0ba6cbf1a70db9815b51d8228ef36303eede7f5f6cb1474ec026ae6eebf8e36597246a6ddc668b7cdf9367c7882978a7c23d39ebdf84c311a2d10bac4e5b6b6c4debf336a8a87fd1d0aa8894969a867f5424a37a6c8975e6c19ec3b051396c3f5c7ac70c2410f901d9ffb35a42847e1039fdbeedd4e3b55de8d8096114b2a2979d2b5083b4bc4babe9b33bdf431085447e5a4563e74e705080b346e134a7053b6a5e3f565471998aa3b62a9e516814efe8ddcbc726722ffc56f67c92d95cc584e070054582d7fffa178c2eb103bc106e5c55750385022ed6b7d203d220aa86f07921c3758accefb66557436017e62dbeb71ddbf0ce061145d613b8e82ac2eb91373bcdb07e416c7b7abf2e8ad550044598a8234424f3db0c706978a879b17d5468cd655ee80a1736d95f16846ed4086d896f88f7ce7d173d4b8b7c2a67822a484d76c35f1c6868b3668849c7a7b7cd17676e38e076890f9c130c5c336d6ff242c5fdd763b9a42f325c39a066771b37b4fd5cc978c2cdceae9ef7a220a411999e7a53b611e0078e4f8a7c4fcabd1fda54967683fcb127f826257344aae2160acbd8c2fe098821db6de13d97b729f558011fcc120014e9026ed241a2347cdfb8d63271472fdeef45c9316bd1b7a4135ef3c7fa878c20433b39e6313fa9ee4290a7a37f567c8593a1b4e0bee97a2c151fbbd84de84d2b80afd9d8ed6b4bb08091475600cf03052b7d5d443dff6cf6936469ead537df49152a2d587fc76181c8bd31608a02d1d13d748705c3662166239c49ebacade0c49028a38b7a5cbb4cba2d8b29bb6494e9f09d1903bb17284c9f13355d895fa7e5cca6a4f50b218dbf6d31d9be325fe0ee300a6aeeec2eeb26d172e020445d431500f3ef580aa78b5e5b81ced968caa5df4e49ae4105bf2b491db85cdbb43e9596a319312096289e26298c273f89ad2ca531f8c9d0ae08db4568955ef07b3c6a93fe079c0ba4ede8f09634b47ce7d836110debdc6e859be5b9fbf0f2d3f05f1c12934d2ea23acde56a46aafb1f187e3c496cee25ed221183b973860e01e9e33ecbf6e3216726a01e223251891917a43cbec50b528f028cbdb4c470792422c7f6753528d353c1cfd9c8bb1845d9f01bb9b6490f42ba8730cb1e91361a87d68e88d300132b59099587cbec14166baf2237adb3478efbcfdb74a17a79e4a905ac329bfa36742dbba442eb37304a712a3adde8514721642395f7ddc4b3ca81e17784d4ca3c7ad46794a89ca425dbae85a2464e2c37cc4f6e8f155f67c80b3d62609823f68c9539be3026ad746606d29e145bfdfe577fb96a5ecf55f440f395786a23b5b4cd0cd52ce1764a37ab5a5cc7dff50ec23064d5ab0a6503274b321145609b03dfbb89d311a540f653996b4589023f24a1e3d8aaf1058a04449b4172a31530634192149832cdf399c33f5ed000f26b5fa663c45ffeddc9137b3370562b18b825c034dd943237099c6d9ba2ea6c51a5e5bbff593e247873ec26afe03f617d3cfcf282f574f9301e0dae38d99ade52131c75b4f4ea4383c29ceaa8ec6453fc4db85c8d1f7b661a8bf432c1cfe47908b15e18577bb12d289bd64fa01b20a80a83f2137fa0a02b8517bf9bf6145484b349c14851413e3b88fbcb39ed11885b6667d776") sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) write$FUSE_LSEEK(r1, &(0x7f0000000080)={0x18, 0x0, 0x7}, 0x18) 03:50:31 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}, 0x2c) [ 1728.684058] binder: send failed reply for transaction 5510 to 30688:30701 [ 1728.691655] binder: undelivered TRANSACTION_COMPLETE 03:50:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:31 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x100000000000000, 0x1000000}]}) 03:50:31 executing program 1: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x168, 0x8000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000180)={0x40, 0xfffffffffffffffe, 0x7, 0x8}, 0x6) r1 = socket$kcm(0xa, 0x2000000000000004, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x2000, 0x0) getsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f00000000c0)=0xffffffffffffff01, &(0x7f0000000100)=0x2) sendmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000000)=@sco={0x1f, {0x0, 0x9, 0x6e956aec, 0xfffffffffffff000, 0x40, 0x40}}, 0x80, 0x0, 0x0, &(0x7f00000001c0)=ANY=[]}, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000001640)={0x0, @in6={{0xa, 0x4e24, 0x80, @mcast1, 0x3}}, 0x1d1, 0x1, 0x80000000, 0x280000, 0x2}, &(0x7f0000001700)=0x98) sendmmsg$inet_sctp(r2, &(0x7f0000001a80)=[{&(0x7f00000001c0)=@in6={0xa, 0x4e23, 0x7, @remote, 0x6}, 0x1c, &(0x7f00000015c0)=[{&(0x7f0000000240)="61c1cc02563a27d1f7a3a8f5b67deae30c8749d574ab4bd4c253e8df4f59c0aa92131a1e04cb922220cb5648719cf772d49244c0353d4af593d1b4", 0x3b}, {&(0x7f0000000280)="eec90f2e4b6fc6077021d3d4e2f0514ee19d7a2d24903af4238dac", 0x1b}, {&(0x7f00000002c0)}, {&(0x7f0000000300)}, {&(0x7f0000000340)="212ecd01f8fe9297d189903386fa740e3675e2c7bbc0b9e964c4b5821434e01d9739bc8b6ecca2e520f48401533543856f2e68df8fa316584a078a7ef6b90379489bcb191b74b2eaf5aa7a41f5b8ca6609819b70b3096f0d", 0x58}, {&(0x7f00000003c0)="a5f99589ac051c0b949398960e2855d894720ded00073bffb0a1e57816add1f28d3ab5e97cc46dc5f71af8547521285ecaee1dc0b57c47a1434f5912c03bec07975144525539e6df2acfb5f4f31706cfd4db88775eb44ef8ca3458f00551e1cf505b3cf729fdfec95eeecf965f3e90ccb3acbdf84b70a83e8031adae15fe18185616ff2432aa9c3be66a7290692054122cc4f94c0242cb106733f5389270d804a6d394e63b7575d2792fab8877ed9a7e2122b8a8d7cff1f114ae22da6224c47a56d67d44fecf46043318a23c7fab0e8844b45a2e08c23a85486765eadf6ceef4aaf7ac8f97458eeb61e3a7ab5e1663d3293901aefa7bfb243a", 0xf9}, {&(0x7f00000004c0)="7370eccf151ce1f8b4b3977f2a03eff8cdbcf314192a182d6be9d7207a6723c44a9f9330a2b442c84f5c119ec251aff7d545cf01cc9ba53b53e307dd2e4401c6b4bd51d8b7f9504686c619ea0572664a174e9b5b9ae0daa98b8823887236d899af8a39d5c892784e2049ccbe1050b14382990e1b92ce775a0129941ae4e950758b4cb253d0bc3b790c0e1fc56089557cff7baafe0b02857d0bb8964778677163e758b5ce1e6826ba1904980537382a98e1882655ef89df1c3011e9211d4df2fe70573df33eccb5ccc3f6d3bc8437ceee31ab966171c9aa1088be04834f28ab73f076b72a770ec48979778841f5693a39ccd0be3dd54771d9b32780820eee905c58cbaf2a246b395ad02849fd1d3928eaaffc001f561091ef2e2a965e3bebbdd95c927175294d0a36c4a5a6638e460a09e53f239583d8f8c7377ec5f12e66680742dccf4ef8869e1f84eeaf20f8a2f7ecbc5e3892ce6fc4b65008628a9e0ee2738eb64741542f6a86aea894b81b0bcde6c10562ce48d68078565b497c60f5c9c7f0548b9c5648b7f31f6eee8b35dd3dc596b3ab7d41ed7df1f553b06315b99b16b8ec8241504f55dab7f297c1162d5c647aee2889aaa7e0846e67fc633990292feac25877b12c8009192eda4810ece4513d0123f19ffcc5003c6c3454ee32e6e4ec49c4ec7771eeddba25faeaeec2b915944589e4ee705bc6cc4587ef74eba2cdaaa5d564106a2ead4f29f9f9b2ba770749f24ad14cdc131129c1195dab40138a0f747757f6d4548fbf752fca76dd273d846b1ab629847c12f8ff2beecaf431e976d333cd8d30678f0dc66926d5d512c71da5b0f987f934989a7f13eab64b806b5ca92e4dafaf68786ae7888c8e8e07af3081ca616b6d5dd57086c90e203fcf1885553505828a9fcfd568fa0cce0fed9e0dc0565837fb830ad7264c1cd036a4f182e88c6277923404b70f3eb5d57b04b26454471d222af8e162db7a0af8eec70cefb4c4f01c22f600ce3a260db3ead3abc8f9deea4529868132ae49be3160616f9eef54f3addb75d10f5c3194dd44aee55f9747cfeffceffa96516c73526026a06d4a14a74c142a74cb644bbf289f848455d0fac4edf0865ebe394a1747a5b8e85e87e5899d02a8d708fd7e9e957a2e4535a5d5e921a1e4dd4ec3f87ef2215118b43c9591c4ee0df58a80402058052efeba34100815ff0a1ab78d49781565316a92cdcfd464c15304c0e37d3023df3630675dc9845d409f97a30146c3784c676441a1f7f3af76a3227b16ea58552a48b457a9eab9dd7a52d64d9a5a28723617307bdd0f4eded61b08f9874744bfc7236150bb7a5ad23b49840c199adcc3b8ef9268ac969c4d8cb1a78af6949515c6d5881151830cc79c9b4c5c18b786037cb2c40054963432fd1da6f021397e9c6f26f8234a6d96e12bcc6b24bfbf474e795a67d2e2d8981f45d7a7ec2e1282a1aec4a08e96d4be4f2c9999dcc8c7845051cf6e47ae48acf06ef99f8d99825b042bf6f6ea827884856203e5433c516dd07b5f1b8efa924d5a0f7e9f0248aee741ac37e65e3d2084021fb4d93b1270b50cfbd2d8a38f99217243ac5944b187fc328d6d7b5cdd9e1cb178d37dc6da412871376945a4dfb4bf59b2d05e0cd2cbbca19f89eccf5c5821772b899b21a605b54c8614be878b7778e9450a5f9db6c130fe85fe35d52bd69748136eb5880c71fe903f327f0a7e082a0a3ab4b46c94a6296acb672014330e010aaa62212e5305b5d5e5de5bdd46560596666b70b457248696f11bbf8557acce30b608f4cd3c3d0ab54060a9e0aface429152f847b637594c3522cbfbb1afffbc21826398267390b7068bbb3555287f0e0452d68d402d57b6f24fd986825988ed577ef2c4dd758b3bb669a95e63f75265ffb33124175d12fb17e61beb2d6c9824a4a0915f06ebb0047674ca43172e56c982c937f3e86d29854907f28a99d538711f9a26b938ec8cea1eb76cc0241663b1f5a4fdb7a4578d7a29f7c9feb7ac8d5603d901e210551bedef3b83d2865ed1c0f8521131c62c65eba7a84cef398948c77f460c2ede72fd79630ef9002a5003a599c182f99053d95ddc7709addd303666ba9d257b5b2581e75d22fa9c20c27bd78aecddd3718ab5ae01d993604c8003480e93db80a0f7f97bdae21979c94a68ba44bbf017b1481fdd2d8a1b1645b0a7f20729a3b9d153f394cb3e5956c52b64c8773bfb03017fd4ed145f0cc05d85e4e8c7b918a808c89d8f722e9feecfe5acb8bf21de04d8755f422e25ebedf53d656512c6758d200bc1fa80be633a18b6fe8c821f1f64403f15daf0c08db3b0531349932c66f47050b23ea24fec6d6f14a43f50a98300415e9cdfa98e1604e7bc6eb9e22409317cbb2485201bb0b997ec823e5dfdd9267d0ec926a15da167b48e9ef3cc45f5c268c17d3598d52275e8cb907d0234ea47374e4616403ab4b6da1c1b1b22c19de0adb2eaecc460d147991925d193b08de29816ffabefebffe051a2d9fe90149ee833dcdf8e1f4dc21c27b40ea7a8b48db6fcc3f7d1cbbe4f7c2732cee9e1301470eed12123d0558ab306d8615bad42606d0443faa04b4d3fac87a53c1f7ea94ed0435ccd233afa1ce125bdef5b5f8ec46e1a41220c913e26e5599cc8b8293e7ea1c8b910a34838b3f6e8c38ff6c80b0e2bb47958072d4cba24da0863101ee5b735d7d0e61c56ac05e2dc2f51179c79a9a721d817b47e8bc67ec6f7f1fbbe536e5075dc9a533952dc79fc3a126e7d1358109e9fb63c7b4c06de26301126deef4cd0123d034fab7ba0b8961b5821cd0449ee2f8256c63d9b5fcc5b114ca00728fe1333c43854cdad0ae8dd4dde00c0207942382b2d04e49e6f88f4167f29ba95a29e37a3f4eed773ce764f3373d250a1466514a9b887365c3cfba5608b7dedb4d35c29ea3d5ae0c4ce69cc2ad858bb6439b4d4c82efd9ad9f357e34d4f1bf8c2cdcb92863b47d335e9506f038cc6fc4c7cc06b090acefcde6a59612905fdef2b1f755603ccfceebaa7f02fb2471d7429563ff9e8864e3d634f09a790b587206bc4ef8fb81e233586937f404ed0ea5c09f8c8b5accdfa7b536c5368c11828d0b511b26fbf6799d30e6a865473b0b12d8c5836d5c51ec8891530d1b761af2524e2a0882c509a46faee861f9514cc9345ee539d0f28080400292f510ba964fb4e3408ca4ee1b109061a08ced0ff50ad599a294f71d093d1d2e3b1e2954c07b034c951f60d5cb05d20955807757644cd1783cc1f9d00daa64c78db8304de3740185663bf3691df515c68d225c735ed8db2c7fc0aaa60008d85a57ba885d745fb1a5954d767bfb4f36e6c119c71191ed2dc76b555d292222b33c3264b0348f21cdb9b34b09d3a871a1cbeea821d7fd0aea27cd21c394de598ab2e26df22feac384d889a45111b0c5693b81645e218ec52d990d8c9337a58597065232b248c5e4f83aaea4c2572dff8e498449211582c67a795133bf391bc08c809f3c4232d2be9ffac2e20fff67866f14d1c199537586730331e65018467b783a50360280834db890d242b6de5445eb0060bfb806cb10164f7eb2a9256963f84dc88dfc6d2fb0ef0c7faaf1c0c23cd24bf5dbe2ca7ba74d38ce9e095b3992b9937738e37869d23bc6453de4ca0407611ed21619e6cf00444523493319d680cfcbc252d4713e5f4b6b0eb3fdee2c4de2a808e58e653e8162b939b9cf284c49981ddf515b2e042c9787f04ed09d771099ef249658e772b42be21f0495a55b1bd7659ba8ff2a8fdbe5375c90bf67698c65d6997e309fb4767ac774d7f1d30189730970009832124d525a75c6b5f6ec23b9f69c5922ea1435a8c006b55452041dcd74ee1a5cb27461b82c71a793fc08eaab37ffa23866a3aa00355dc28097634a5ca4046b3aa5ace78c2f512ae1d1fa79d4e272453aef8f290e571c5d9d83bdfcfb22c6974cc989591b686aa5ae9f9e0793dff52ed437784289b590ec0743ad4ace26591051fcbdcdf67840506412ffa841a1f5708a30429e3020ff1630644b450af314e3d0af3583e385d2c7374f2967e26f57af62c97b14f8eeff05d0062b4a7b1dc7323a4ee041cef8d9998f9b2d1e53ee9d56a8c07bd5a5d349ea1fdd47dbd826a855e43b5b7339921d136db39b71e16487f81c5d026a0765f80737c06f42e7bd9021dca5ff651b1015ea52ec223870352338112a204014bdb0d2f0d8199f5fec5a4c8db20ce2ee5c0b1088fdc4a6e8bc1d10f259bd5e88864d343b7255939d8ea4f1d1222a28838ad9aed3305dcd85dd09628cc96ada809abce4618756927f2615248d00d48863bdfbdeb5cb834c457f6be8accf8f04d36d9b2adeca5f2a87321b3760a7f5173c4c979feb6ec91c5e9fe7f364c68330d1275e9069aa8e78e391d7f7f10e7dfa2e0363b6f585a936456ab3ccea9cbf4bd362387beca1b222b4abfd531c927a6b207798f1c69243fe9671f8a9fdb5f52e7a9c96e2f4c82ee7b2ca2681cf1292b69ceb112db523e5a8faaa3dc13bb33ca0b95cdc512c43336a3ca3b75b695bbc4ed61618f5f5630d51ebefa21e871a26611f54c9e4139e36bb554f867e661557b8c8050c806f67e9b28f8383b234ff6637c40e60a1b6e4189b0b84651c3b8134a396e5170d9ba5ffba69360dd4918599a4eff761ca82d5bad0d7f6dea2959f16bd34f66072da4daa10881c80370fa2367d486a725031b9e850c1349ac89a2030483044142f26e7b50b6286d4539e0351f54c9a0e17364fb825c1630b229810ae106022513f616424625b55d612e780378c524a600139b381a5590c02ff9674f6dbb43d07e71b8ba84501a9d9d28b95d50320b1649f3473dd1124ef824aa6ba83eba6baedfbf4f4716f88a73bb0b112b0c3d79c0142910168ef9b0f8e0e71703720268b2414a056aa16da94531a25e46fb53cd51be8fc21ae896fb222dd6d685cf45af8ee597f40bd8aa9f3a62e3fe1ebfc8b11f02b5eb743c1d937d967ee9073a0cae221cd545156faff927c81793eec3c088eec4ecd0be7e677fa58e97991ebb4b505e1b3b7a50d2a05fa2ff0ccb6e02b7ae4c9504bf4ed09fce3680dea1b8424d9547bfa4df55fd10cde458c22577fb8cf7d794fa27b7a52990678a676c92bd47f2649e248941c3e03cac698eb03ea2eaa1d06b3c6b8f6a489707a6413bc089b494e2916ccbc00c724c5f4aece2578c9484f67e5b17ab62f781ce1397980ad1150b750500efd903cb10ce2e7102aeb5413044b56a6836c5400609f2dbe2f0cdfc63b52f7c73b38ae594fdb79aa31bc0a825f0711b552785ec1d7e870aca04f902dd5c7e27b3f1f44fb685c1f926396d691f0dbe222ad276f55d0757640d19888e79d3ea64f435f3d6c16f9141a2a312dfda7334e1088bb929eb7eee6dc368cc2522183e2b2db5cd2d61a19df04a0f30a097fe9f452ee61637a8b799506246ea931866539b834a67c8d7f969c0d5053483339f532df66916b5571fa800d57fa159de68a14f4a136e388a6db092b0f6e1bcbe1f1ccb70264f335e26c5b3802c01f250b8fe10171c87fc009a88a0649395106bb9e5bcfb40cc1fcbe8d8ecfff6da80e5c7e8ecc668518b54d6f803dcb76f9ac5ece879fc623519fbc2e7bf7be3a4b766544adbbcae5c8aad77386adf6bb5f2a273d8caa49e091bb5c4f72eda00d70488946229c5d9879089aa9730681a46f419274fb56595144347eb202d9154f3d917fecd0d7931db01691802788f1957024e9e0d0a7b833fb4dfa246b85524b57b921bbd3a4ba9e9526f2d113", 0x1000}, {&(0x7f00000014c0)="c9986e0a7f036165cc84f8f7864761954d03f7d869350f780b5721bab877f120faba21b1c4f0fcf67fb466e6842c80f11e2b55074a83356091fed2f374bef99403a48a355820dc88addee18f559a16c42320ad94a871c52d69ee64d23911192d3a03ee5cdbd5ee7bc462281792a58a6e13a582b6eb512f8619a0414bafe64fb73c2687ac200a47b81f1f2ef3e64a69a0f620f640161bbc05271b66551a7ee2ede5687d180b65b16e6f38243b8643b69105ad533d0a49aa110456af0b1d97656a55bfaf6ff89d528c1096ead423f4b393f42791e282f9e69502501665c32cc56a6241dcd6935344e81d11b5be", 0xec}], 0x8, &(0x7f0000001740)=[@dstaddrv4={0x18, 0x84, 0x7, @multicast1}, @prinfo={0x18, 0x84, 0x5, {0x30, 0xffffffffffff0000}}, @prinfo={0x18, 0x84, 0x5, {0x20, 0x10000}}, @dstaddrv6={0x20, 0x84, 0x8, @remote}, @sndinfo={0x20, 0x84, 0x2, {0x1, 0x7, 0x2, 0x5, r3}}], 0x88, 0x880}, {&(0x7f0000001800)=@in={0x2, 0x4e22, @loopback}, 0x10, &(0x7f0000001a40)=[{&(0x7f0000001840)="a14d9bb49551e29bdb8b9bc25807e0645523b19ca0c2402a41c5fb371ef5b8856bd711c2f81980b03b0988c28d1c3e0113f0f85f1a7c2e302e78e1ae42d07d0798c04baf0dbf566c0dc3e43eda1c050e78b23e3e3c5f236a425e066b12ee6bad4052f51982491d3835bf7f915c826710e1c7868a915d390c92f5843c6b3512f4fb82e9038bf1ec7022e9999b6170aab2a456fde3cfcebd9621fa17826900578a1dab125aa7df1068d9dee8e3f1a0381bc9a62aafb18e340d955e5cf41fec1f819ef277ca6fb93a4b875dbb190053fab5661081", 0xd3}, {&(0x7f0000001940)="71d5eff21a00831c971454552fa8704998493357bf7e08f58bdb24c57b74d7f60fde80c9af1f72ca7d7a7d80722c181005fb1f702a7df1a4d418fef654e537cbb27399ae7e0f81529be409df5809bc7d4aee09235551d235b9dba6196cba34bd46e99ea0dbc1d3a64a7905014cd33409f7f393578f7354cc3e90ad1a7636003c456f0c4f0e932529d44235005e5f488318428a7051ecb57c8f62cd36930c353e4f44549b1599103f704c795ee091ef43cca844b7310b7f21c717a14fbff34d3503f0c7d2f4b732c6dbff7254c5f580225bce", 0xd2}], 0x2, 0x0, 0x0, 0x40000}], 0x2, 0x0) [ 1728.790824] binder: 30735:30736 ioctl c018620b 0 returned -14 03:50:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1728.858419] binder: 30735:30744 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1728.910172] binder: 30735:30744 BC_FREE_BUFFER u0000000000000000 no match [ 1728.949226] binder: 30735:30744 got reply transaction with bad transaction stack, transaction 5513 has target 30735:0 03:50:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c2235000000007f"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:31 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x200000000000000, 0x1000000}]}) [ 1729.006186] binder: 30735:30744 transaction failed 29201/-71, size 0-0 line 2756 03:50:31 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}, 0x2c) 03:50:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:31 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0000000000e80022000000000800000000000000000000000f00002d4f52c3de5c9a6cb87693b2ac86664fbacc0f8108314c403d392baab600e4ea476056877db1bb535106e7eede0548b41e5369a93a6e2961e3b07401378b1cb3574ea0e0de48ce0c88e2d820fba712679a068e2965e69cff21895da3b54f40833d71bdfa0e1e73fb21ae"], 0x28}, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f00000000c0)=0x4, 0xfffffffffffffe93) 03:50:31 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x1000000, 0x1000000}]}) 03:50:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x600, 0x0}) [ 1729.565208] binder: send failed reply for transaction 5513 to 30735:30744 [ 1729.578194] binder: undelivered TRANSACTION_COMPLETE 03:50:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:32 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x2000000, 0x1000000}]}) 03:50:32 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) [ 1729.719632] binder: 30783:30790 ioctl c018620b 0 returned -14 [ 1729.796982] binder: 30783:30790 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1729.843444] binder: 30783:30790 BC_FREE_BUFFER u0000000000000000 no match [ 1729.854828] binder: 30783:30790 got reply transaction with bad transaction stack, transaction 5516 has target 30783:0 03:50:32 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1fffffff}]}) [ 1729.938870] binder: 30783:30790 transaction failed 29201/-71, size 0-0 line 2756 03:50:32 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}, 0x2c) 03:50:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:32 executing program 1: r0 = socket$kcm(0xa, 0x6, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000080)={0x8, 0x8, 0x9, 0x9, 0x8001, 0x9, 0x7, 0x6efa, 0x8, 0x2, 0x69}, 0xb) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f00000000c0)={r0}) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r1, 0x111, 0x5, 0x0, 0x4) 03:50:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x7, 0x0}) [ 1730.054438] binder: send failed reply for transaction 5516 to 30783:30790 [ 1730.065118] binder: undelivered TRANSACTION_COMPLETE [ 1730.070272] binder_release_work: 4 callbacks suppressed [ 1730.070278] binder: undelivered TRANSACTION_ERROR: 29201 03:50:32 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x40000}]}) [ 1730.128358] binder: undelivered TRANSACTION_ERROR: 29189 03:50:32 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) alarm(0x6) 03:50:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c223500000000ff"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1730.234684] binder: 30825:30828 ioctl c018620b 0 returned -14 03:50:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000032"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:32 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000002}]}) [ 1730.295404] binder: 30825:30828 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1730.332987] binder: 30825:30828 BC_FREE_BUFFER u0000000000000000 no match 03:50:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1730.386408] binder: 30825:30828 got reply transaction with bad transaction stack, transaction 5519 has target 30825:0 [ 1730.408930] binder: 30825:30828 transaction failed 29201/-71, size 0-0 line 2756 03:50:32 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000]}, 0x2c) 03:50:32 executing program 1: r0 = socket$kcm(0xa, 0x7, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x200080, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f00000000c0)={0x0, 0x67, "b78d240d7f9ccde629ac9a4172e9ac947161080e582b669ed7322e06d73a5671ce79b793b936ea9709bef0587c6c78b77d5dd67ba69b48a814a6992c486c9e8d2b2a9e3149ffc845848944f20306110752b09abb3f198dd6794e23fe09f712ae61c23f36f8a97a"}, &(0x7f0000000140)=0x6f) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000180)={r2, 0x8}, 0x8) 03:50:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c2235000000009e"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x7400000000000000, 0x0}) 03:50:32 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x8, 0x10000) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000000c0)=0x800, 0x4) [ 1730.521870] binder: send failed reply for transaction 5519 to 30825:30828 [ 1730.540318] binder: undelivered TRANSACTION_COMPLETE [ 1730.578342] binder: undelivered TRANSACTION_ERROR: 29201 [ 1730.587379] binder: undelivered TRANSACTION_ERROR: 29189 03:50:33 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000010"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1730.661331] binder: 30861:30871 ioctl c018620b 0 returned -14 03:50:33 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000240)='/dev/nullb0\x00', 0x400000, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x4000, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000300)={{{@in, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@loopback}}, &(0x7f0000000400)=0xe8) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000440)={@mcast2, 0x3a, r2}) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) r3 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x155200, 0x0) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000040)={0x111, 0x0, 0x10003, 0x1}) ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40106436, &(0x7f0000000280)={r5, 0x8}) ioctl$UDMABUF_CREATE_LIST(r3, 0x40087543, &(0x7f0000000140)=ANY=[@ANYBLOB="0100000000000000", @ANYRES32=r4, @ANYBLOB="0000020000400000100000000800000100000000d741cc5ebb1e56fc6ccea32c22d91184485ac687194dd1c8b3571e1e001bbd1f4364751c5bf4f13791b499de8546e7e565a23de19353cecabb34f8723165cea1f203334574825a3d38788977a52e0d08d22a1ba8392ec249509951251c428ff9d1c3aa1361aaae7c5dd76e63070fcb32e578af6d362ce7fc852fbe42332df0c3eb6acc74f9204ddae366f025e5c56f1be06c26ba6eeaa6918b46edc99a898930153a624f78bc586900000000"]) [ 1730.779052] binder: 30861:30881 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:33 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0xc0000, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000280)={{{@in, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@remote}}, &(0x7f0000000380)=0xe8) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000003c0)={r2, 0x1, 0x6, @dev={[], 0xc}}, 0x10) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="2800000000000000000000000000e08f0000a40a00000000000000000000000000008bb4b91b140818f43c5f9cd701b7477c14615658b28d35544231f94ba917064c374b8297d99c2d2eef71e01851e6080000000000000088640392177eec405079cf027372c0e7d40d86547fee6fb2c3be3d9eb51837ce90c322df5d721fcfa9bd513f615c8c3d5eaaef44fb719f0000000013f835c8b8f2c856ff2d92a7162fb861481edbfd23c659d0faea332f5b7d93c6debc85b3a902b3aeeb27a3789cb7ef019960b37f7602bdd9b33eb904f8a38a87e2202202b2083d833ec5e2066d27ec8b04d2f84e380789bc0a362567322674bdb6ce2a11173de5b42ec2b9105b907ebedca500f6818ffb3ad4a3b25eed3cbb4281dfe09f43cce61cf349865c04dee084ecdf0d3f47"], 0x28}, 0x0) ioctl$VIDIOC_G_ENC_INDEX(r1, 0x8818564c, &(0x7f0000000400)) 03:50:33 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1730.824222] binder: 30861:30881 BC_FREE_BUFFER u0000000000000000 no match 03:50:33 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0xf3a, 0x40002) write$FUSE_WRITE(r1, &(0x7f00000000c0)={0x18, 0x0, 0x4, {0x2}}, 0x18) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000100)=ANY=[@ANYBLOB="0500000000000000f1216739bed3ce4855b428a6541a74c3733b666dbd4b2ca1d597fc6f16f9", @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) 03:50:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1730.914733] binder: 30861:30881 got reply transaction with bad transaction stack, transaction 5522 has target 30861:0 [ 1730.950127] binder: 30861:30881 transaction failed 29201/-71, size 0-0 line 2756 03:50:33 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}, 0x2c) 03:50:33 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB="0000000001040000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) 03:50:33 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x60000000, 0x0}) 03:50:33 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x20000, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r2, 0x200, 0x70bd28, 0x25dfdbfb, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x101, 0xcb4, 0x2, 0x17}}}, ["", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x4011) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:33 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:33 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r1 = getpid() ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000000c0)=0x0) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000140)={r3, r0, 0x800}) getpid() 03:50:33 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000]}, 0x2c) [ 1731.468710] binder: send failed reply for transaction 5522 to 30861:30881 [ 1731.498066] binder: undelivered TRANSACTION_COMPLETE [ 1731.511246] binder: undelivered TRANSACTION_ERROR: 29201 03:50:33 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) r1 = getpgid(0xffffffffffffffff) sched_getparam(r1, &(0x7f0000000080)) 03:50:33 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0xfffffffffffffbfe, 0x1000003}]}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f0000000140)={'filter\x00', 0x0, 0x0, 0x0, [], 0x1b8, &(0x7f0000000200)=[{}, {}, {}, {}, {}], 0x0, [{}, {}, {}]}, 0x9f) [ 1731.540238] binder: undelivered TRANSACTION_ERROR: 29189 03:50:34 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1731.623769] binder: 30934:30937 ioctl c018620b 0 returned -14 [ 1731.682576] binder: 30934:30937 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:34 executing program 0: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0), 0x2089) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000100)=0x80, 0x4) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r1, 0x40087543, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000000001000000", @ANYRES32, @ANYBLOB="000000000000000031000000000000010000000085ec50897c1f71ef983dea20533c6c077d751f832fd93b0ced68"]) [ 1731.766864] binder: 30934:30937 BC_FREE_BUFFER u0000000000000000 no match [ 1731.815816] binder: 30934:30937 got reply transaction with bad transaction stack, transaction 5525 has target 30934:0 [ 1731.892153] binder: 30934:30937 transaction failed 29201/-71, size 0-0 line 2756 03:50:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x48000000, 0x0}) 03:50:34 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000080)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000100)='fou\x00') sendmsg$FOU_CMD_DEL(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r2, 0x0, 0x70bd29, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x8, 0x3, 0x33}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4) 03:50:34 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:34 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) pwrite64(r0, &(0x7f0000000040)="103518a1180fdf59a97ce8033c22b4af8688647bab682b9debf9af28", 0x1c, 0x0) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r1 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x3, 0x12840) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1808808}, 0xc, &(0x7f0000000380)={&(0x7f0000000180)={0x1fc, r2, 0x0, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, [@TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x394}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffff7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}]}, @TIPC_NLA_NET={0x38, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x81}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xb128}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7fff}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7fff}]}, @TIPC_NLA_LINK={0x118, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x20}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc31d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc3b3}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}]}]}]}, 0x1fc}}, 0x0) 03:50:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:34 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x2c) [ 1731.969208] binder: send failed reply for transaction 5525 to 30934:30937 [ 1731.976584] binder: undelivered TRANSACTION_COMPLETE [ 1731.981788] binder: undelivered TRANSACTION_ERROR: 29201 [ 1732.025139] binder: undelivered TRANSACTION_ERROR: 29189 03:50:34 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f0000000140)=0x14) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000080)=@xdp={0x2c, 0x1, r1, 0x4}, 0x80, 0x0, 0xfffffd69, &(0x7f0000000200)=ANY=[@ANYBLOB="280000000000000029000000ff030000000000380000000000000000a40a00000000000000000000"], 0xfffffffffffffd99}, 0xffffffffffffffff) fsetxattr$security_smack_entry(r0, &(0x7f0000000240)='security.SMACK64IPOUT\x00', &(0x7f0000000040)='\x00', 0xfead, 0x2) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x20000, 0x0) ioctl$KDGETLED(r2, 0x4b31, &(0x7f00000001c0)) 03:50:34 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r1 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x2, 0x2) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f00000000c0)=[0x100, 0x401]) flistxattr(r0, &(0x7f0000000100)=""/183, 0xb7) 03:50:34 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1732.133696] binder: 30968:30981 ioctl c018620b 0 returned -14 [ 1732.192393] binder: 30968:30989 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1732.224981] binder: 30968:30989 BC_FREE_BUFFER u0000000000000000 no match 03:50:34 executing program 1: r0 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x24240, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000100)={'raw\x00', 0x2, [{}, {}]}, 0x48) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="28000000000000002900000002000000000000000000000000000000a40a00000000000000000000e80176807e7c563d2aa0b30ce60e4089238fb69cd047b1282c6ad9989caf457a83bb0348d332203b2bfee6dffe6fc23fea5c15b1631d860e8574f6f57fcb02220292d56f9f6ad7efa423e7eec4e3e23bd83833960ccf47ee5d4c3ca2ee387ec2f6cc7e64796e9eb6ddd277e46efdb1eb72ad31190db590cf90f7266025df793ae1f93959042ba0a3a532cc026c46c3121cf9c9179d946e195ef7a97a1cb51d422f40cbd05903951c47948d6334cb3c8546a8d957448a462713f13accb2daf5bb83250b3368e2fa64467bceb3dc16806bacae21035d6844d430eec50841fb23d8155c8a709c16082bed20c8b4b24a01385bc11317afacb8bdf55b882d4de9b2131a3847f2c6c33bec"], 0x28}, 0x0) socketpair(0x9, 0x80000, 0xfff, &(0x7f0000000180)) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000080)) 03:50:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1732.255485] binder: 30968:30989 got reply transaction with bad transaction stack, transaction 5528 has target 30968:0 [ 1732.322712] binder: 30968:30989 transaction failed 29201/-71, size 0-0 line 2756 03:50:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0xfdfdffff, 0x0}) 03:50:35 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:35 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]}, 0x2c) 03:50:35 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0) openat$cgroup_int(r1, &(0x7f0000000140)='memory.high\x00', 0x2, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x400000) openat$cgroup_int(r2, &(0x7f00000000c0)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) 03:50:35 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x3, 0x3, 0x800, 0x0, 0x0, r0, 0x44c}, 0x2c) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:35 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1732.932221] binder: send failed reply for transaction 5528 to 30968:30989 [ 1732.974695] binder: undelivered TRANSACTION_COMPLETE [ 1732.997968] binder: undelivered TRANSACTION_ERROR: 29201 [ 1733.027328] binder: undelivered TRANSACTION_ERROR: 29189 03:50:35 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000080)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x1026f, &(0x7f0000000100)=[{0x28, 0x29, 0xfffffffffffffffc, "005d9257e70f35e8ad081aa43ceca946320008000000000000000000a40a000000"}], 0x28}, 0x1) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000500)='/dev/mixer\x00', 0x800, 0x0) mmap$xdp(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x10, r1, 0x180000000) 03:50:35 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:35 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1733.060845] binder: 31017:31026 ioctl c018620b 0 returned -14 [ 1733.120930] binder: 31017:31031 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1733.138311] binder: 31017:31031 BC_FREE_BUFFER u0000000000000000 no match 03:50:35 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1733.165596] binder: 31017:31031 got reply transaction with bad transaction stack, transaction 5531 has target 31017:0 [ 1733.216030] binder: 31017:31031 transaction failed 29201/-71, size 0-0 line 2756 03:50:35 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0xf}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:35 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="28000007000000000000000000000000002000000000000000000000a40a00000000000000000000"], 0x28}, 0x0) r1 = dup3(r0, r0, 0x80000) accept4$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14, 0x80800) bind$packet(r1, &(0x7f0000000100)={0x11, 0xfe, r2, 0x1, 0x52484ea1}, 0x14) 03:50:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x7a00, 0x0}) 03:50:36 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:36 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x2c) 03:50:36 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000380)=ANY=[]) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x400000, 0x0) ioctl$BLKPG(r1, 0x1269, &(0x7f0000000140)={0xff, 0x4e, 0xbe, &(0x7f0000000080)="22e94ec139daf6bb9d4199feb7dee9c1722759079b78bf52266683278abafb3b33415c8eccad3ad70004d14a3d819f36983f42288a291e46b4c64867e9fb21dbb74c753baaf808daa28dbd840367bea24be5291d408cc5a9b87f774f8ff90a30cccfd5ecad36ac8c98604f34fd3e89b801323a5ec4a2ff914c79e76e9eaf13d1dad2c673eab2c2c6850653daecc476224cd048dc73c85f44fc16b37da50bd9b75d3e1fa0c8b7c8a86b938103b5939fc40dcc2845b1739435836da5b3928e"}) 03:50:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0xffffff1f}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:36 executing program 1: r0 = socket$kcm(0xa, 0x4, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000480)='/dev/snd/pcmC#D#p\x00', 0x3, 0x121c00) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000004c0)=[@window={0x3, 0x3}, @mss={0x2, 0x3}], 0x2) sendmsg$kcm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000000c0)="c34337c3c21e02e0f9ba732ffbbdf6fddb9a284aa5509e1b7b76c2d2b8f4b9d6a884c0db666d86d4a195612e7c63cd981e853b659b6eb6429513c596f1ac2dd0bcaebf5625da4b8c1b3909791df8480ec639f024bbcd4fcf5e829e7abbc551162dd1a949", 0x64}, {&(0x7f0000000140)="fa0b120be886be3e3e670ece208e7fdb96d735c69aa2bd7c2b3ad8c541b456df0a6a2b2b7130ec893e3237a8873ff4095970608d9bb528a2112b54952e333bb95732d29e62a132b9df573f7eacb745e5d5990c9ae9fbbafc400bf36c0848f793675722a0e00e891111be7b1f859274ce862a751a05c89cfde6b10f4a8c854b0419f0a940cb35374c7b4e0367a4441f1abae05d5425e489139a85f417e34a72b32b564381e079ac988477dbf3e37c7f135d6827075ce20fd72f44cd61eb8692a5317184350f445ec316f853598b09c83201a0bd2c66806b484a9da6d4fa89b431599c1233b6bf6035603c103f85da68eb0389cb", 0xf3}], 0x2, &(0x7f0000000280)=[{0x60, 0x114, 0x7, "2537da946a4c83d56a8d03d618dca4860eaa5dcacc2fccc1c71217af232d505c1ff9dba32450c6e0a3bb4b2626b0e81d8b294fff65e9e1067f2b2287ab877ac216e90ab29d91f600d70f41066533"}, {0x40, 0x114, 0x5, "3368ae9fc23d2ff756f6ba7754361c838e3679551c9fbb7c781ee85356102d66f3a7208ddbe17bf33c9eb490dfcd"}, {0xf8, 0x112, 0x4, "a0a9b2d44b0c875f681ac5745c664b922c230fad37133bccf2e4c936ac8aa7f22f1d3d72966a1584ace291bc5f7227409e1170bcc693fbe8d7a3b5b410ee5848a925b59a95253901af118cc3203453a475d5e28714ca7edd64bd65ccc56be81bc09442c027328aa7f382c4f9a373d402a3dc48e4befdfab20610da85ddac4f9f832069a0ae9c6623413cac1212c3b27f492a5baf3fbef94992995ae6985315bf9c079fb40ca03915fcf3b060690b7d4b8a33aaa662587983e12a14456513ac6755ca91756ba92d5957471604e0eb4f15873755dcf9ff072d316c72cfbc6de2cbafd3"}], 0x198}, 0x20000000) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="2800000000000000290000000200000000000019000022f500a40a000000000000000000c1b1fd00000000"], 0x28}, 0x0) getgid() [ 1733.855322] binder: send failed reply for transaction 5531 to 31017:31031 [ 1733.863246] binder: undelivered TRANSACTION_COMPLETE 03:50:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0xc0}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:36 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/fib_trie\x00') ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f00000000c0)={0x38, 0x1e, 0x9, 0x12, 0x6, 0x2, 0x0, 0x1b, 0xffffffffffffffff}) [ 1733.981122] binder: 31064:31074 ioctl c018620b 0 returned -14 03:50:36 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:36 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x400000000010000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f00000000c0)={0x7fff, 0x7, 0x3ff}) [ 1734.053576] binder: 31064:31081 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1734.125628] binder: 31064:31081 BC_FREE_BUFFER u0000000000000000 no match [ 1734.164703] binder: 31064:31081 got reply transaction with bad transaction stack, transaction 5534 has target 31064:0 03:50:36 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x2c) [ 1734.173109] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. [ 1734.182319] binder: 31064:31081 transaction failed 29201/-71, size 0-0 line 2756 03:50:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0xec0}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1734.335660] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 03:50:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x68, 0x0}) 03:50:37 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x121000, 0x0) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f00000000c0)={'gretap0\x00', 0x401}) 03:50:37 executing program 1: r0 = socket$kcm(0xa, 0x100000, 0x0) ioctl$sock_ifreq(r0, 0x8938, &(0x7f0000000080)={'veth0_to_bond\x00', @ifru_mtu=0x8}) r1 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x1, 0x101) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x41480110}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r2, 0x100, 0x70bd27, 0x25dfdbfb, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x41}, 0x811) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f00000000c0)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="280000290000004be4000000000100e6a30a000000000000000000000000000000"], 0x28}, 0x0) chmod(&(0x7f0000000000)='./file0\x00', 0x10) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000340)={0x3f, {{0xa, 0x4e23, 0x3, @dev={0xfe, 0x80, [], 0x11}, 0x10001}}, 0x1, 0x7, [{{0xa, 0x4e22, 0xc0c5, @dev={0xfe, 0x80, [], 0x20}, 0x5}}, {{0xa, 0x4e21, 0x9, @ipv4={[], [], @remote}, 0xffffffffffffff80}}, {{0xa, 0x4e20, 0x800, @loopback, 0xbc4c}}, {{0xa, 0x4e21, 0x3, @remote, 0x800}}, {{0xa, 0x4e20, 0xe59, @mcast1, 0x7ff}}, {{0xa, 0x4e20, 0x3, @loopback}}, {{0xa, 0x4e23, 0x100, @local, 0x40}}]}, 0x410) 03:50:37 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:37 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x20000401}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:37 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}, 0x2c) [ 1734.776206] binder: send failed reply for transaction 5534 to 31064:31081 [ 1734.804678] binder: undelivered TRANSACTION_COMPLETE 03:50:37 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x33fe0}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:37 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000280)=ANY=[@ANYBLOB="0000000001000000a4e65954e38cc4c3085bf7cc45f831d82267e4d6d6f3077d18c05ecfc9d674cc3cccc68f942d57481513502f1256b244d3079bca274ec69ba8d7ecb3fd8ba4ee0ce81ad7c48595e807b0a98f8fc558863700a79bdda3b0492fa89251b447516c85efef8497a64b3a543ec1a292821df7bdb4516744f35f4c16426c00385f3cfbbd484ae179538dbd542746f16022e5144683c77f915691d6d38cce5b21ec03ac6282b8f9b12794f9fc9e546c130cdc9fb06badc7179b7476a24eee3ce32eb91616c7b04ccecc08b63ed3cf7fac6533af0ee6f70004000073991b2a99585705dfd2aca3e994fe8e903d235d0eee7ac774f74814b138b18b979a751e906af71da27d0285a8cd7deac94d534976fc8fd828b5e3b03aff9b0860c817827ad00fbaa726ff601c25c4cc86a736b3d296a7f3193bcb3e265f23b8a10db415be71c4e767da8c44615663038d84ae1fd8b8efc371bb41749f11f9c48c03e23e3932e1eaa146afda7c227ac052f7643d5fc2b6f881580e00d944147c7f47931909849943b7bcbf901358207dde6a15b21b876a82410a5666bfbbc8f415b685d85350efc542ca250b", @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000080)={{{@in6=@mcast1, @in=@loopback}}, {{@in6}, 0x0, @in=@remote}}, &(0x7f0000000180)=0xe8) [ 1734.892149] binder: 31117:31123 ioctl c018620b 0 returned -14 03:50:37 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "0000000000fc524aee0c06b99900000000"}], 0x28}, 0x0) 03:50:37 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1734.955900] binder: 31117:31127 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1735.023913] binder: 31117:31127 BC_FREE_BUFFER u0000000000000000 no match [ 1735.039616] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 03:50:37 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009c000000d3d63c0df69c65038aaadf8b42c077fe4ff7794fe2bd7ffa43fb858edad81c23d808cd1bedaa15bffaafcf9591fcb13ed511d3d0271e931789f5e5cf9b2c4d6f77215079f4130d3414b4232f08bf364b69ed0a1bd7f4f5929eee0e8c152004e21d95792c9b7b8835c39d6b6c57f2f5652549", @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) [ 1735.072504] binder: 31117:31127 got reply transaction with bad transaction stack, transaction 5537 has target 31117:0 [ 1735.094204] binder: 31117:31127 transaction failed 29201/-71, size 0-0 line 2756 03:50:37 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x7ffff000}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x100000000000000, 0x0}) 03:50:38 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]}, 0x2c) 03:50:38 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x101000, 0x0) ioctl$SIOCX25GDTEFACILITIES(r1, 0x89ea, &(0x7f00000000c0)) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="28000000000000002900000002000000000000000000000000000000"], 0x28}, 0x0) 03:50:38 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:38 executing program 0: r0 = accept4(0xffffffffffffffff, &(0x7f00000000c0)=@rc, &(0x7f0000000040)=0x80, 0x800) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000140)={'6c\xe8%\x03X\xbb\x11)S\x01\x00', 0xef}) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000180)={0x5c, @empty, 0x4e22, 0x2, 'wlc\x00', 0x20, 0x1d, 0x2f}, 0x2c) ioctl$UDMABUF_CREATE_LIST(r1, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x8}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1735.693563] binder: send failed reply for transaction 5537 to 31117:31127 [ 1735.701702] binder: undelivered TRANSACTION_COMPLETE [ 1735.750100] binder_release_work: 4 callbacks suppressed [ 1735.750107] binder: undelivered TRANSACTION_ERROR: 29201 [ 1735.770319] binder: undelivered TRANSACTION_ERROR: 29189 03:50:38 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x2}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:38 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) readv(r0, &(0x7f0000000040)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) [ 1735.821591] binder: 31158:31166 ioctl c018620b 0 returned -14 03:50:38 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1735.870642] binder: 31158:31166 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1735.931014] binder: 31158:31166 BC_FREE_BUFFER u0000000000000000 no match [ 1735.969050] binder: 31158:31166 got reply transaction with bad transaction stack, transaction 5540 has target 31158:0 03:50:38 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000]}, 0x2c) 03:50:38 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB="0000000001000000", @ANYRES32, @ANYBLOB="0000000600000000000000000000000100000000"]) [ 1736.008444] binder: 31158:31166 transaction failed 29201/-71, size 0-0 line 2756 03:50:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x500, 0x0}) 03:50:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x300}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:50:38 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BLKDISCARD(r1, 0x1277, &(0x7f0000000080)=0xe64) 03:50:38 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1736.122807] binder: send failed reply for transaction 5540 to 31158:31166 [ 1736.181861] binder: undelivered TRANSACTION_COMPLETE [ 1736.200580] binder: undelivered TRANSACTION_ERROR: 29201 03:50:38 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000140)=ANY=[@ANYBLOB="0000000001000000", @ANYRES32, @ANYBLOB="0000000000000000000000000082da30fd5b2d08db01e5b65e55de2268b1bc960995daf0a67ccb082815188622f2f83a3be93e9647c108c446e59f4cbda5274fa143878f881e5d9cc31088b85be05f97017102bd2f0f4bb587d1ccfe3483da6cc674dff1490f6af227e32bf6e1829e23cbc6264a40ba950aafed26c35fbd6c2aa1a93a8879bb13c19597c6ede0c9e331d0ec4fb6bcb6bcab5a9eb1180913d70a6b9dfbe7c0f5c3d9246676f0188300"]) 03:50:38 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) dup(r0) [ 1736.224589] binder: undelivered TRANSACTION_ERROR: 29189 [ 1736.242673] netlink: 20 bytes leftover after parsing attributes in process `syz-executor5'. 03:50:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x8, 0x0, 0x0, 0x20004080}, 0x0) [ 1736.321326] binder: 31197:31205 ioctl c018620b 0 returned -14 03:50:38 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1736.403492] binder: 31197:31213 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1736.421507] binder: 31197:31213 BC_FREE_BUFFER u0000000000000000 no match [ 1736.442256] binder: 31197:31213 got reply transaction with bad transaction stack, transaction 5543 has target 31197:0 03:50:38 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x2c) 03:50:38 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x40000, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@ipv4={[], [], @broadcast}, 0x146, 0x0, 0x3, 0x0, 0x0, 0x6}, 0x20) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r1, 0x40087543, &(0x7f0000000100)=ANY=[@ANYBLOB="40ce17000000be2efc2169d81ef4f5115650935bac25c9b68566fd727f07f932b5a5c217fcf671baa281c4af012c7f7f20c271ee34c28332354604cca637bac98e980ae72373d67b0e12254b8de4270c4ff0c42b8e7e1d269f98bcd672469d4b45bf95169234fc826f093e1dabd9250ab037a0628f31341841d748b01868a3817c1dc9fa910dcf0d9aed16a03e53c8c91f641056cc1ef4b8938eb455606db1a56084a6520300cec55a65657c51373ef26ff70a1d6ffb093cb678fd37c237eaee3894a0c2dc69b81fe6f6644e3f6ac4f8c1117488c58512d046dd16d723fc8e75bdbdd65de20c6974ccf36952a3b04d4fe1621603b72f4de242deadd53a81c6fc032f0728ef9cab44ba5bbe958a8f86f19704b3fb57bcaf57440d9a268843badd690e961070007fe4a00ed30717f4e821331f020a573b6d6f845ef265ff56fa541531cd0abe8812c43148a4ac4e114605be7b7853a7a64ced0550eb06f67159793c8cc50b7cc2", @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) [ 1736.465940] binder: 31197:31213 transaction failed 29201/-71, size 0-0 line 2756 03:50:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0xec0, 0x0, 0x0, 0x20004080}, 0x0) 03:50:38 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000340)={&(0x7f0000000140)=@generic={0x17, "18c1a4a0bdfc5650cda36c77ccb150b5ffcc945dd441f428dfad3e218ea9e00628409e3bc78eb3138ae602635b3f3a720124de6b8689584a6da2f5e389aa1010d03ba281483c86c73060958f83edbe1a3abe5d2e17bd9cf23a756d1cf1cf2d24e9f66705a2eacb8bcf4b266e4ab57d3079d0bf52c24a1dfb15d05f70c1e2"}, 0x80, &(0x7f0000000080), 0x0, &(0x7f00000001c0)=[{0x60, 0x117, 0x10000, "22f3ff53f05c5b629cdf94abdf842108a7f5737046d609fabde9a40f6374c340d2f24c581cc8332aa414b70aa690e9c408de9994e2ae947bd05532f9e3694952ac5c403a2220e927fd64adf9"}, {0x18, 0x105, 0x0, "19336910"}, {0xe8, 0x0, 0x200, "8906b258f061f0dbe99089b79cd61f51de42faa5e10e3966cb9222709b000c1fdbe9f3b79578d8a07326a78222ca743798e58b3ac2dc768e40aa59e97722788c169a7591a102f71f5aa060ab1311e54bb565a135de0dd92fab0c837bbbfac64beb276099ddf4b70facc6d3e81c3708318af63e0302a5891491ee217812f5fc209eda7cea9a981284f516f0723bf55ec9218cd724bdd18b3db75f9fd164b052d69cabf27947bed87fae55ae04ff0971a09b819312f2d64a7c3842ba67fe2964ad0812f316f9f94519988f9e3862c7bac7dc38edf87eba06ce"}], 0x160}, 0xd0b96a8323aa704b) r1 = accept4$inet(0xffffffffffffff9c, &(0x7f0000000080)={0x2, 0x0, @empty}, &(0x7f0000000380)=0x10, 0x80800) ioctl$sock_inet_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f00000003c0)) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @rand_addr=0x10001}, 0x4, 0x1, 0x4, 0x4}}, 0x80, 0x0, 0x0, &(0x7f0000000100)=[{0x30, 0x29, 0x2, "0000000000ab000000f2ce1d5749e890fa000000a40a000000"}], 0x30}, 0x1) 03:50:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x300, 0x0}) 03:50:39 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:39 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000080)=[{0x28, 0x29, 0xc9, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x2, 0x0, 0x0, 0x20004080}, 0x0) 03:50:39 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x2c) 03:50:39 executing program 0: r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x1fe000000, 0x4480) ioctl$TUNSETNOCSUM(r0, 0x400454c8, 0x0) write$vnet(r0, &(0x7f0000000180)={0x1, {&(0x7f00000000c0)=""/94, 0x5e, &(0x7f0000000140)=""/24, 0x2, 0x4}}, 0x68) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) ioctl$UDMABUF_CREATE_LIST(r1, 0x40087543, &(0x7f0000000080)={0x0, 0x305, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000000200)={0x7, 0x4, 0x4, 0x0, 0x1, 0x2}) openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x1400000240000, 0x0) ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0xf84) [ 1737.108295] binder: send failed reply for transaction 5543 to 31197:31213 03:50:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x300, 0x0, 0x0, 0x20004080}, 0x0) [ 1737.169281] binder: undelivered TRANSACTION_COMPLETE [ 1737.177061] binder: undelivered TRANSACTION_ERROR: 29201 [ 1737.188488] binder: undelivered TRANSACTION_ERROR: 29189 03:50:39 executing program 1: r0 = socket$kcm(0xa, 0x1, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205649, &(0x7f0000000140)={0xbf0000, 0x0, 0x68, [], &(0x7f0000000100)={0x990a7d, 0xfffffffffffffffb, [], @p_u16=&(0x7f00000000c0)}}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000400)={0xffffffffffffffff}, 0x13f, 0xf}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r1, &(0x7f0000000480)={0x5, 0x10, 0xfa00, {&(0x7f0000000200), r2, 0x3}}, 0x18) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="68000000000036442900e5eb8177fd0ae52b00000000000000000000f8ffffffffffffff0000008a830925a36cd2ae312a5f009cfc6ec43088f1971961e45379d644c7b2b514e7c86f700d07319b12237223dadc4d5c6d6c70e8c35c37895d3773cd885ff33b4c6666a441652f0798d39ec3621f6890ce15bf18e51e26c5267d0ffc"], 0x28}, 0x0) [ 1737.245198] binder: 31247:31257 ioctl c018620b 0 returned -14 03:50:39 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) r1 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x101, 0x400) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000001c0)=[@sack_perm], 0x1) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x40400, 0x0) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000240)=ANY=[@ANYBLOB="cffcb96eec3dd9d0719d176c0916ae0a9ca380f9bef9a2cd27de21880956df44de6f21bbda744f80038baebfddd03fee8afafc8ba5b8edb9ae532d31ccf5cbb7ddef9ee1339ece1253da73f45f6eaaef8b6879ab196b1d8b1fdb626279d72984c59b556f8270589c00716b62825d8ed483ebd65e81069f474f1064557116c73aba9fc2ea9a88", @ANYRES32=r2, @ANYBLOB="000000000040000100000000000000f0ffffffff", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r2, @ANYBLOB="00000000000000f0ffffffff0000000000000000", @ANYRES32=r2, @ANYBLOB="0000000000f0ffff0000000000f0ffffffffffff", @ANYRES32=r0, @ANYBLOB="0000000000400000000000000080000000000000", @ANYRES32=r2, @ANYBLOB="00000000000000010000000000c0010001000000", @ANYRES32=r2, @ANYBLOB="0000000000000000000001000020000000000000"]) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000100)='/dev/udmabuf\x00', 0x2) 03:50:39 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1737.335400] binder: 31247:31263 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1737.342615] binder: 31247:31263 BC_FREE_BUFFER u0000000000000000 no match 03:50:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x20000401, 0x0, 0x0, 0x20004080}, 0x0) 03:50:39 executing program 1: r0 = socket$kcm(0xa, 0x5, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000080)=0xb1) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="28000000000000002900000002000000000000000000000000000000e40a00000000000000000000b551a0e260206a432b6bd3521cc273bc4f1791ebfa2240558c20cb8ec17f9b3b7673117484296dde79995a86cde214be385b74a45ea6be88fa0d67eb3b09e91ff1d4551ae22850b4ff1f5fc417c2975d29e47e189a2811818f113d3fd809ad82ae15f9e098124f7bb3d9a9edb2f58ff3d6260db0411f24a04557f402a2ec1d4e1bf6c88f0afe5c6934e0ad737d535428e2a4e5ff524e0b7b0cbb47ef3fb8a75b499cd62e18722ecddb3668910b3e832c4ef3524a41c3db0027f9fd168d99542bf2c3838f2572d94c805e996e16f43c5c55d207963e10e1d82d22c958bb6a3a4ddafafe38ca8e0bf42404200b12d213048ffe43ae06f8ff09e809de32eca07acc4e25a361131ec8d8fe000c1b1c0ec8737ead0e76057f8b0657995e3aa2f9"], 0x28}, 0x0) close(r0) [ 1737.395117] binder: 31247:31263 got reply transaction with bad transaction stack, transaction 5546 has target 31247:0 [ 1737.429743] binder: 31247:31263 transaction failed 29201/-71, size 0-0 line 2756 03:50:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x4c, 0x0}) 03:50:40 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}, 0x2c) 03:50:40 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x0, 0x0) write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x2, 0xfffffffffffffff8}, 0xb) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000140)=ANY=[@ANYBLOB="2be95cac16b76851"]) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x8000, 0x0) getsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f00000000c0)=0x6, &(0x7f0000000100)=0x4) 03:50:40 executing program 1: r0 = dup(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f00000017c0)={0x0, 0x1000, "a092113d8c4b6b61f88df5b8991f107a0ce44ef2f3488cd690e86ee2e8a147b11eaf7a55cfac70e47a428717b4e668db09efdeb120d8835d9d90a184906f977f67d6760cd552fa7a202fc15d46ae3478bc113716183bb3f98dd2eae739caaa71c613bf3300645cb2bb5488d88ac683c86b613ba90b18fa329b8d90bbf7eefd2e2528f8de6420de62d8d09df8a39d58e47ea6e4c2b56fcf06c18955ab65ededd67a3552993d86fbc87232f0c284ad07a5063adcf81062b5708770fd88a1938f615216b58d1c2801716ab7b34c42a735cdb7644ab76de143e172fa53815d8f8dedc74b0ebc9346ffef7d5ac9cfa37db32489897c8f3e6a1efec20af24ca8f6a33d30693ccd0a20d729543db795593053ef337e55b5e34a592756059b0cfbeb5a5fb1ca58fb5001866482aa591a4adc9b7055e740e51f692c12f701900a54e60f4c3a7bc387744a7f064e4131c4315f0cb6161cf03b8816c72e47b42fde0c8379a4d727d5df3f9b2f3489eef5c28e1cd3ed3809036ae5316f72a1144988b02b0b839a393d90b2a72a371af6d587fc6e676704d4a5d7606081eb3b84111affebddc9d7e010e3725e0622f1ad51344888aa332647751e57382026ee3b8c7bad492f3964563963ea7313d7d9dc0aadbc0c904139b21be1eb70b695a765914a92d7a60c88a7720a5806b8b121100a5796ff0a4bd18b5b7fb04962c897973e059b6a477a6dd79eafd618ba9e66d148bc5f9444390b9a100c47bd750646faf6de466793ba1ed444e21871e5678920df4e5fa42dca9f86c3bf0ca52efd64a29b7a911f4df2067ab1a256f27da9a0f753014c71cd9765559f59e12e5a0d33f7a85c587e94ac48285a7d87f377bfbc3d6cc8fd1cfd8689251ac928cb72c01df7d0dd64d5cef19db35fd3175515eab5292cfe6f1907157278ea5e693504c8c8bb7b65f694eece3e7be17b295adaa21afde257c8346399db0ef7291e255894f4db948bfef2f97146e67a7582b4ebdb7b7613174230119a9ba0ff457be5a5af656997029cb93bb56932908002c9d28f66455e34e7ebbb24b26d69287a280c7a3b76bb704583d5848023259805ac12d4fb885ac2b2a30f4eb449d0af128c89410f6459e950eef69750c1282c35482fdfbefa4739867c354a1e688cb2c45c525761dca23cddec91f515ad4256060c94ab572d713ef84543d77c820aef0d74f040b39244fcf7f0aefe00a223aa7ab958af4beb8d018dac6dc72b9dde3ec8e01bcec5574967b4587bae50e1216acaae30f46a77111bbaff4623d8dd987e3d43680ceb453480e47e65429135005fa8e93c530afa80acc5034a04eb2fb66992f08922564adbeedb42d93ac1b0ee37c44e5ae182ea9e23a7d2e0327b4a515fa6f2268df0c4ffc4424db3abd4d930b2eca61dbfa53af1947103213f8a0f09f1e084b50e14785f5d1fc4b49205c351db87804afd278cab03f8efb7fccbf6417cd126d2000f8704080be2dd73a4eeacba222564621d191115f6e02f2f496ba2139cebded6454f44da102c88bef19172e5b87d0d74676c34383be7376281712df3a068d52c4396330ca840bfb0af1a31e108c7135711fb4fa3903c2aba9911af6a67efc09eaa42cad36920668b9c7080f6afad47a4efa4a5a80be2231a3514a02e0ff9ab949606f1a33b08f24c9e8a7fef71baec08043f4680f1b216cb97308fe18d03f7704ab257d92a59b0922d45ac3d5d09b04560c312d90ad8c86260db791602370e78d853c703f876c37de5da1d68b5bbdcdcb61cc36edd4a632624be379ae7f16fe57b20a0e8295fd25fbb6c8b324bbb26d00cf6d02892835e90a1fcec7001df153fd9bc17a9f6f261fde2466bc430bc014e77239f46381c7c7814a43328a0c8d4c9ccb51badcf31969962daeba5dd6f7b441ca3842bc5cb513b2b5bb9ec0dc4f749ea23dd7abc116cb886a609329fb23cd0b49e58e6afb88e74fa7fca446d920922bb6ae5a09287d37a7bc13de4b296cf7e98f17b50509e6b85f4282244520205a98191e183949cd738c8786ba63aa4a403c20844eae87fdf6ecfa87a8d6361fba09b483b3e71a0b0176ebadb099be5b3425cd7b4e4859821db300b84741e78d8759daa2ac73286871943814644c5332b79efea6f82033f999c5a7e595bac1ec8c822eb9da8ec438df45b241de083244479dffccd65eb7363bd8e71d51d23d4de7d1ae7e4ab6b6bbd1f409033b1be5cc0972977dfbf7cd624dc4734a611b65749f21276e7e193ecc8515145561fcfbd887a03bd4a8db0f07121a96bcbcc29927e90bc7b01a4f07a5e56ff7c37406d58c11fd69526d56a730e38aec823db5872b34c58b8a664c88d2c3262a73aed69d1f4273ccc7fdc81c2b71de61ed5dad0916d15ceddcb8c7dd95d5d16670edbc160776d16b5c91d6accff59aaf56b0c0f0fd1e899f514ed2aa82f8f890189825476b80c9cebeccc7a9b5b49281d2442f95b845d8526ab1e05ec23bd4cb0023322651dc719435336a955a1bc2ee4af563d71c8c27fe18eaa8af58c3726da6dca159827cd08696c8f5a020f2525eb06abe47a948e2c36d5f8bf9b0690033aaf3326d31a3f402dc1ef8333ce1dfabaa736e8cdd499ebf17bd8353f530ab6659c5ccd9334000fd6e4c52cf712ed1089df3e113ea2039ba4a673ec834f2c8d349e168850628a868ca393274e0aff53ebed391f82989adbed3f1dc7cb71f17f198c54985ac02a6ff7ffde81440540d696d0dab53e9ac1dc587a4f0e175c19f7d1c3b24a4cd689b853099058ce1588b8cf531b9fb9a96190f32f862ed78485ffb3280abe4be08686f2dcc4a5b91d2a0e5445f7145d997477828b7f544e15d60b6501d7d9c8da1d4e0177fbbd707118e66ff55436270f9e58fac6e8d3808e6934998beafae2758acac4cc77296a645be0a067d12c1139c21643a7dd300a1a7ddf00f4a19197bdf066e01b5b90e077379c87afcdacff48b8e96bf4f3760a4d129f41fe6c6a1346c4845a737e18cedcae8810c0487b965b56ecac7ed109baeb6e112e69636255b782ff680a91e75040de9e6251c1eb66cd7d726b370effe56d4b8f879cab96e01ac112bbadbbf3eca7b925252b43ace24dd3a057d992cb499657852db69f973db89e7f27e52b3f80380585c29eec44c8dc9205b9f7f90bb6251405f00fc17461d980f7b6c99af93d0f324d228f817c7298383f2c56a451d2eb80d14941afc80984d541f75e0c410b6bfbf4e040d26847dda8fa198df4d51ace877ff44ab7b5ad942554221731b4d2da385f9fa69af9ccca0e80dfb1f61f59f9ee5d6a23bc48e51dd5ae021022788b54429a0443edfd15f5421711fe2047b49ec3e79ebbd133c9c662fb3da19d4917c77bf74f973bde32d5c6a51204fd74a4060388f5dad6e1a26363bf583bd8d419df115918d94ddef7e4e4b9d560c92deee144194e96789506a50eaa335bbb42ce03680536bd85796b7905b38e94e2fb47f65e1ec182f9d6e0e25ca9841d068add37a6e0656bc7de3a415443259ad1ae8fadc53a23d9263ca752631fa94d1f4816b57800f2292e430cfcb46d37d391656b2e8f4cda7727dc3c9c07303e0bd8e95712c216a123f7ed63ca612dbb466d249d2562cdb7928a1e3fd196fc04aae5c3eaa28656d210ea705f0f241984a946083858d9ec88aa64e6da5251015ca357af3d830843a3613819e1599458398264708e615fa89cdc1db6d73343438e0dbb91b8cc8532ddf3f2f942681f5dc125741ed781fb158239921e53bc9f8a718a2e67d900e6a4f0c606e71b6579a767366ce3ee96bf114dba6ae59ce84ac4d530f1aaa4257dccc81b4277ddbe8f7a9e27d1c690e0a2a904a32898bf2ffe5f260cacb1d8f57e6edf0afd8f3236cf08275626c0754c49d449c8ce1d95bd40bc4db78221ef6d4b288be4c48c0a25c5cf57b84d05b66145ff9c9ec00e5ece0f701bf3c77d0d2453b4771e2309290f3d5e09d1d6227fae97efcd40ba35a602498812e785ed5ca3aa246ba4d752fad1d64ff4fdb69ce8ffa8776694854c49df07dbe21ea383186ba6fc7b0a26d77f12917d5700f5299bbd545184522a419eb69a8bb745c36fdb8a563fe86e456493802e5dd183e2d65f404b7a7d94a8a08e68bd4275f2da47f80fe09bbb1d335ee9623d7e3c68a98761c75e50c7ac0eeb05f1137cb789aff7383031c3543bb880dadeff5bc3f577a549680d1b879a4e0c3e40b9cc1c3b70e98d0cd7f24140825a6e85d41164248151b7db7e7449b6eca0f396f62744002a3f9f86a561ad97a7c5027977151d16e47002338699be0479cb3219cff82a12fa1b081e677cbd21172b8863819d04fdee0e746c42153771f503ec85b9c27c105bb459258ffc5b951ef576fa456f23e495159a22ddcdfd91e07fa55df1809d1346cd5261ff9ba195d89248fe4d3eaf73840eb2a7b78073a3e763738642d08930ea4d3c5dd3f5747c408d0cffe456d1246a61943e570ed2728c84362a7d3208b746cd79e6961e8b670407afb38241ebbbfb129fd1fc694520040db13a639a229418e60a690a01b1ffc6f0449a494dfe1cf93d5998d8cea072f190b41e228d697f872f71ce9bea0e7a9491745d9d7bf2915a486a88215a2bd35ed5170e0f469b938c5a519e7f6e3b509e07066d3e5d5db0e418d65e98f31b187c43ad4c3e4c460ec1899680ff4fb5017b5789c2936e20fcd88bfcabc86b1fe5bad75a87c3a8aab1afc703f3da221f3501273abb8ee118a2d0d100a2f9d9c529b2b4b2b7b79326a5058482e64b68b2c21eeba46a2c4838eb18fc2e97609c3a61a43660586f683177f19132055c2e9f96ad1173b1e54ca1605269fcd44da1362fb1e7905688f73d5711c6043e62c3b2a9c587560d7a7130bf532fcd215dfdb210b34ee7b78f64608e3f137d46ce78746cf7832043b8bb9b18bdb4a45fba8f53dc4164a7df260093c28bd5c8afd8c13ce5d78510e27bf4104c55e76fbc49187eb71a22f931a0126dccd852574b23dd785f324738548d4caf441aed22afee471b493ba3f91aeaf6e60ca71d490822ed2ed4995622aca80141bdb30af1a39b87e9030db998438fb0aa90e56697d39d09aca23f295d2f9828cd2b0266a2826724d90cd5f4be30e3d2e242e27058a603a7706ceeb42e29cdd5a90b1608b80980096c2c8d51047463575b3306211b96131ebd528c2c99e2f57466208566fd751a93a0949a99962d73615cfc14ab8e8bd1a836552428e1d6c5abdbd36dace9e10c605593286be4478d1784768ca590ccbdff928aa2fc4c34f53ed8e49cf1ba34c7421b5bd06b0a621341eb8566fa1177552f0c946a4e648b35f825fd23201320bdaa34c96a0daf8d1584ac5719cecd06dbd47f83becad57b738bce69df782454b469fe7c6de3819befb0e0c72b25572db0a046e139803d4267e812e04a00b521d6c35f20644d74453a1181c9ed25d88c8daa017e95811735be824104d84feeb82ec9dd0a7757376d7533bb5a86540522f1a2747714db62fc8d4083c75bb9cff09a1fbfecaf9c016d7513e36a94ac88b858350be884171498e2845334be02cce40233047829e6b45d8ba02515e78959d8973ac8a1bcd455250e8c042ccd154d886496d1e80ad7e09969ec51e158ef92344abe23747ecdd61190c6029d73bb3df168f76036c10354bc9c27b6ca75cff7176366d8c86c431cefafb4a13dee62ce5f188b5ebd7bfaa4ec82734f37c4275f76e37054fa50c01a29ff4543ff86e6ef2b038ee533d1a58165e0d31a0e7c5cbef2cc29d5f6008d2639568ac99e7bcf8511bc"}, &(0x7f0000001280)=0x1008) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1b, &(0x7f00000012c0)={0x0, 0x96, "a6290f52b0acc4b92578d548a803f3690cecb01b0df54cf2744d2be4a4c1f2ddc9f35843d148a96fb7d19774854f243f423918a21c5aa3488d15399a55d66aedaed543a187164c8558cb277c8a0bc0fc70479e957a0438f8f0cee79d25bc512fd503c09d3801ad6e13f767ea10f9133eb6eab1c583413a68ecf909bf8e51510f2649ed635be64a3002483b30734412aa03fa72620370"}, &(0x7f0000001380)=0x9e) sendmmsg$inet_sctp(r0, &(0x7f0000002b00)=[{&(0x7f0000000100)=@in6={0xa, 0x4e23, 0x8001, @local, 0x20}, 0x1c, &(0x7f0000001240)=[{&(0x7f0000000140)="b18586935255f68e", 0x8}, {&(0x7f0000000180)="df3daa677171149d202017f8219040ed99cb75215bc41861347ace7b91b762cede1446abf8cf09ae74e70bacfca6c32c28de121be14b2de91bb0f4e59ce2d0aaa66a3a62c0b146e33590edbb4f3bc7a91e11367a58b7", 0x56}, {&(0x7f0000000240)="e9ec7ebf667b757369ed410c3732af4341a188601200770e35965a434f38527b65370bb125aeb77b3a6da66b30a488cef6154e41786518a750d87e468dc196a8cd52a74060f09a2d68a1c90a7cc5d45847490e8461bf14783eb03227e369fff980b2128541ec4b508a24ca69137f590160255891aef18d6acab39c7885963363957f8786eb8a6cedc32c95586dbc4af785d2c9f12cfdc65c241a107a0a46384bf4ee1d818d5e99ddf28d34a0d6939a44ccadca9aed433ddfda4a1152ac7afebc12f46c1303b891a199ead4e67387afbe5d5f4d942cdf734f6e2583ead1d9b73122fc048c95b812a8dbb7bc099440bcddf2d60195dd02f54bebc12e64639d64315086b54b593a241252f2e3edd60aa3fddb8ed17e11b486f0802435314befda0b8cde77b678852f45ea6bffeb4e8ebc7ec9588955f3e989b8a2346bbcf9c9f8b4c7fa754104fcf43d1a2a24ffa5262fac9c0aaefc136886d93d4a7af62d451d8fc28196e87f5ff7de064aa4572b037511cc94b7a284859b5148892db272f1b246a2dbf2a7b75152a088938c9a7891b150725ef20534fa01726d4e32edf2ccf7edf01f55de9e249cd96662d0b87b4ae5f137ab2847b3837c51751d5854d5f564b5d3a205ac027c72eeffeeb95e91615a2ba3b67fd615ae5052639f3bcebdaebc6af66391271a33786d945a6e4a87e157323c2f0539b993310682f5c06d8e1bd30e33e8659e1334e132f552339f7900be844849a8458c47d4f087744da805383f1ecc571f89e0e0929b372b1d043afa63c11639db1d7aa5ae0d57064d4a1838aa6d72aff46c269d8ff3f204f41c03dcff88a1834ab109ad1b06739583dc4e7a1f19981bca147788dcefc77f57b129dc895f314ae2a9e9f66e2c75608df4907d7fda49d745dc513c00d5beeff45e56fbbfa85bf11c6b0ccff9a27807d9195c0e3a7fa21a9f53f5ce2769133659aeb2c6243e36ffa4b79db29cdb8a998ab3227a4466a34a306934fed406753f866bd32ff7c5db2c33b39d8fe73da19c663ef4c5c5f0aa2a3d6b60829b137ef8f8a98b08a5423dbf55be25e0909c87a5d57990bf2d4b2059b0939753712394b7959601285fa0bcfd8253e25113bb7d07a5df1a77bdd079b55dacfe1de86ddb5c5bc12fb5f79d7d19ec4b69543000c0ba15eedef12b86bd1ac670d68d4e89c5130fe28ad5159c437444d16e1be87ab5206957ba670d4f0f56cfa3eb2dbf6ef8568259e7f278fba76999dcc8fe795c14fcb0a3a103e7163da8015b2f193c5898744cdc824dfc4932d22c38c6daf4a30a2aaced274faf87a3d1332067010d13cc9d077f408cbbd6895116b2bb7ca765b48e2d86f4cf56e6c0cce823179591a3252ff0b5b6978c10fa5aedb5eecf501d90a3f1f95d867599a0ced3eb05ef306fd02e37ded0a616374e9d30716562f40962b1e5eb7582f59661939df4e3c1baf6ff585e50c376b065f648a0641714a4e641ec0b6b8b66de3342c2aa85cf553f13a93665374074a36087f88c735a4e704c0d162b186fec20ed010e41067fe1c1c55b2f049cd0362468b5c3537f040793d07f85819efd5ee44884a91258054f4edecce8c0e35778eb5699b79b5beac01e47e246fe889226104453c6f27abc5b99b0873201eb9e05c4fd4f18c67b00dd26935ee6bf65152cba6ef8263e53d655cee6a8fe46afca26d8500bed823cce820780a8507956f960a554f254658e3b976c6fe40c3f56627d2f8730a276d11a85c10704b32381333671d5e840373ef1efa50f0c850148f41d2ed18bbd39dfbbfe92a877aa4793ed0a25b851edf126408dcc083fbb6098b299c12b95054b3aa6809d45908a0b80cb08dc54af27b2d463ec1b1a26c858df9a822cba5f76754714b692e1af10755afc05654d8ac463edf5f562ef4505bfb720152e5ead57cc66e7107e496a30a8955cfe8244c16657ebd3752b2787141c82c75cffa04607fcf5a9190bcbe571c8da5a1548640cf7639a79d32df9a43d072e3e89c48d5d3f125cceed5c5a6b9c21dfddca8b821816899c084e67eca76dc8493a2ac9fde33cf8ad6fbfcf840712560017d776e8a6da916d6a8ef000d72ba96048725b4cbd8c302e8db4f3816b95afe15a4a936c3032fda5ea56de5a7c5090a6ce2f7fa4a81479fd19e693af39b8732998a3a5d2a2bedea1e1c8115f457f298820a9e1af0968a0aca3e8f280966d425468087f81f87d2862d03823c274803fc2185819d7ae9cdca1a4b409abbe18c1b665101ccc8932627a374426620fe6ef4601123db4ebbb36c94fe9ffc5a02af1353a16ab90f24a4baf27a2077da1c8816c0c0d63798d62ca6fff775c6d149380a7e9a6904162f08ccb4ae92cb5024ba8094ffd75cf5d986abee8e91f3b0fcf56771a5e76c59b9e46923d90b2b78a7039f116013240466b958da49c1fe672290cc6a81e734da7f594fdfdbd9d9c6dc7f5ae79022d10a042357c2e88d6d346d6b43c8758b6ae13b006ed8927657ab36c804de61e47e385f6aefe8211ea3c403bb6a5d3889e77cbe7685052e7cc3cae80683d5070f3b0bf24faac23e849baafbfd523e8c5fdd3046ff7db441057d78cd6c4a4d29790b0236e4f42e7913f2776970173f88a2d0118e6dbce9149c31531c060b5d394e1a78ac3121d79caed9e0d577adc5026cb8ea1dce176561bf23e8000c3a3cefb4140953d85f22fc5e79708ad494c75e96113a040372e5b1a9282356c731a2a1561efb8d838a181ddcbdbc578a5a50eb44b0094c1855fb44bd86441cf86778c49bd231d68052da2bbd91de7330595f09845f4a69d576803cfc4a7fb8eacd323a7bfb955a3eb3e160888820e35a150c3c167390703dcaf4f5b817a114e04f2c54be514ee250dd5dae582d017d44c5d1772a160f90f93b74deafe91aa0984f1d09c8681b4c394d70f226bd44e04807f15c7599a8a5092653a14e820e659201e954312bb5f349e84903891c26d3cb71eee6604c1e321133a99c5ecbb78073dd0a3782ed61692e3f4b425f9fdcea5eaf959786684656864f4e68a2a321d36df9a8632d6d5f74189845e499b88acc2552bac4e7d39bebe9f552a53875b18477062a48fc110b07de1dbe264c6519af623d82a46e2ea221a5370e6a740dac2b4bea6b84c6837bbca8ad449b310798f3205c08d38d9af6e68182cd0a9397be668a012a35411d356710c56e05f3cd83a7b369579b3e922a9e16f362843be8bcdb73ef04d3891c5d271c2c5986f96914967c51f513c1181b334b74a658d9d0d4150c6625f49b2e7cc8f9c37536cd070bbb6cf2c1043ea2d7749c19194acbfd99b44b2f98242d7f9ddc0ccc0ed10e82ff79a95a7764cf2256c662227acf5b3452fed899e3d364a89b7911f964c83022df62fac105841effabd7ee236db8161a77d36e23a6a4d2825a8601488dc2f45d9f2f35ac7608306db44ee1dcd94b621285e716727c23dffa1a80d0187e76a7bfef31abb68ecd290d9f68b4c7324a57af811fbacf66d0cee6cad3538cc3ad3454d313d910fcd84db0a139d41e0f03bf2917953d5d3bbce796fecf35a48f1b74141292fb515fb0467b2138e9f687173e27245ae9661aadaa2a1fae282f013f31f8303735d4da59939268657d1761071d4d761cfdf52680f602feab8625a053faa844047e6b7fba53e598423f89f061814ccfe6789f2d4cffd3fd16388d89a1d2fce0e3d9475bbea7cdefdb96f1c1c6f8af97dfb8d5bf35c60e14b793bfc0d2ec6ca1a7c4ba110de9643994b486c804a15ad367b207caddfc3a4be5256f1584755b0abfdb5f801c3e8b3763ac54f9dc5502b331211f00b733e660fe273ad0526798e64168f568ec6fee2c2bc489a4dd325f30531ea5ee01ba8a76bda8000981ea2489dfcf5066fd39053d412291e576406638411d71741a459d24c9c219f2a8cc49e54ce7e82223908372d8c49859b7913598999915aa5bc151830f56982cc38c57d686886c1a78cc4c4bc4e52689853cde138c11a169a0ed0f4f0102c1b2921ea640a66906c8a41bece9702e533043fbb90ede059890b0d7895cb917ad9ff43f04f4835fc03a5bdf2a7204099b01b58a8fd854d2ee2ae4daf4e50bf7e088cb300d361431bdf9705de131602c3a189aa3b071be0deabebc3c662d335829cd951bad06306a830c0970d3bed7fe3eb9e1820f1f55ef7383ad9bcc57343fbb25f85f447c6c8b9873cfe99aacc320a1fa2b96ba87ceeb5cd8dd850b673e252941e50001c22b24243a0d01566264e105b82fac5207e80365f5397f939b3e99b054e9d3ef856ded8389a487f9ec16a6ab6564bb4230fbcf640bf21dab0452f1330ef1678077345027e2c36960ca37c688e274630d779155ff3cd96f972faf51a8d3cdea0ff1ec9d0e79a7519e39231f11d571bb264b7df3a4c3b03b0aac2f24ad7eb4581e4c0a2f6548e72c08c236bfaeb4de1b636fdde96a7dd485fed89a331aca33bdcab70e39bd47be77336a622358f7a608b62a3409583eef734c8cc795dc9e0342f7c4e0297da50291c4b86cbd589b4ed1db937edf87d00bdd6de9e75587e08cde62f2f89d3b322b7b8ba7ee2601722ea7e71435424ade49de0e423082e184d69838524c88fc5ac241ce901bc4ed3de33fd3798432eef226475d3b87c3f69a3d8ab701d347838223b4b6f73793838cb9ec8710a67cfe4acd9ae8f80341770ddcfd919399f128507bd049c6c8dca6104150a7e395da3e399d5dd01e6237d01acca8fced36e1bcec75ee9cd85231472f142412410f6e1128cf3476680b3d11ba91bb9073235615c85433ade360b77e651ff9f0a7d51fc9c11a48bf0818cedc624125e1e9f839f3e34a20d1c3bdb0ccaff711c146c8bf935e24bdc6446d33d5eb064c595c933ac1fc4adc5cccab1ac61089cc41c5da78ca3e7c8bee8dd00a5d5cda53c65ef34f19e3af264f71e372674d6b0cb6c7d5e6b8200d2060879fdebeccb22bee0b45e34bbb2c2b1f6e7e6a9b8c389709f6603737a887287f01f835928259903613d4173ef862f9f62539c68de81c4c9a0cf156db312df01bfb36f2b98bebfe58f3ac4ef0be345837ac18b53ba2948785607ef6da05e5773787ebf21e8b105322d307ba144b3af3c0450f77ffffb71ea0d4e0acd6f66c0979db72029620f2f3a9803e92f7c5a0c9108d0eb6a27675d3ec9c32976217e5ff4800e4a3c67fdc906124f7fd029d2a7b02e6dea1b140d54e9d734fe776dd42d150711566848a8a0713bde3d7293aafc2f6e9638f0947a63c97c750380e823755788be158897a7898084be54fc1b16a755e153d7ecf2b683dc3a4485dbcee69adfed9b50e4caafb25c3c4f1832e76a7408ac2baf8d654d568562204ae123b3e68a7d6f44b08aecf205bfa2fedec3a3a5bd0dbcf50c0d1642523b4f36be74ac5d0e3ed8ab1a70ac68f4f929a3c8906aca997fa113864d823c3129e45e71d3a9c329a783f0a3a123adce9c1e97b419c47b417434cd93001cae3cca705f6bc3a82982f4808f6023d7a6e20842c743f0abb1300b16ef59f400d8a14500d2cedb55089b123ce75b47f741777869d6ae7dde82fb610dd9ab417c07474070f36269ffafa99652ebebc7df9c22bc4550cd3fccbefb9a2b25c95a8beac48132bf4fff86f262b022685499b0346bfcb2d760052b5e548e9436fbd9964694fed6bbf00ebfa198d76e409d100415a27bbee4c40f70f4b61bc9a71ae33bccc6c9c7484d143246d94f80680e3dca12ec4e96cd6aa6d079b2542e1ca5b826b10e62672fa1c58c628e9a0e61cadab253a8416f40d5f86611542d", 0x1000}], 0x3, &(0x7f00000013c0)=[@sndinfo={0x20, 0x84, 0x2, {0xffffffffffffffc1, 0x7, 0x4, 0x8001, r1}}, @dstaddrv4={0x18, 0x84, 0x7, @dev={0xac, 0x14, 0x14, 0x15}}, @sndinfo={0x20, 0x84, 0x2, {0x8, 0x5, 0x7620, 0x22e9bba5, r2}}], 0x58, 0x40}, {&(0x7f0000001440)=@in6={0xa, 0x4e22, 0xfffffffffffffffe, @mcast1, 0xa457}, 0x1c, &(0x7f0000001700)=[{&(0x7f0000001480)="4184bcd0a517b3ad2a9618882f1eda77a3b9b8b7ff37918535e784a5610af0397b410f2f988d47da40c998e6d6aa6c965c68f8cebec9326d3817dd134455024575e5a277a47e64bdf6248f21e6760b264317952d917b85507b942396f2d44b9b7599eca4fb9fd5b494afee2631594f5d350455982b9ac698b53de957a6b81682bbf081bebd4d12ddcf41c1ce9aba5219258991ee89890e0433cbb94d9bd9f48b7f40b3517b81acfd", 0xa8}, {&(0x7f0000001540)="5b7af87792797bb72aa06c165671efc2b25c9ea577c1527d8b1373c85248499f6ec8d91b24bebc21b80b8b725485149f73d317b871ea55182fc4894bdc4c73a5b647b8297f1c56387fcb36055336d937eb5ac6f63a56e9409fac76e1532afaad824a3c46996f44212f8be3081ba48bccda8b84da769e5a832e86f74ff5eb0db0f1e97efa9fee1c7ffd9267ec60669f8713e17a97ef09ab9fbcf61e4016de8d112ed45f7f028bb9e5285e94a9684bdc5861c668dbebfa5e25128a4f6e5179518a2323190ea2253e37687480b192b91138350791bd9358e0a20baadb28a9ab5e748fccd6a850cd19c6", 0xe8}, {&(0x7f0000001640)="6fb7ea315d615d4d729a4674a3e81e249ba4aa5dda0bfd479eadb1f816fbfa7f75150a4f22036870446a07c7a69cce625ef41f64480584a547152f92eaf211639708958261418b237d64b1d3f5bb0de2f660025a5840faea633dcab67d94bad04a484d93113b314bf0216feb3dd5a5878735293a99d4235c73654d4d502aafa689200a15ab73068c76af86684de1bddd341842ee782f3572cf0a79e695b4a1", 0x9f}, {&(0x7f0000002800)="f9e58013f5590f4baba0d2677b8107f4af47226d70b2e4304e50688369008a174fe10a7763dd07c08647898b3f1141d4fe6464887fa1df7fa5b215254a1cd5a339fef6ec2d135389e4346dd0f6bb5af25b51f80edf742719fb50af61d5dd4961c18972b8e5cf1c1e366f906bb0805d66dc795244d86874b6b1dba13464a4741739cdf3cddf49e213469d9c119acf3409c5f876535cb8cd796f5c5fd23695fa143109bceebd9b280305b051a740244167495650fbfbdd3da2ed43c17e451ce62a2bbba8f31aee76e37e7d08f91566cdadb935ef8b33a8de6a9d2715dd42bbdef824ebedf673c9d335b7cbd9649d78f8d269a984744d21b1356b", 0xf9}], 0x4, &(0x7f0000001740)=[@prinfo={0x18, 0x84, 0x5, {0x30, 0x1c}}, @prinfo={0x18, 0x84, 0x5, {0x0, 0x1000000000000}}], 0x30, 0x20000081}, {&(0x7f0000002900)=@in={0x2, 0x4e23, @rand_addr=0xfffffffffffffffc}, 0x10, &(0x7f0000002ac0)=[{&(0x7f0000002940)="6455b3aa777604a776156e482de65fca3ef00c5a187ed928e09b1c9912c0b1eaefdf6b27b342a563320037e21cc191e265d989776431c49b0ca67f15f327eed3b7471764d1a7d71b98efff59e8a84234db19acb4546e14d7ee2c84d3f5ed68c3f116e7edeb08517e0610924b62ed1bfd2d7de5194b255a12680aae5e3ea672a69989c466ecf61ccce26d46b0db2b99a7b7ae496d788317902ce0a2e0c1918706c7a63ab89c27db947802798a7cd7fddb3857fb7713e53143c3e43fa0affd5d6cf0719bbbde02c7a2beeac835818d54cbeb0f98cb85630861632e3b6390341484225d36ab2bae70dd26d12b8834f3ea7fd9cd13bc3f4817dfbac42625b6", 0xfd}, {&(0x7f0000002a40)="bc56d9a7cd3a886ab89fbc826b5ecabd706ae22a5afddf528933f3a36170d5d8fa7362db6592656fdd816626930ba632fde4397a735ee278cbad813fd7cc08b350d68b6ea7b2812d1e75a6092d4309f94a1b251e2457ee61a7d801412ee60da7bc5abb8c34f921", 0x67}], 0x2, 0x0, 0x0, 0x801}], 0x3, 0x20008000) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r3, 0xc0286415, &(0x7f00000000c0)={&(0x7f0000ffc000/0x2000)=nil, 0x7, 0x3fb1dc3584f5727d, 0x80, &(0x7f0000ffa000/0x4000)=nil, 0x847d}) r4 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000001780)={&(0x7f0000000000)=@ipx={0x4, 0x0, 0xa4c, "e55e7e58e084", 0x58a541c6}, 0x66, 0x0, 0x3b, &(0x7f0000000200)=[{0x1e, 0x9, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x8000) 03:50:40 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x33fe0, 0x0, 0x0, 0x20004080}, 0x0) 03:50:40 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00p\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1738.036098] binder: send failed reply for transaction 5546 to 31247:31263 [ 1738.049000] binder: undelivered TRANSACTION_COMPLETE [ 1738.074569] binder: undelivered TRANSACTION_ERROR: 29201 [ 1738.080072] binder: undelivered TRANSACTION_ERROR: 29189 03:50:40 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) 03:50:40 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x7ffff000, 0x0, 0x0, 0x20004080}, 0x0) 03:50:40 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1738.175505] binder: 31298:31302 ioctl c018620b 0 returned -14 03:50:40 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) [ 1738.240463] binder: 31298:31306 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1738.275413] binder: 31298:31306 BC_FREE_BUFFER u0000000000000000 no match 03:50:40 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) r1 = syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0x3, 0x101001) write$FUSE_POLL(r1, &(0x7f0000000100)={0x18, 0x0, 0x3, {0x7}}, 0x18) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040)='/dev/udmabuf\x00', 0x2) [ 1738.343419] binder: 31298:31306 got reply transaction with bad transaction stack, transaction 5549 has target 31298:0 03:50:40 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0xc0, 0x0, 0x0, 0x20004080}, 0x0) [ 1738.388718] binder: 31298:31306 transaction failed 29201/-71, size 0-0 line 2756 03:50:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x6800000000000000, 0x0}) 03:50:41 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}, 0x2c) 03:50:41 executing program 1: r0 = socket$kcm(0xa, 0x7, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="28000000000000002900000002000000000000000000000000000000a40a00000000000000000000c1fabe3e406e4efec69c9529ff647716212f288eb04b97c9b5d30a0d2202c5faeaffaea427c44c978b18d25b1a2819db3f1b46de7c1c336fbf86dfe8adcfa0a4ec9685553df7e281aff253db1faed3e62d75e22a875c3efe9d3733ca613106ecd54c5aec446b2a66014ee54a647a0560be5091bb94db251d62cb89385e349baf3ffef114ae5bee4b94aa9cc459b8e02787a0a32014f9bada9b53105564598504d3aa82890cb314c2b763b3f5e8"], 0x28}, 0x0) 03:50:41 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:41 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x791e, 0x0) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:41 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0xf, 0x0, 0x0, 0x20004080}, 0x0) [ 1738.978375] binder: send failed reply for transaction 5549 to 31298:31306 [ 1739.013159] binder: undelivered TRANSACTION_COMPLETE [ 1739.025903] binder: undelivered TRANSACTION_ERROR: 29201 [ 1739.043917] binder: undelivered TRANSACTION_ERROR: 29189 03:50:41 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0xffffff1f, 0x0, 0x0, 0x20004080}, 0x0) 03:50:41 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000140)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:41 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1739.170107] binder: 31338:31348 ioctl c018620b 0 returned -14 [ 1739.239260] binder: 31338:31352 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:41 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0xfeb1, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:41 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x2c) 03:50:41 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0xf0ffffff, 0x0, 0x20004080}, 0x0) [ 1739.325095] binder: 31338:31352 BC_FREE_BUFFER u0000000000000000 no match [ 1739.393664] binder: 31338:31352 got reply transaction with bad transaction stack, transaction 5552 has target 31338:0 [ 1739.422649] binder: 31338:31352 transaction failed 29201/-71, size 0-0 line 2756 03:50:42 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:42 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000180)='/dev/udmabuf\x00', 0x2) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f00000000c0)={0x0, 0x1, [{r1, 0x0, 0x1000000000003, 0xfffffffff0002000}]}) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000003c40)={@initdev, @multicast2, 0x0}, &(0x7f0000003c80)=0xc) sendmsg$nl_route(r1, &(0x7f0000003d80)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000003d40)={&(0x7f0000003cc0)=@delneigh={0x70, 0x1d, 0x404, 0x70bd2c, 0x25dfdbff, {0x1e, 0x0, 0x0, r2, 0x20, 0x1, 0x9}, [@NDA_LINK_NETNSID={0x8, 0xa, 0x9}, @NDA_MASTER={0x8, 0x9, 0x80000001}, @NDA_PORT={0x8, 0x6, 0x4e23}, @NDA_VLAN={0x8, 0x5, 0x3}, @NDA_SRC_VNI={0x8}, @NDA_PROBES={0x8, 0x4, 0x3}, @NDA_MASTER={0x8, 0x9, 0x4}, @NDA_DST_IPV6={0x14, 0x1, @remote}, @NDA_VNI={0x8, 0x7, 0x20}]}, 0x70}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 03:50:42 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x1000000, 0x0, 0x20004080}, 0x0) 03:50:42 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x9, 0x4000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f00000000c0)=[@in={0x2, 0x4e24, @remote}, @in6={0xa, 0x4e24, 0xe7, @mcast1, 0x80000001}, @in={0x2, 0x4e22, @local}, @in6={0xa, 0x4e23, 0x0, @dev={0xfe, 0x80, [], 0xd}, 0x2}], 0x58) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:42 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}, 0x2c) 03:50:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x6, 0x0}) [ 1739.964786] binder: send failed reply for transaction 5552 to 31338:31352 [ 1739.972001] binder: undelivered TRANSACTION_COMPLETE 03:50:42 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000240)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB="0001000011000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) 03:50:42 executing program 1: r0 = socket$kcm(0xa, 0xb, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="28000000000000002900000002000000000000000000000000000000a40a00000000000000b30000"], 0x28}, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000080)) ioctl$RTC_PIE_OFF(r1, 0x7006) 03:50:42 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0xf0, 0x0, 0x20004080}, 0x0) 03:50:42 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1740.082120] binder: 31387:31391 ioctl c018620b 0 returned -14 [ 1740.149081] binder: 31387:31399 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1740.207194] binder: 31387:31399 BC_FREE_BUFFER u0000000000000000 no match 03:50:42 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x10, 0x0, 0x20004080}, 0x0) [ 1740.255123] binder: 31387:31399 got reply transaction with bad transaction stack, transaction 5555 has target 31387:0 03:50:42 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000100)=ANY=[@ANYBLOB="000000000100009791847ec0af2fe5dc3a00", @ANYRES32, @ANYBLOB="00000000000002000000000000000001000000a67be39e815cacb9eb6a3172740ff0170018913392725334a8ae6d0ec6a68d8f2d890e1d5a0de98b6777062930767002134bbfd9e1f55ec676d474aa1088b9599901"]) 03:50:42 executing program 1: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000640)="29bead28b3800b5f00dd87835e30956e88c8fe9f33a7d6bb123447f0bc77c83b5818bacca7f7e8a285efd50138aa381366b1e0240ee572cefe3dcb3a01e5da590bda54a76c2b133c8a5d51e37a4ea4bddd12bae4625d1854b2c4a280df3305921156c485605bc734099597151e58ec5803d55a553f6d5f7c2134fe619c77be78c6cd8dcf547c53f439ed0e8c0caa08b9e6364b89f068ffdbe788e44cc37478ec734c6891f8a6cffa06f0eb1be0f94f8de3961a38132ef3", 0xb7) sendmsg$unix(r0, &(0x7f00000005c0)={&(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000140)="e1077b361f7f7b8684edd89229408a9086ffab1fcbeab1f94642adc13c5c6b9fb1b60990b893fa4f28b4ef0260d72e6f65c388e63f75277efb8f1611f1368bed203f3ae089eb461af239bb65100354dfc38c3dcf8061ac684c96435b68f1b475b9f1aeee492f6819b850babf5e97f61cc8ef2a3182da35fbf7cea2a96ca5987291942f86884f2816598abf03c3ccff8ab69a7228dfd29d37a63ed36b937fafe391395ed885e604fa3c5fdbc88cf63b5b", 0xb0}, {&(0x7f0000000240)="f65a1e251f134880218f5b28f770d6f9b18f072415c9a99fe2c5642052f22df6df2e636c1d1583990a359f980ea59cbfc1a0c486fa8742177a99aa38c49bde788494f742007345d75dd8c1a0782faffa7d8a71dc8a3a87bdfb7301913fa6cadbe674c4facb4d39be0c5d8b71911410d6033ffefbae977745280a1634658ab065aeb77ddf92dac2f6", 0x88}, {&(0x7f0000000300)="36f9f977baef0e48a50fd8efe8882565cbe6d9ad344084d3383bbd963922e59313626406e7fac47d27eaf832ea3a68d882bea1c4a4e01a423f68b4e5a843bc10702645e88a9fad0a729fb57b6da00f18649217ac", 0x54}, {&(0x7f0000000380)="88d354", 0x3}, {&(0x7f00000003c0)="805eda8d782170d7d1bddeefdefd5cf38aee84fa28e8be411dfe86dd5af6bd7d056faaf88ef008a9feb43ff5c3992e03d9223937e91ce93b46148d8e53baa45390a234d3dd48fed959bcdf2bc143b17573cd82ab7c2f873e2316a8ad09b6a0fb278780c934c435fa990c7c1eb5343ae8b28037ed0b46a83eb4bb55d50b24bb8ed08b0a5fe30f679673c9597b49c9a82f60b35782b2618a1cf0ed762c85e5e9894fbdae9d19243394c76b27403a3402271ce60a2e819af1fd572215f92018bf9f32b6b116aded55e354bf005abd29962863636f239a611026b2e575776e2da5f32797d4773474ab545d741491681ca4e709", 0xf1}, {&(0x7f00000004c0)="d6eacdcfca14d5896d2fcb8c5fd69a0585d1518c838b4aa2c58d11240184b2ba51055e3f58326a473b7541b85c7ba2fab31997ac8a4d67a096abb17ddc9d65c7c17e1a392bd9ea3bed913bd7707fbaabc87e4c70c4953ca3e7dd79a8165da2bf8978bb26b82b5a16d100161d09f27d653db58e5fc30a1ba3ea699268871ec2db", 0x80}], 0x6, 0x0, 0x0, 0x90}, 0x20000000) r1 = socket$kcm(0xa, 0x2, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000600)={0xfff, {0x0, 0x6, 0x6, 0x2, 0x8, 0xdb91}}) sendmsg$kcm(r1, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) [ 1740.297602] binder: 31387:31399 transaction failed 29201/-71, size 0-0 line 2756 03:50:42 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:42 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000]}, 0x2c) 03:50:42 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="28000000000800002900000002000000000000000000000000000000a40a00000000000000000000"], 0x28}, 0x0) 03:50:42 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x2, 0x0, 0x20004080}, 0x0) 03:50:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x400000000000000, 0x0}) 03:50:43 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000280)=ANY=[@ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYRES16=0x0, @ANYRESHEX=r0, @ANYPTR=&(0x7f0000000080)=ANY=[@ANYPTR64, @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT=r0], @ANYRESOCT=r0], @ANYRES32=r0, @ANYRES16=0x0, @ANYRES64=r0, @ANYRESOCT, @ANYRESOCT=r0, @ANYRESDEC=r0, @ANYPTR, @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYPTR=&(0x7f0000000200)=ANY=[@ANYRESHEX, @ANYRESOCT=r0, @ANYBLOB="45616f01df42f1930f26de9d23097fe281a8c68685e7477cf1dd3984a932152566293710a61fbf9e813822cc242b", @ANYRESHEX=r0], @ANYRES16, @ANYRES32=0x0]]) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffff9c, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x5}, &(0x7f0000000140)=0x8) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40000a0}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x54, r4, 0x400, 0x70bd27, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000001}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffffffffffffffff}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syzkaller1\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x7}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7ff}]}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000180)={r1, 0x0, 0x4, 0x6c, 0x2, 0x9}, &(0x7f00000001c0)=0x14) prctl$PR_SET_SECUREBITS(0x1c, 0x23) ioctl$VT_RESIZEX(r2, 0x560a, &(0x7f00000004c0)={0x4, 0x2, 0x6, 0x81, 0x3, 0x2}) 03:50:43 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0xf0ffffffffffff, 0x0, 0x20004080}, 0x0) 03:50:43 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="2800000000000000290000000a000000000000010000000000000000a40a00000000000000000000921a"], 0x28}, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$KVM_SET_XSAVE(r1, 0x5000aea5, &(0x7f0000000240)={"50ea5f04a302f7ba4242d680e6acc895af8d456265627d2754c324eba3c32a376ef236c3a5dd635ded69bde037ca92c9076f4929dd9e0ac3ef35a7461d932b00240e3c04b29303964f264856dc718863c2c62901dcde6609f76ec18bacdbe45e357aa2c4331a8fdb6e522f23958bd27d6b4cfcdff30cdafd21fd4b0a63db506e3416595112b182aff6842a9779b931772e7e9f3e794dc982e4608713f5ac32d547cc1becdb5ff6ecf8635d10246de476d97ad3cebbc0b8b9bcf45fb2828e691e1501fb78bdef2e1e0acad07eb9aa3c203e39a8bf4edd55ad55e7501cae89a0bfe5a781f9c5ea7e214b25c3353df8d8cfe50c2f25cacf99877139720e375c0d1098b7e21cabfe32109eec1eb1e34792016076a38b5ebad4f8d1604bc8fe4ce97d240f514f7d094ce7babd4a42ae7e8d86859a47eef54210611248e1cb886628740a623d0509483dc0878d89dcf27ae63d066bd3143a2a24cff9028b49a2429ad7840e83de754d922e065b91bb821e15dcfceca360725ccd0fe6ce530caa18ea0312dad4c4de923f81d3dc107f525398c837706f720bde58799799091a6d7af1dcb042e4501f9d5baff4b25fc5de2fad18b0a1d8f54083cb21ff35eeba6107e7331a9657e688a02216d110a72455026d9c24a713523c434f8ae63ed36616cfc9950d973d7d1aa31dc30dd108841a0f25187e5d6e4e87953efa75405fb043ca0582d79ff3667054c001864c20fbf283208188852b2e853cf7d8df98f30f9cff278c51ed5a39a696ce03ec726bdab5a499e474d06d9b36f3a3f4cd52957c59ff4a608ad17adb9aea787162a1c592101bb3709291d098503c6c82c8dbce12e57b1f3628666f761732e46711cf8372f56bd84a64c971e941f374e7f12b46347ead5683cf32b0493ed6b9bb79a4ae8ad73de2f2725c03b263e8562eb77a222d137e54bcd6747522050f74a79fe0f0e68cf5deb4a2d944c12f85a7531db53e0ba1c38ee39252660b10d05e3a732f5883463385527f16764af2629d44131c1b0affa571a1b37ef92503bff3460e11d54c1f4746f813acd5b6cae326012494e4fe304de56de4994a4aae7d81375ed250831e2840defcab6daf26290d7df6e5ffa2895ca2358284fde91db45a01a2b016adb9d92065c5f9ada817fb4323eb3c8e1a6356647f8cf6ca3385b515ee199187d37532ce306dbaf744ab3471e9aad5affdee1d2b4b2874ad7b97834d0a6fe78db259777c80adcbf2ce31ec2ab6c75d9881bedee9fd5ab518eef28dda2ea43c6ef4b30b33db1e1721a58b4e37cc035a6f37f100b2ec54b0620dfaa1a9debb415714a7f9bb5a28a988af4c2ade6daa2a29932926cd62c326b8b90ec1b4aeaeaf71c02ab6a08bcf35b3d868dee04508c73b039b3037982d53db54dd31e47120239c6d5e976da91123f005035b388be0182b43c71024f6"}) r2 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x0, 0x0) ioctl$KDGKBMETA(r2, 0x4b62, &(0x7f00000000c0)) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000000140)={0x209, 0x80000000, 0x10000}) mount$overlay(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='overlay\x00', 0x1028080, &(0x7f0000000700)=ANY=[@ANYBLOB="696e6465023d6f6e2c696e640300000000000001626a5f747970213d756365726c6f2c00ad83a8a5d9f5e4ef6d803a70be807ef1ae229959eab75213417e22a9f531063e3d345f9cec4350afebb254441d8645f6147803d86bd0ffb739a6c5c6d07fba2c7afb79b0d0f28efb87bdc1f8e875c89f5b2cb312b0c5cfd3e61058da72ec9f8358ed8d"]) ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000840)) r3 = dup2(r1, r2) getsockopt$sock_timeval(r3, 0x1, 0x15, &(0x7f0000000680), &(0x7f00000006c0)=0x10) 03:50:43 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x2c) [ 1740.873183] binder: send failed reply for transaction 5555 to 31387:31399 [ 1740.911035] binder: undelivered TRANSACTION_COMPLETE [ 1740.931251] binder_release_work: 2 callbacks suppressed [ 1740.931258] binder: undelivered TRANSACTION_ERROR: 29201 [ 1740.969718] binder: undelivered TRANSACTION_ERROR: 29189 03:50:43 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0xfffff000, 0x0, 0x20004080}, 0x0) 03:50:43 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="28000000000000002900000002000000000000000000000000000000a40a00000000000000000000cf4afb0e5c7ffc60f3de59b2513c114792a5e92dde366d59fd23442238ce3cc0e71291ffddb910b003d2e6c9c71bb01c94a823db53b84e9ba48ad74f5398fbd604f7839b39080d2efac12eda78a4dd9ff001ed6a6f1dc6db9d7ef099b82ba0e03696729259473dadb40d47ddafb366518c0de85a4dd5af5bfee7ffcae74523018788b14ce248e997faa15b5887df250a3fe5ee9db359ee4413f36a765a573e01dfe6121bde4358f7a8a70d7deda6369220f3e5"], 0x28}, 0x0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f0000000180)={0x0, 0x8, 0xffffffffffff0000, 0x6, 0x3, 0xff, 0x9, 0xffffffffffffff01, {0x0, @in={{0x2, 0x4e22, @remote}}, 0x1, 0x0, 0x6, 0x101, 0x3f}}, &(0x7f0000000240)=0xb0) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000280)={r1, 0x8, 0x7, [0x1, 0xfff, 0x6, 0x4, 0x6, 0xfffffffffffffffb, 0x4]}, 0x16) [ 1740.988765] binder: 31445:31454 ioctl c018620b 0 returned -14 03:50:43 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1741.060483] binder: 31445:31459 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:43 executing program 0: r0 = syz_open_dev$vbi(&(0x7f00000000c0)='/dev/vbi#\x00', 0x2, 0x2) r1 = getpid() ioctl$TIOCSPGRP(r0, 0x5410, &(0x7f0000000100)=r1) getsockopt$netrom_NETROM_T2(r0, 0x103, 0x2, &(0x7f0000000280)=0xbb, &(0x7f00000002c0)=0x4) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) socketpair(0xa, 0x800, 0x20, &(0x7f0000000080)) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x2000, 0x0) ioctl$KVM_GET_DEVICE_ATTR(r0, 0x4018aee2, &(0x7f0000000180)={0x0, 0x0, 0xffffffff80000001, &(0x7f0000000140)}) ioctl$UDMABUF_CREATE_LIST(r2, 0x40087543, &(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000f80047d44740910a2cc9ba187bfc9f0844e3407773dd42061a83883caf20894a3444c6ee913c611b3fb1df152d5e17d92ac295f22c177d916338abfdca74f80708674a07c9b3fc31a59a73265bc9c31e9cfaaa55669823fb180cbdb37379df1a3b5193eed2b1f1d540b5a703b210f9aa8f"]) ioctl$KVM_ASSIGN_SET_INTX_MASK(r3, 0x4040aea4, &(0x7f0000000240)={0x7, 0xbe57, 0x517}) [ 1741.120914] binder: 31445:31459 BC_FREE_BUFFER u0000000000000000 no match [ 1741.164195] binder: 31445:31459 got reply transaction with bad transaction stack, transaction 5558 has target 31445:0 [ 1741.200127] binder: 31445:31459 transaction failed 29201/-71, size 0-0 line 2756 03:50:43 executing program 1: r0 = socket$kcm(0xa, 0x1082000005, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x3f00000000000000, 0x0}) 03:50:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:44 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x9effffff, 0x0, 0x20004080}, 0x0) 03:50:44 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x2c) 03:50:44 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:44 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="28000000000000002900000002000000000000002200000000a40a00000000000000dbb5e5b44ccb517d24118e8523d6b3c145cc9238940597083032869a10dd95675f08f17a9bb518ff7f5c669fda40e98537e89ba30a88680358cca632000000"], 0x28}, 0x0) [ 1741.788697] binder: send failed reply for transaction 5558 to 31445:31459 [ 1741.820284] binder: undelivered TRANSACTION_COMPLETE 03:50:44 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) r1 = request_key(&(0x7f0000000300)='keyring\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='/proc/self/net/pfkey\x00', 0xffffffffffffffff) keyctl$restrict_keyring(0x1d, r1, &(0x7f00000003c0)='dns_resolver\x00', &(0x7f0000000400)='loeth1selinuxsystem^lo\x00') ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB="8900000000000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000440)='/proc/self/net/pfkey\x00', 0x40000200004, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000280)={0x0, 0x80000, 0xffffffffffffff9c}) ioctl$DRM_IOCTL_GEM_OPEN(r2, 0xc010640b, &(0x7f00000002c0)={0x0, r3, 0x2}) write$FUSE_GETXATTR(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, 0x7, {0x8001}}, 0x18) fanotify_init(0x8, 0x101000) r4 = request_key(&(0x7f0000000100)='logon\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000180)='/dev/udmabuf\x00', 0xfffffffffffffffb) keyctl$restrict_keyring(0x1d, r4, &(0x7f00000001c0)='pkcs7_test\x00', &(0x7f0000000200)='/dev/udmabuf\x00') [ 1741.839951] binder: undelivered TRANSACTION_ERROR: 29201 [ 1741.869349] binder: undelivered TRANSACTION_ERROR: 29189 03:50:44 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) io_setup(0x2, &(0x7f0000000080)=0x0) io_pgetevents(r1, 0x2, 0x6, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x989680}, 0x0) 03:50:44 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0xf0ffff, 0x0, 0x20004080}, 0x0) [ 1741.922576] binder: 31495:31501 ioctl c018620b 0 returned -14 03:50:44 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1741.984482] binder: 31495:31505 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1741.991976] binder: 31495:31505 BC_FREE_BUFFER u0000000000000000 no match [ 1742.049244] binder: 31495:31505 got reply transaction with bad transaction stack, transaction 5561 has target 31495:0 03:50:44 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0xffffff9e, 0x0, 0x20004080}, 0x0) 03:50:44 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r1 = add_key(&(0x7f0000000040)='.dead\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$chown(0x4, r1, r2, r3) [ 1742.103831] binder: 31495:31505 transaction failed 29201/-71, size 0-0 line 2756 03:50:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0xa00, 0x0}) 03:50:45 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000]}, 0x2c) 03:50:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:45 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@rc={0x1f, {0xfffffffffffffff9, 0x9, 0x7, 0x6, 0x5, 0x6}, 0x13}, 0x80, 0x0, 0x0, &(0x7f0000000200)}, 0x0) 03:50:45 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x8, 0x0, 0x20004080}, 0x0) 03:50:45 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB="0000000001000000", @ANYRES32, @ANYBLOB="0d00000000000000000000000000000100100000"]) recvmmsg(0xffffffffffffff9c, &(0x7f00000017c0)=[{{&(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000140)=""/134, 0x86}, {&(0x7f0000000040)=""/21, 0x15}, {&(0x7f0000000200)=""/82, 0x52}, {&(0x7f0000000280)=""/146, 0x92}, {&(0x7f0000000340)=""/86, 0x56}], 0x5}, 0x1}, {{&(0x7f0000000440)=@xdp, 0x80, &(0x7f0000001740)=[{&(0x7f00000004c0)=""/3, 0x3}, {&(0x7f0000000500)=""/52, 0x34}, {&(0x7f0000000540)=""/32, 0x20}, {&(0x7f0000000580)=""/9, 0x9}, {&(0x7f00000005c0)=""/4096, 0x1000}, {&(0x7f00000015c0)=""/216, 0xd8}, {&(0x7f00000016c0)=""/77, 0x4d}], 0x7}, 0x7}], 0x2, 0x2120, &(0x7f0000001840)) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000018c0)='TIPCv2\x00') r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000001b80)='/dev/snapshot\x00', 0x80, 0x0) statx(r3, &(0x7f0000001bc0)='./file0\x00', 0x1800, 0xfff, &(0x7f0000001c00)) sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f0000001b40)={&(0x7f0000001880), 0xc, &(0x7f0000001b00)={&(0x7f0000001900)={0x1cc, r2, 0x10, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x3c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xffffffffffffff80}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0x70, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'eth', 0x3a, 'ip6gretap0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xf4a7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @multicast2}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x2, @empty, 0x1}}}}]}, @TIPC_NLA_LINK={0x54, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_SOCK={0x8, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_BEARER={0x10, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x406a}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}]}, @TIPC_NLA_MEDIA={0x8c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc663}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff7fffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}]}]}]}, 0x1cc}, 0x1, 0x0, 0x0, 0x8000}, 0x20008000) [ 1742.722172] binder: send failed reply for transaction 5561 to 31495:31505 [ 1742.755237] binder: undelivered TRANSACTION_COMPLETE [ 1742.774779] binder: undelivered TRANSACTION_ERROR: 29201 [ 1742.790684] binder: undelivered TRANSACTION_ERROR: 29189 03:50:45 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) getpeername(r0, &(0x7f00000000c0)=@hci={0x1f, 0x0}, &(0x7f0000000140)=0x80) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@hci={0x1f, r1, 0x3}, 0x80, 0x0, 0x0, &(0x7f0000000080)}, 0x0) [ 1742.825361] binder: 31542:31545 ioctl c018620b 0 returned -14 03:50:45 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000180)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:45 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0xf0ffffff00000000, 0x0, 0x20004080}, 0x0) 03:50:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:45 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000080)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) [ 1742.925597] binder: 31542:31554 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1742.953330] binder: 31542:31554 BC_FREE_BUFFER u0000000000000000 no match [ 1743.025076] binder: 31542:31554 got reply transaction with bad transaction stack, transaction 5564 has target 31542:0 03:50:45 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x400400, 0x0) ioctl$BLKPG(r0, 0x1269, &(0x7f0000000100)={0xc8c9, 0x2, 0xc5, &(0x7f0000000240)="c9e321c7608a1199658e0500fd1ba46a3a93c80b9fc441d7adce1a8cb7fb69ef7a2c7ad917d91ef0143b84411edb95b253e3df34f505b600824357fafc237c60d33aac0d30f78bfbb34a29191f7ae1fe096ffde3b6cc06dc2bc295434ad6e5ccc3a806000000ffbee3a8549d21f6f5366c64c330b88e49becffb719c08000000b42c2376f48ca3f927d9001dc863984114d2d169b45450177a99944a6cbed20794b59234e6c0f74fe3b59122336c8c278c2a5446dacd3e5c32000000000000000000000000"}) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) ioctl$UI_SET_SNDBIT(r1, 0x4004556a, 0x1) [ 1743.069192] binder: 31542:31554 transaction failed 29201/-71, size 0-0 line 2756 03:50:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x7a, 0x0}) 03:50:45 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x91320000, 0x0, 0x20004080}, 0x0) 03:50:45 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:45 executing program 0: setsockopt$inet_sctp6_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f0000001680)=0x7fffffff, 0x4) r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000052d15e7b4c41a81c906bb0683aafbdab755880c8541068f526522473a16f178cad8a942ad1b0ef5643abf6b04c07065713d6bec5bb3300a1c736bcff00000000000000cc1c559c94c3bc8b076c8042c0c0786761d561a9c5af188d818cbf"]) 03:50:45 executing program 1: r0 = dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x80000) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000080)=0x100000001, 0x8) r1 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x1, 0x400) write$P9_RXATTRWALK(r1, &(0x7f00000001c0)={0xf, 0x1f, 0x1, 0xc0000000000001}, 0xf) r2 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:45 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x2c) [ 1743.622042] binder: send failed reply for transaction 5564 to 31542:31554 [ 1743.652000] binder: undelivered TRANSACTION_COMPLETE 03:50:46 executing program 0: r0 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x3, 0x2) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r0, 0xc034564b, &(0x7f0000000140)={0x9, 0x38387557, 0x466c, 0x8, 0x1, @stepwise={{0x0, 0x8001}, {0x8, 0x7}, {0x5, 0xfff}}}) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x80000, 0x0) ioctl$VIDIOC_G_INPUT(r1, 0x80045626, &(0x7f00000000c0)) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) fstat(r0, &(0x7f0000000180)) ioctl$UDMABUF_CREATE_LIST(r2, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1743.687224] binder: undelivered TRANSACTION_ERROR: 29201 [ 1743.712671] binder: undelivered TRANSACTION_ERROR: 29189 03:50:46 executing program 1: r0 = socket$kcm(0xa, 0x7, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180), &(0x7f00000001c0)=0xc) write$binfmt_misc(r0, &(0x7f0000000240)={'syz1', "3f4ed83c57d3f57c52949fa5b1bc9ccdbf594f915bb3bf6608b99f509f99e219a7562e48857a30ff3d6e8d1000f7fd8f95208f93b369e1d25782498b619b1e2bdf64b940be10e2e5db99abd5654500a96a4b7e"}, 0x57) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1a, &(0x7f0000000080)=""/133, &(0x7f0000000140)=0x85) 03:50:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0xfffffff0, 0x0, 0x20004080}, 0x0) 03:50:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1743.748260] binder: 31590:31592 ioctl c018620b 0 returned -14 03:50:46 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x2c) 03:50:46 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x400100, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f00000000c0)='\x00') [ 1743.831325] binder: 31590:31604 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1743.855393] binder: 31590:31604 BC_FREE_BUFFER u0000000000000000 no match [ 1743.863240] binder: 31590:31604 got reply transaction with bad transaction stack, transaction 5567 has target 31590:0 [ 1743.916761] binder: 31590:31604 transaction failed 29201/-71, size 0-0 line 2756 03:50:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x6c00000000000000, 0x0}) 03:50:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x3291, 0x0, 0x20004080}, 0x0) 03:50:46 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:46 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x151000, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000140)) ioctl$KVM_GET_MP_STATE(r0, 0x8004ae98, &(0x7f00000000c0)) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x1, 0x2) 03:50:46 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040)='/dev/udmabuf\x00', 0x2) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{r1}]}) mincore(&(0x7f0000ffe000/0x2000)=nil, 0x2000, &(0x7f00000000c0)=""/109) 03:50:46 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}, 0x2c) [ 1744.545203] binder: send failed reply for transaction 5567 to 31590:31604 [ 1744.570863] binder: undelivered TRANSACTION_COMPLETE [ 1744.588966] binder: undelivered TRANSACTION_ERROR: 29201 [ 1744.608039] binder: undelivered TRANSACTION_ERROR: 29189 03:50:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:47 executing program 1: r0 = accept4(0xffffffffffffff9c, &(0x7f0000000080)=@hci, &(0x7f0000000100)=0x80, 0x80000) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0xc1000100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x60, r1, 0xc00, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x3c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xf5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9929}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9b9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3f}]}, @TIPC_NLA_NODE={0x10, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) r2 = socket$kcm(0xa, 0x1000000002, 0x0) sendmsg$kcm(r2, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x9132000000000000, 0x0, 0x20004080}, 0x0) [ 1744.649746] binder: 31640:31642 ioctl c018620b 0 returned -14 03:50:47 executing program 0: openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x1, 0x0) write$selinux_create(r0, &(0x7f0000000080)=@access={'system_u:object_r:chfn_exec_t:s0', 0x20, 'system_u:system_r:kernel_t:s0', 0x20, 0x100000000}, 0x54) [ 1744.693486] binder: 31640:31645 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x2000000, 0x0, 0x20004080}, 0x0) 03:50:47 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000]}, 0x2c) [ 1744.761249] binder: 31640:31645 BC_FREE_BUFFER u0000000000000000 no match [ 1744.799425] binder: 31640:31645 got reply transaction with bad transaction stack, transaction 5570 has target 31640:0 [ 1744.837617] binder: 31640:31645 transaction failed 29201/-71, size 0-0 line 2756 03:50:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x1000000000000000, 0x0}) 03:50:47 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="280000001bbfaa5b3039c70d475400000000290000000200584cf25500000000000000000000a40a00000000de89000000001ebd7ecf559fb787fa032e03ec4d4b4826684f15fc1b066a0dca67360887b7aaa490b83139422f27626303e88a46875a6977c5caff88274a5ef8b1ab31e42bd6c5c9b228bcc76d17752238e05319bf5841c3e2e227b3d04fb1cd1ebb8f78e25cab8d13f7647e70ef783c8ca38af9516b0647dbc056e0d58053bac6bc52cec271c6083d157e6a9071288bd830f93e1b5ee54ebaeff2d6a9ae50ae5a8b04d72749f91bdcb16777d34de012e48e971a51a19459ab500a3e0f0c53554e14350fbde2d66c60649c29354495379e181b8f88d817ad9f"], 0x28}, 0x0) 03:50:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:47 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000040)=ANY=[@ANYBLOB="006f01f332811fb9000001dbcc14", @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) [ 1744.938405] binder: send failed reply for transaction 5570 to 31640:31645 [ 1744.946312] binder: undelivered TRANSACTION_COMPLETE 03:50:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x100000000000000, 0x0, 0x20004080}, 0x0) 03:50:47 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x4, 0x40) 03:50:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:47 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="28000000000000002929070002000000000000000000000000000000a40abf3464d3f814328c0000"], 0x28}, 0x0) lsetxattr$security_selinux(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='security.selinux\x00', &(0x7f0000000280)='system_u:object_r:crontab_exec_t:s0\x00', 0x24, 0x1) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x0, 0x2) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, &(0x7f0000000140)={0x9, &(0x7f00000000c0)=[{}, {}, {}, {}, {0x0}, {}, {}, {}, {}]}) ioctl$DRM_IOCTL_GET_CTX(r1, 0xc0086423, &(0x7f0000000180)={r2, 0x2}) [ 1745.057155] binder: 31674:31675 ioctl c018620b 0 returned -14 [ 1745.117480] binder: 31674:31682 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x1000000000000000, 0x0, 0x20004080}, 0x0) [ 1745.185429] binder: 31674:31682 BC_FREE_BUFFER u0000000000000000 no match [ 1745.195192] binder: 31674:31682 got reply transaction with bad transaction stack, transaction 5573 has target 31674:0 03:50:47 executing program 1: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000001740)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000027c0)=0x1, 0x4) r1 = socket$kcm(0xa, 0x6, 0x0) sendmsg$kcm(r1, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000080)) 03:50:47 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}, 0x2c) [ 1745.275541] binder: 31674:31682 transaction failed 29201/-71, size 0-0 line 2756 03:50:47 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x6c000000, 0x0}) 03:50:48 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0xf000, 0x0, 0x20004080}, 0x0) 03:50:48 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x81, 0x80100) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000140)=ANY=[@ANYBLOB]) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x0, 0x0) setns(r1, 0x40000000) 03:50:48 executing program 1: r0 = socket$kcm(0xa, 0x7, 0x0) getresuid(&(0x7f0000000a00)=0x0, &(0x7f0000000900), &(0x7f0000000980)) r2 = syz_open_dev$media(&(0x7f00000007c0)='/dev/media#\x00', 0x7ff, 0xc897d) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffff9c, 0x84, 0x13, &(0x7f0000000800)={0x0, 0x8}, &(0x7f0000000840)=0x8) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000940)={r3, 0x3}, &(0x7f00000009c0)=0x8) syz_mount_image$xfs(&(0x7f0000000080)='xfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x9, &(0x7f00000006c0)=[{&(0x7f0000000100)="1efaa06eca4d1d9409e099b55d2285317194112d3262b2a2008d6971e2d167c8961c", 0x22, 0x6d22}, {&(0x7f0000000140)="566e5bb681cc5a61322b1808da690bcdee0ed75f21988aa68fe0b655b8e768fb47a9753e60462e89992fdc3034926c892d17c508a43dec252a9e1ed658fee264fa7ca3282eb3c8272ce2e3e2a2a9bb2a1eb3e8e93bd01ce1", 0x58, 0x8}, {&(0x7f0000000240)="9f18bd493a28bef628fd949b0f54f4e44f4bd80ec17056c9a58e62131f06c9da4e9855f48c0645b9615dcb76201fb0905adfc7441ca5e9cf994d74b62f3d7ebfa87bb10589f26a0735ebfd0d9cc0a853dc3f84486bb109b3f0365fd3", 0x5c, 0xfffffffffffffffc}, {&(0x7f00000002c0)="348e4649a45e92832aa67fef2ab80ff9f5ca3efb85c0c18caac4fae919a042ac0372135fc70c10007630946a040ff0a4ed000df489deefc59a640bd9605b0ef36c2015b4fc6c9c3262554c5bdbab10351808508ecc283b692e8645fa7df67ae608595fb3e88bde9aa6488e90164bf6040043386d7783b50c8e97ab66b96940fc549fbe8f8eb9844a6fe0970eeeb84fcbb75e3e71abfe9842477eccdfffbf56510004ca59f4f8042826fe74055afee23d1477c723de", 0xb5, 0x6}, {&(0x7f0000000380)="8919de002fa882148240bd1a1ddda8106275c1b022375883da5061d5c082c2c823f3e30816083913250c319c883ee1f6b38749a9b1e07357f92ece022a711713eba2000f15ab7330ba3a73d2a5bfb70ab098bd33b75a8719e1ffbf06d88ac796aa287fe97df87e6db2bd21a96ab2e57b96ef2548cabf5fd8f48593d48cc2a2c524e5449927e9469ec3a592dc1ca328891512a713f42e690acebacc43282b34a77223f5a88fe8b74b86a6a9429baa886f1af21898e0a8c82a010620e77b3ffdebb39c7d689912716ad02926b59af7088e382131d618b72f25e4e55b82b6f53bef645c14054c83b89fa3d616a11db18a99ce0d97", 0xf3, 0x1}, {&(0x7f0000000480)="af5ae00e666f4d0373219e5aa550bd0e4296b657ec6320a0dee6a46d95a83e215e93731cbf0d0bdf18eadfd60080afbc3444786a3dece7d7dbcc43e6241a69ae59c04b939a800e70d083d16fd69b548dcade571e55675ec4b0c27f6c7419be1c4e93d96f9a06a3058d4939fd14e877ad75e026891b2176716d9c8f66c817ba267450e7e9718df747f4af3a35c794c4f292309534157f05a82daf4b319c36d423787803b5dc1369b4c7dca13a770d69603df6eaa71b5f5f821dea72cee43c0c483253079693a10f5d9f1c0bf4088f36110696180fa9", 0xd5}, {&(0x7f0000000580)="06fb48bfefc01aa6d169e947159ef62d6b2c918117bdd70351179a74922c0d9c1284c7df3f452862ab078f48f49f0fd24d77fcc77055a26e9e7dbb44077465d6c81dd3731bd02d62bea6cc619c328563fd2361c26bce730a2aaec55aaad0481d47ab7e48ff7cc344493dac3d28dcd10d3f19136ed680bebf99f57ef1aee5fa9993b401ba0f8f5e3112df803cc4df6a0280f6597c376b708180fc7b64b6b0819280ee39d88235", 0xa6, 0x3}, {&(0x7f0000000640)="83a4c979ed23ecc2fd8fc8df251540f1a68fad8cc0c393f5bda1ac48012205b8435abf61567148f51e38bbc08dac26e87f372854580d28671681b13ec587df6c9be3f03b96fa2df29d06ec11299035a569dc6acdfd15c9e59359bbd5cde73e3d6853af44caa0db9c0c64432fe67c915a09cc603739e65ec440e8", 0x7a, 0x4}, {&(0x7f00000001c0)="15c5e8992a7122dbefb0d2c5faa8e1d448d8fc4e7e1caeeb959f59521938aca086", 0x21}], 0x800000, &(0x7f0000000a40)=ANY=[@ANYBLOB="67727071756f74612c6d61736b3d5e4d41595f455845432c666f776e65723c9b446dfc44446ea09a2455aee7036c0a47587b90eff902f4e25dc529728351e22399c4ecc95067325f85b3c7fb3ea154f5", @ANYRESDEC=r1, @ANYBLOB=',\x00']) iopl(0x81) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="28000000000000002900000002000000000000000000000007000000a40a00000000000000000000"], 0x28}, 0x0) semget$private(0x0, 0x4, 0x49f) 03:50:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:48 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000]}, 0x2c) [ 1745.804867] binder: send failed reply for transaction 5573 to 31674:31682 [ 1745.818304] binder: undelivered TRANSACTION_COMPLETE 03:50:48 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x9132, 0x0, 0x20004080}, 0x0) 03:50:48 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:48 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\b\x00\x00', @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) [ 1745.888183] XFS (loop1): unknown mount option [mask=^MAY_EXEC]. [ 1745.909712] binder: 31733:31740 ioctl c018620b 0 returned -14 [ 1745.967440] binder: 31733:31745 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1745.984734] binder: 31733:31745 BC_FREE_BUFFER u0000000000000000 no match [ 1745.991733] binder: 31733:31745 got reply transaction with bad transaction stack, transaction 5576 has target 31733:0 03:50:48 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x3f000000, 0x0, 0x20004080}, 0x0) 03:50:48 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]}, 0x2c) 03:50:48 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f00000000c0)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0xffffff81, &(0x7f0000000200)=ANY=[], 0x28}, 0x0) [ 1746.117154] binder: 31733:31745 transaction failed 29201/-71, size 0-0 line 2756 03:50:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x6800, 0x0}) 03:50:49 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000040)=ANY=[@ANYBLOB="0000000001000000", @ANYRES32, @ANYBLOB="00000000000000000000000000f600000100000000765c8adb71"]) r1 = syz_open_dev$midi(&(0x7f0000000200)='/dev/midi#\x00', 0x8000, 0x2000) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, r2, 0x400, 0x70bd25, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x40001}, 0x80) 03:50:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:49 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x800000000000000, 0x0, 0x20004080}, 0x0) 03:50:49 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x4000, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffff9c, 0x84, 0x1d, &(0x7f0000000100)={0x3, [0x0, 0x0, 0x0]}, &(0x7f0000000140)=0x10) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000180)={r2, 0x7, 0x2, [0x8, 0x7]}, 0xc) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:49 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x2c) [ 1746.711328] binder: send failed reply for transaction 5576 to 31733:31745 [ 1746.743517] binder: undelivered TRANSACTION_COMPLETE [ 1746.760620] binder_release_work: 4 callbacks suppressed [ 1746.760627] binder: undelivered TRANSACTION_ERROR: 29201 03:50:49 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x10000000, 0x0, 0x20004080}, 0x0) 03:50:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:49 executing program 1: geteuid() r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x2, 0x400000) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0xd000) [ 1746.815268] binder: undelivered TRANSACTION_ERROR: 29189 [ 1746.816945] binder: 31785:31789 ioctl c018620b 0 returned -14 03:50:49 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000040)=""/120) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000180)=ANY=[@ANYBLOB="0000000001000000", @ANYRES32, @ANYBLOB="00000000000000000000000000000001000400000313638b1ca7967e02125565c0f5a75587e53e38de80fe2f596f921b92fc5d82d8699e83236ef5f1d5c6fa9ca09ff1c64026d4d442d8d39eed47956d44e2d3d23fa31f664347830080ffffffffffff5cf758748c668c8ed167b33f94f11ea7080886a42d5d3843ffe494c8c250be9c1e10d9c3297ef4cab92e33b82d7817520cbdeea90a60765635d1874109cd9ebfb51dddcc979e69281d3339514d097f0356e33ff84514b6afc76c99ab8fbf7cb6138a2f5c7c258d8128f0d62320ff47c2c24d96aa541e4461036e1ae099d2d0138feea49bee55c1fc5f71"]) [ 1746.891983] binder: 31785:31796 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:49 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0xffffff7f, 0x0, 0x20004080}, 0x0) [ 1746.962764] binder: 31785:31796 BC_FREE_BUFFER u0000000000000000 no match [ 1747.001093] binder: 31785:31796 got reply transaction with bad transaction stack, transaction 5579 has target 31785:0 03:50:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1747.064796] binder: 31785:31796 transaction failed 29201/-71, size 0-0 line 2756 03:50:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x300000000000000, 0x0}) 03:50:49 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x8000000, 0x0, 0x20004080}, 0x0) 03:50:49 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000]}, 0x2c) 03:50:49 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) dup(r0) 03:50:49 executing program 1: r0 = socket$kcm(0xa, 0x6, 0x0) readv(r0, &(0x7f0000000800)=[{&(0x7f00000000c0)=""/145, 0x91}, {&(0x7f0000000180)=""/70, 0x46}], 0x2) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000880)='/dev/audio#\x00', 0xf6, 0x10000) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000240)={0x200, {{0x2, 0x4e21, @rand_addr=0x2e7}}, 0x0, 0xa, [{{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xf}}}, {{0x2, 0x4e20, @multicast1}}, {{0x2, 0x4e24, @multicast2}}, {{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x17}}}, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {{0x2, 0x4e20, @local}}, {{0x2, 0x4e24, @empty}}, {{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {{0x2, 0x4e24, @local}}, {{0x2, 0x4e22, @local}}]}, 0x590) ioctl$SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000840)) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000008c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x1000}}, 0x20) recvfrom$llc(r1, &(0x7f0000000940)=""/168, 0xa8, 0x10000, &(0x7f0000000a00)={0x1a, 0x2, 0x6, 0xa9, 0x8, 0x4, @random="e865aff60b88"}, 0x10) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000900)={0xa, 0xffffffffffffff31, 0xfa00, {r2}}, 0xc) 03:50:49 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1747.611198] binder: send failed reply for transaction 5579 to 31785:31796 [ 1747.636597] binder: undelivered TRANSACTION_COMPLETE 03:50:50 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x3f00000000000000, 0x0, 0x20004080}, 0x0) [ 1747.669233] binder: undelivered TRANSACTION_ERROR: 29201 [ 1747.693433] binder: undelivered TRANSACTION_ERROR: 29189 [ 1747.710664] binder: 31827:31836 ioctl c018620b 0 returned -14 03:50:50 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x1000, 0xa0400) getsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f00000000c0)={@mcast1, 0x0}, &(0x7f0000000100)=0xffffffffffffff49) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000140)={@mcast1, @ipv4={[], [], @empty}, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}, 0xff, 0x60f, 0x1f, 0x100, 0x0, 0x80000, r1}) r2 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:50 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) lsetxattr$trusted_overlay_nlink(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='trusted.overlay.nlink\x00', &(0x7f0000000280)={'L+', 0x3}, 0x28, 0x3) r1 = syz_open_dev$mouse(&(0x7f00000002c0)='/dev/input/mouse#\x00', 0xdb, 0x80) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f0000000300)=""/251) setxattr$trusted_overlay_upper(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.upper\x00', &(0x7f0000000100)={0x0, 0xfb, 0xec, 0x1, 0x8, "c805fd0f61b8c86a173db0e2f941311a", "9416449a14584cc46805403b0879b91277a87dbdee10a1058d149deb1731c55ded1d7a93173f5a7d7b5d3e96039056b174fc9f26d533268832a46b240c248bf6eb880dc7e563d2c77b1225b0e4341d1b7b95a7b10276bdc00dcc6102dbe515a0de102281ee0cfb71da54b8280bf16ba8c29ca189dd8799e43f78f5bc7fc60a653cc7d2fa8389b9549afa0785a6a87665d14976f4112aee93a94cb53e2fa0efc2636c1064141c924f4026d3245979927c87b9981414b2a4ec1faa305bec7e46564cfb693e59203241470d8d3fd14e26e70d752d22e2d7b6"}, 0xec, 0x0) [ 1747.768552] binder: 31827:31838 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1747.803026] binder: 31827:31838 BC_FREE_BUFFER u0000000000000000 no match 03:50:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:50 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x3f00, 0x0, 0x20004080}, 0x0) [ 1747.840906] binder: 31827:31838 got reply transaction with bad transaction stack, transaction 5582 has target 31827:0 [ 1747.862924] binder: 31827:31838 transaction failed 29201/-71, size 0-0 line 2756 03:50:50 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) mount(0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)='posix_acl_accesswlan0keyring/nodev#*md5sumcgroup\x00') r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x2000203a, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000540)=""/246) ioctl$EVIOCGREP(r1, 0x40047459, &(0x7f0000001640)=""/174) write$P9_RXATTRCREATE(r1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) pread64(r1, 0x0, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0000002900b0f6d3ee0000000000000000000000000004a40a000000000000000000001300000000e9cfa130a52b3b8dcba0b2a8a3f85a2855b2347941ce82eaf322a6116f66b02e68cf9bc0e3d9a237de54b664438804bd2e59ae2b26a4376e2f8ac2d4ad2722593e2980082bb73d06cc4e1be9b161857472cba91a4d238991e8f1eb1a8cb2f7cb03562b030729c247ef8630e0e5"], 0x28}, 0x0) sendmsg$alg(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000640)="a7d8bbb273d39254ec7d92b77cf8705e74806488cc6006e8b7ada70d9739f86a64464fe58f21cded700ecd36988ed2a2a27ad247b215875c617b8291cf36ee0916b80fba19b421bbaa51821d6847c9d48043ff0c147682bc3404bd5fbaa44462c3b0f04605f74d7f0954bacee24311940a0be883865f9c5bcdd22e88563b6d6c280b4c2ec8e3d1b292377482c34fbec1a2b3e20e8825bc4061baf604e46bd92bc68e98951f6d0c39c9af0f4953f740f41e21446e1cd2da5a9058d6e43a3d1696e6a7d5490dd75c6be356ca2423a8204a3419ffe32470e51b44dc88a70b6d941d1645656df027ed7755bb01166b4a2f722884440abafaf09d33658bccbd211a5d48338cc0dd9b07e49075d5d1a5c37dd5e86234a15e19191d0f8082f494a214d03709ab11858689f2b68ff50da3705b520b15f563190105dbaa861d1c4acc50bb7dd0574d8a4f8564a6c7c16f3ea4ab04cf04a08bda08ad5c2eda41fa715b2361d07af6d04b8305ce0017cc1d5700e8cb9676c31163fb7abd827e9aab516ea4783c7752edb44b22cc2f5422e6bb3d79848e94c0604bcca18e57fb851e903804314551722d647b931cb28fc55a5e18e90b627422d63477149add6a7451332298719a4a5dd139bd8582fe89b3fe3aec7290d8b42abf3d2f7e6edb4a06f88cf244e02d10bc36c278274a5fcde05ad5641c4144399ea4967130192e93c2cd658734e1d4adf8b6af6efdbc76e0b574aedef89cf1b9695869f7e92b6e225dc6bcc04f30ccb3668acc612043e0577008257488b4f4b4c36f5cfe0ab5185ac6643d2d3330a00b47cf084b94bce533b2b1183f19dba7f856cb174ae93b58fdafd969750b53dc8ab6145f6c5c9adac192bef2e1ba97e23402c330516cbd7ba72564574f6b4c12e55b533331e9eacb50b5323a231146f30ebf04033ca78348b2e5f21da947903c9d4eda156d884bdfda18ed665a0c8475455d86a3e637c82070ef80ffa27aadbc53ba28cd81f71eee9738569544b7a37c82cde331d51952542d120939a7589a9c25e2f3a30fe210a54fcdca484bb4e694101e445b7eb8880555d1c4c6af8fe2d0dccebe11a3aaf9c93edd15c4a57c5202181b158989c98e154cc4efb1c575df44c6037730c663cc813846816fdd0a844acb978bfbb27d641f68fe7b76b9929ffa5a21b397497560711a7132ae6da05bb4e41602caf8e9c72271ff70d2339d610e33b934671e2f79b02ecf559ce74af4b5112b142d798a6c1b5cb6266007b2f1a18e46884aba43224c71b5c8d4b2a1766208497554380d9471e96cffff8adf8e164b5c495489a04e4b0a212496c8ad1694dd2929e2c3c9b72621d4894989bbdcff6b15a90aa8b537e0ed8e4680e76e112380651e24483f799c884389c539bdf31acf6f822e53a248a77714cd47b32be62e5c852ec0449d390c2b6e5e024c7cfa38063d83bfef9b6b18caaf30ddb0bbf156f2b30236253d87633d9010385c17169c5fea54d20e0bc817c84afedc24554d946f8540a7af353e178731d374b4be389406015a0322fddc3100c3d4e092fbd6d898feb724c762a4f333e7d6bae34e7408ac9bc570c8b55fa8d8e5ae4ecbcf8e1b788c222c50499d9b0ef48c15eb1716a81c9bf8764dbc6ac38b65db9be9bca6a665fda38654705c7c13d5f2f507e24282aad852c0e9f5f3c7239b853f186686876d1773943dc4f94bfbe38b99a21c8aa14af189963f5da479b8dfc76a03219d10012f45fa766630de0551e696eb3481f77ed398500d330bca52bb7dadd67fb102dad473bfd5d7eafa8c6931778e4368847d379b9b49907d132418d4b80ed1f140968de169f7b8bbdc084aaed2575d7745101a80842e432c1f9b932555f00093986a431b29eb6160f529d284a635bef1727662285089bfdb8ee451791e299a5249b34a5dd9bcaa023102c489837074cbb3a6570f5bcfc12ce2d049ac7c3635518d24c2254e3956caac6dc89773c3aa14541eefbce98f1dcad5e28f6469207061e240a796abf3b1dbd3c107db942d88b601c71995ecfcb4e176ee4684609562972698aca34baab11864c6936db8dc7a74b940a17e92c3b675271b508072e396d19bcd5f1e0320ab79002fdf40cf1cf5c22b578a79003e99b3a194ce26993862968941f428d15ea1a4f43652ba088c6496fc5f2428fc5f2323f41cb100fa25a5d745aea6195e6400b69ee8ae625e74ead15d553f988a1f2f98a96a4ecb96416981f7aa2f3ec9c3a7e0b56225595e12e41a6308ed716fcc3408d809f71937d21ced4ef8a5236dedc2cb06fc4354c69b24d35987360a4c7428c3cde132a23a3e62cabd66a98e359857246972e18209944cd2b1777894345a016d92f76ca4bcc8103e83da5f976b1ece355206b5041828590467e39aabb8a9d0e2dc9695e76e8f04604fff7f3e5d4fa0a8155ec40067ae0a6b44c15d1c6b000a59f04a74e239876a95ed4663cdcfdb6052831ca7656b89fa3eee37c6d56bbf8b6e04650a7a298cc39b2829fa10ce709b15c77786c32e7b7ae4406193b511c75168c890bb91d36e12eb0313d2b865c0586f1ed8a74aa216af462236383c58bc097a6f7eb019657f12fbd38d9b3a0ff0500d9efa50e4b6cac26000cb437f4cfccf713370e0d22fddc3e6f5377bac4647b62f95423b6ea87a3aa06b8693406cfd6ad6f01ed1fb62988d6469e768a002052f05cb188f05fa97b6a7dbd8e72dbc79c477c0fd9736720927e43cf493a28095bbf797657b12d97bba83b5e603af202bf95d19a480d42db37ba2b8b241736863ac01e5a1201957e25ab807a70fda0d1e7b82795f0a41369c00979006e7ac56c1cbb6c6b8e2e7a5e49bbfb3dd024c5deca6363513811185dbeadc7f95ce72c91c9b5e300b419fa8b143c56341bfe70d835212040dfbe6599113a07cec04de5fc2dfb62f5cfe736d4de3cc2ca592657c1c36808a6e581a2e39e84b1481543b5d033509a94ebe80365b423e535d069c78a8a4f1a16c21e91c18604ca1f4f314ddeea1c3a8852be85e9473c045195f770b6a6aab4c464235944d52804f129ff2a56db408bf9e802f6f4c69ebbaa880f3bf319dd96f1ae325476318ae510b17b0f1645a79dae556f54856248bec2a65036eb59e93018e7eb3e4f569097b5a09709ce3f7ff595df8476f5186d42aeebd8ee7902779e218435a58b9ad181eb03545736543e5f45ae113d5826eb10f089a1b07582f5dad325c9eb0b6231f9912746e6b2c21f93cea179939dfe052c01940871b99ff77f5c6f3af2ead1293c4e37f1c36ae2b6770c90d629564fc5762da0970de691cd000a43e37fbd8e2d0128f726141dc6fb99d32d4c4a32878d683da56c0fae9723a6fb4c9e80cfaf66a684d6ed40c13be6b6928304f6597fda1ae34a905dc2f5769546416fe57707f77d418d2c53864da8883f391e54b449474b7884ff7aeaee723876fb7e6ae82473d7855e28fe3103f3cd3c0fe9aef09c31979948a63adc0d58eeabab785d30c3d19c268d6ac4b25e434d63cfd262d1f96d48f0e9b756e07bae81e2a585ae0fdb5efbc938fbf931795f292721e3df10e6189f005ddf1be38dc03e28c91541dfd67aba5a3ab1bb0c24fc6c3294536196b39d8059cc1959a65893b9dbdbf454db4819804018da9eac79be51815e04b928965193ad4be8c3bb230a5c67b0a44ff95fb8c5d4a866032a920e288e38ce41b979796ae15dbcf4ee712a4cd1e435aa08e05f76c514c20dd9647a345b053729a4fbf5aab27357b575e25c278640f89e07938798eb31209c8bce586c552d8844b3a3dab1c667d4ee26ee564f7db0ec01e3490a8f50cc3acfbe3b7907245efee41f0c09a9a7ef15b378802e1a9f4aa1bb35055650d6ca968514e847e1315a3151947cc833222dfe217b5d0317b18719274809fe6e62e0140e2221079869f5ac8a74ae96f983c864ff031f0050d759865a00abcb29408b6cf5519b2b6e83881daab418854d50ba61ad14f56515541dc292c8374b4330e0d5e799165e29896042f96d389ac87c28f753912417efe5b6f38053fa184c9701931f27e972500a88fe0c66e460b95f8658db86107cd15e5813c9a3eb631a9238447fb6fe14f8fe5b77c3980e1c510add868b9dd0e3c693960821face2843d2a446c2983c6968b86c7a4edddd09b549823f173e48ce52b0489d35c2e0b4f3b8fc8be2a51288296cb9fb1e9960a13834cccbe956e1d27453b2efbe8385a28e80853fe6ef6f36b09d94410b2b0f2049ab7728597a8b8d8e22a14fa8699bea09b04e81847f13e53240cfdbdd608f4566e3526afeeca4597e83e86084aee8761c57bcc6a5f2f6dc4c60b0f886f642436461f6b648f2ba79c71a0be54e6e95a4bbcacb8f13fb6832c8d53680a48c25704c3ce847b653379830df1f1e52c4cc346401681228ccf05d3f11d99614766c8928aa762d86acf827ab191fdacde2e1aecae411416500828caf65a1c9ba8d417bbcd6bb81eac85ab7f0d4e2a0431bb19e5c79e56c33055c226524984f20b85c51d58fbb7801e5a288c1196cac63ae9692ee5daf8559b93c715c8b7e8a56af4c5b965165e16a63df5f5a0d9253f40ee8d7764d06ca954dd1163d898adc84ba792054f1e84ab5c94b86bd019632489eb2a80b7adc13a417c2f7e2abaaf6035c445db061952ca862c56362f33cd1bf166b1e96231e22292a65ab7ddd82cc8f90a8921e0b7d604f2611016b97127c2d9c5ca31a3f088bdb313aabab214b6d89cb26c8d6d9c8ecfa710e7fe45ffe5dc8ae8a83d33c40f669d75ac002367b9982f15bc5b82c66672537dd5124989823a6c04185d9a4076b8f11d866bb3336ba9ed6782f0f8545be565a7597d0cd384481e1d894bc9dbc931af11674415127dc1d8ba67a0a8571390d671d3c182c1828932ad098f8e712da9feb6802835a176913581f5ff274a68b0b6a361ddfa4af483e321256edde95d5a86888d84db58565ec021b49e243d382686621a7b9d381acc742e2bd030948aad2e222a43f297bd51015a867e18da9e341fce625a82b38e0c8e4014806acfd87d1baeafec01cee4b6b1fc7a35362ff07791b0cda0f30bd414005433722933b645fae5cc1af0fd82da73cbc964e915751f656beb8de5c60f3d725b53089156b4d6c0e6640c0b42bdbce57e3f17735a74fd31e30c953fa9700487b67782d64f31c5a1c1429c1e5811f29f903a5f7c06a506e499baf70b7188519248b23e9cb0469b9be9d4e7d174ddcd0a76214d1a4d562e642995753507f7a90e9b00a7b72979a05fdb45c4de1b22c9f0fa409336f04a9878813132b9334d55bf4f6ea3403b60b9b8de6e583716e69c57fbdcf3d995070adf31079ad3055d8719d9077b3c7a01687b49896cc4212b26523a4b83cce714a90856af3cd9bc5ef83a6b896b59102f3ac8e6e32b126b59f90054fa7997c9e57fbb11a44fc6270e25a53f73df05a2d84455a214a538a0d31fbc935a8390aede12d9b2519c3353210cc59d4c8011aa50b79c95e9164894274401b7365a22e4203a03161c933fd85eae229668a248557d07a48c9be96d6b72690e11d75739ad532426b2d8fb0d451beab769c1dd4f04c358198e536c0cc14a2404ffd520da2b80eeac82e719e6b65167b5b3b4541229b4f4a41129b9dcee9f26bfcaf7836e1d9bcd1e35ed8e4e61568fcd0957dad3ada83bb5feece46525dd3bbc413f66f89c21c561125c7a2bbc5f05bae146a6cfa3c7b71b47751dac50c73642817aafd3500bd7da4e0a0c2e46ab5dd35bc9daf5fa911360887fe5dd504d94792f6bb0", 0x1000}, {&(0x7f0000000300)="e6dd2ac3de7607ee3d1a26c2d763f5246b0748967fa81d86ce4759dd971c3ec85ea7701db1de536d484de7648a171b5c0d3504f64334f1a423664b1b645bb0de6f86fef06bcad6a0b5851538a129fa623ce9b2031e62248f10aa9ccc9ed139cd0eb7722c8ff5418072bd4183018beff24e09f3ccc8f990208eb681cdabf2c52429c3051b39331bffbc7f570867768f0141d4108ef35ca37336e6f4ca27ae8627e5d8b1a668624df326dc364cced39fe23d8f60d10ce76053f51f0769d4e178b38d", 0xc1}, {&(0x7f0000000400)="f756ee766f836f80dc173e38bcaf35f92def0989697cdb2e61f425d22ce1b1bcab24a3fad5d2432931d94cf06bb22013e82750109c5813ee00ca3f920a9491ba38192aa50ce3e7d3acec167b7ac54b82fbf55da44638f61a9c6d6bff049d0ee3698505a59fa84ed51a121ea743a731dce2d30a79bf82996b30722cc46463e540d00093e9df8ef0b775758beaa755692a03d723d0a10a7f8fcf6a0e7a1d4d8d02ca467049344f1e7cd141a97e22b0cc176430c8613c0618c414af6a02cb005b90001c1a9ce62b0201de55437dc0beac1b64cd5a5f0074b6b22a4b97c90458f1a3cdccba5296cd4e97137c2b8dcb71749b14d4d4b70138", 0xf6}], 0x3, &(0x7f00000000c0)=[@assoc={0x18, 0x117, 0x4, 0x9}, @assoc={0x18}], 0x30, 0x10}, 0x8004) 03:50:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x7a000000, 0x0}) 03:50:50 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:50 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x5, 0x40100) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000000080)=0x4) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) write$P9_RLOPEN(r0, &(0x7f00000000c0)={0x18, 0xd, 0x2, {{0x58, 0x2, 0x1}, 0x5}}, 0x18) 03:50:50 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0xfffffffffffff000, 0x0, 0x20004080}, 0x0) 03:50:50 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}, 0x2c) 03:50:50 executing program 1: r0 = socket$kcm(0xa, 0x7, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@ipx={0x4, 0x4, 0xfffffffffffffc00, "c6974f751a0e", 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x800029, 0x2, "000000000000000000000000a40a000000"}], 0x6}, 0x0) syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x0, 0x40400) [ 1748.507948] binder: send failed reply for transaction 5582 to 31827:31838 [ 1748.543492] binder: undelivered TRANSACTION_COMPLETE [ 1748.566913] binder: undelivered TRANSACTION_ERROR: 29201 [ 1748.572426] binder: undelivered TRANSACTION_ERROR: 29189 03:50:51 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0xffffff7f00000000, 0x0, 0x20004080}, 0x0) 03:50:51 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000480)='/dev/udmabuf\x00', 0x2) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x400, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x600, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x80) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1748.615845] binder: 31877:31884 ioctl c018620b 0 returned -14 03:50:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1748.707056] binder: 31877:31890 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1748.724761] binder: 31877:31890 BC_FREE_BUFFER u0000000000000000 no match 03:50:51 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="28000000000000002900000002000000080000000000000000000000a40a00000000000000000000"], 0x28}, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$KVM_GET_REGS(r1, 0x8090ae81, &(0x7f00000000c0)) [ 1748.756178] binder: 31877:31890 got reply transaction with bad transaction stack, transaction 5585 has target 31877:0 03:50:51 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x9effffff00000000, 0x0, 0x20004080}, 0x0) [ 1748.801100] binder: 31877:31890 transaction failed 29201/-71, size 0-0 line 2756 03:50:51 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x103100, 0x0) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{r1, 0x0, 0x0, 0x1000000}]}) 03:50:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x2000000, 0x0}) 03:50:51 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x0, 0x8080) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000240)={@multicast2, @multicast2, 0x0}, &(0x7f0000000280)=0xc) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={&(0x7f00000001c0), 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=@gettclass={0x24, 0x2a, 0x8, 0x70bd28, 0x25dfdbfd, {0x0, r3, {0xf, 0xfff3}, {0x8}, {0xd, 0x3}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40001000}, 0xc, &(0x7f0000000140)={&(0x7f0000000580)={0x1d4, r2, 0x800, 0x70bd2a, 0xff, {}, [@TIPC_NLA_MON={0x34, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7fff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3f}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffffffffffffd}]}, @TIPC_NLA_SOCK={0x14, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8000}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}]}, @TIPC_NLA_NET={0x2c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfffffffffffffffb}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x100000000}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x880}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xc30}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4fa9c7e8}]}, @TIPC_NLA_MEDIA={0x2c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_NET={0x18, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8001}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}]}, @TIPC_NLA_LINK={0x18, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NET={0x68, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x400}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xb963}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x80000001}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xffffffffffffffe0}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xdf95}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5e6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xe4}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}]}, @TIPC_NLA_NET={0x64, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x81}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xff}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x100}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xfffffffffffffff9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x400}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8dc}]}]}, 0x1d4}, 0x1, 0x0, 0x0, 0x1}, 0x20000010) getsockopt$inet6_int(r1, 0x29, 0x50, &(0x7f0000000380), &(0x7f00000003c0)=0x4) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="280000000000000029000000931790494d6cb08d6ce8df00"], 0x28}, 0x0) 03:50:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:51 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}, 0x2c) 03:50:51 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x200000000000000, 0x0, 0x20004080}, 0x0) 03:50:51 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB="ccd3b2812a9e3b8f", @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) [ 1749.411231] binder: send failed reply for transaction 5585 to 31877:31890 [ 1749.428336] binder: undelivered TRANSACTION_COMPLETE [ 1749.458169] binder: undelivered TRANSACTION_ERROR: 29201 [ 1749.463674] binder: undelivered TRANSACTION_ERROR: 29189 03:50:51 executing program 0: r0 = socket(0x40000000000010, 0x80003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write(r0, &(0x7f0000c05000)="240000001a0025f0046bbc04fef7001c020b49ff00000000801c08000800030001000000", 0x24) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r2, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:51 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x2, 0x20004080}, 0x0) [ 1749.542405] binder: 31930:31932 ioctl c018620b 0 returned -14 03:50:51 executing program 1: r0 = socket$kcm(0xa, 0x4, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) [ 1749.631661] binder: 31930:31936 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1749.694620] binder: 31930:31936 BC_FREE_BUFFER u0000000000000000 no match [ 1749.722318] binder: 31930:31936 got reply transaction with bad transaction stack, transaction 5588 has target 31930:0 03:50:52 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x9132000000000000, 0x20004080}, 0x0) [ 1749.744836] binder: 31930:31936 transaction failed 29201/-71, size 0-0 line 2756 03:50:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x4c00, 0x0}) 03:50:52 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x2c) 03:50:52 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:52 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x2000000, 0x20004080}, 0x0) 03:50:52 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="28000000000000002900000002000000ddffffffffffffff00000000a40a00000000000000000000"], 0x10}, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x2, 0x0) ioctl$BLKROGET(r1, 0x125e, &(0x7f00000000c0)) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000100)={0x0, r0, 0x8, 0x4, 0x7, 0x9}) [ 1750.338814] binder: send failed reply for transaction 5588 to 31930:31936 [ 1750.370855] binder: undelivered TRANSACTION_COMPLETE 03:50:52 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={&(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x21}}, 0x1, 0x4, 0x1, 0x4}}, 0x80, 0x0, 0xff77, &(0x7f0000000200), 0x28}, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/enforce\x00', 0x80, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r1, 0x800448d3, &(0x7f00000000c0)={{0x4, 0x2, 0x3, 0x81, 0x100000000, 0x6}, 0x2, 0xd1d2, 0xfffffffffffffff7, 0x3, 0x2, "c8ba7167c58c039e8eb331d321dd9133481e449aba9e6a534e9de912d2de1099e88135c9395f421fc2702a0e36fc6da2475a41a00254dba51feac9b5234d03681511d5395ad8ac0beb8c6c7eb4c466485d1dc81cb083820389e5ffa35fae6f8c19d5ffbad89cf5e7cb83563bfccff31e075cb26cbe17cdf8d74e3f99fa782eff"}) fcntl$setflags(r1, 0x2, 0x1) setxattr$security_ima(&(0x7f0000000980)='./file0\x00', &(0x7f0000000180)='security.ima\x00', &(0x7f0000000240)=@v1={0x2, "0771bf1f72272c4ce3afda06e06c08c1d7f2"}, 0x13, 0x0) mount$overlay(0x0, &(0x7f0000000840)='./file0\x00', &(0x7f0000000880)='overlay\x00', 0x1008, &(0x7f00000008c0)={[{@redirect_dir={'redirect_dir', 0x3d, './file0'}}, {@xino_on='xino=on'}, {@metacopy_on='metacopy=on'}, {@metacopy_off='metacopy=off'}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@default_permissions='default_permissions'}], [{@smackfsdef={'smackfsdef', 0x3d, '/selinux/enforce\x00'}}, {@fsmagic={'fsmagic', 0x3d, 0x1}}]}) ioctl$PIO_FONTRESET(r1, 0x4b6d, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000800)) sendmsg$kcm(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000340)="eb46afb56aa8da6c371c5d350f4095b6491c562acb5f4096cab65a2d529ff722f2aaff46d8857e830c3ab5b089b997f6e3c27dcc956295bf18c4f75f048be93b5c5b6f156be7f1cfc0b0e81a12c517bc1acc9d3dde54ec7cb09f658a4396093bc4c7aa8d007218a00ab8cb7731e493309202b7a2949b8eb5b20959974c5566eec6c9698f3946010f78090582de4a020fc3b164abe762248868dfabd3b58d22c1f939e92eafc263e0c4b947d22a3048b90e1769f26141efb6f97d821220f47e15e6132621ad8b72421ed3d602cd513491145a65334e277b8b4b568060", 0xdc}], 0x1, &(0x7f0000000480)=[{0xf0, 0x11d, 0x3ff, "c993bebe10d329c07f14665eb6d7fb90ad8f7b6016c2fcb2f4073f9053efff46ec28d6c25a9add492b0568c8a08451e0476f82c2cb9eb456f3acb8a35d20bfa7a12d147b16c148af3ed005023f9a2d3a34e9d7f85e0d6b41e4275917f67d284cfb551ba9479f111a2d4714ada6caf1e0e04c25c5584cb7e0c8adc384b15760b0fdf685a1a95824c7e7120356205209d962468ba8ccfbef836cd775f71ce5c7f866078c73cf99c8d922b185976ac02dd2121f9f53802e93f9272bd72522c3a1977e13cc09d68cc9ad6b53f0ca8366d85624bcbd80d8e4a385c1af"}, {0x58, 0x88, 0xff, "ab6a93c66be8e8a49af423859532915b6aed13dcdd6a0c2fff9c6e3c5aa040fb9d2e0d1d20eca0912eddf57145a19eff7871a079b061fad28e7237d19e694286cf45ae09"}, {0x98, 0x113, 0x0, "4575767a2a16762bc3c1dd16c228e9a38f6c7a360774db9524a9d6a63098658fb76306c2cc8179235fd4a9894498fa702a14cb736bd9c261e25429e69bcb5fb247ec87656371e3b60b87962a687bef23abf87792631eb203f757d2f0a184e781dda34af44cb807a90ba1cf46080874625d8443849b6d562170b134c263fc883a80b9a9e262"}, {0x50, 0xff, 0x2, "905e827f75d8cb3db06559aad243da7697d6ffe24d760bbc41b54b6b87b6bf75236d80323b73b84ae47b7241922ec34a1b74e145bbe39ccbeec732a7"}, {0x108, 0x105, 0x8, "56f287b1209a52c195a725884f025e7df3c765f317d1d9e7eb0ddb3703e0ef2e6a1dfcc282ee50a4594bf7c017cdf8116382e044701cbc2e86d570e823adc000c2d1aa76907418fed2bd640eaa76f9539f32d296fd6fed3d9565416c8f4f37786c20825974b40c6425e95b5af7221e1c0a04bfc8c1a7ce7d00a9f5653cfb73f1ef2d03f6349752f619ec331aa4799fa43036c13e71ab9985e76cb74530311c734ff78b5335e43f8ba73e6716dfa342ab9c9c91ea7f6d6c07506cab9c9a55ae00bd900839a35d6591b4f24489473f4b2d395d7d95101657a158e483cfbb9ee6f451cd2b0e4b8eadb2125e8b7012f1ec09b06b"}], 0x338}, 0x84) [ 1750.397482] binder: undelivered TRANSACTION_ERROR: 29201 [ 1750.402995] binder: undelivered TRANSACTION_ERROR: 29189 03:50:52 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x3f000000, 0x20004080}, 0x0) 03:50:52 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r1 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0, 0x20) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={&(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x1, 0x9, 0x4}) [ 1750.466163] binder: 31978:31982 ioctl c018620b 0 returned -14 03:50:52 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1750.527826] binder: 31978:31982 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1750.607111] binder: 31978:31982 BC_FREE_BUFFER u0000000000000000 no match 03:50:53 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000240)='/dev/audio\x00', 0x200, 0x0) ioctl$TIOCLINUX3(r1, 0x541c, &(0x7f0000000280)) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0xceff, 0x200000) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x29200018}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r3, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) 03:50:53 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0xf0ffff, 0x20004080}, 0x0) [ 1750.655120] binder: 31978:31982 got reply transaction with bad transaction stack, transaction 5591 has target 31978:0 [ 1750.692107] binder: 31978:31982 transaction failed 29201/-71, size 0-0 line 2756 03:50:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x68000000, 0x0}) 03:50:53 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000140)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:53 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x2c) 03:50:53 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x3, 0x0) ioctl$BLKIOOPT(r0, 0x1279, &(0x7f00000000c0)) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1750.835763] binder: send failed reply for transaction 5591 to 31978:31982 [ 1750.843422] binder: undelivered TRANSACTION_COMPLETE 03:50:53 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0xfffffff0, 0x20004080}, 0x0) 03:50:53 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) r1 = openat$random(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom\x00', 0x400, 0x0) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f00000000c0)=0x100000001) 03:50:53 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x202000, 0x0) connect$llc(r1, &(0x7f00000000c0)={0x1a, 0xffff, 0x40, 0x7fffffff, 0x3, 0x19, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}}, 0x10) [ 1750.960516] binder: 32016:32024 ioctl c018620b 0 returned -14 03:50:53 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1751.026364] binder: 32016:32031 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:53 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x2c) [ 1751.070722] binder: 32016:32031 BC_FREE_BUFFER u0000000000000000 no match [ 1751.104742] binder: 32016:32031 got reply transaction with bad transaction stack, transaction 5594 has target 32016:0 03:50:53 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x26, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:53 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x3f00000000000000, 0x20004080}, 0x0) [ 1751.136153] binder: 32016:32031 transaction failed 29201/-71, size 0-0 line 2756 03:50:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x6c, 0x0}) 03:50:54 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f00000003c0)=ANY=[@ANYBLOB="00c42c6b44e07d85", @ANYRES32, @ANYBLOB="009a8171bb3fb28b302d64e557000000000000000000000000008478bbea2c78078a151001213cf323c1f3e7b86ca22319f9657b5614123541fa2471f9538e7d64534350d47593074b8b3105e70df1232543f76f87e2a95575b27c374e9db762cbe96c95ffbb409659ecb88a5c81e895c7de053b4516cc1c098446bfeefe67e4f340823d5cf4189fcdd1d5fe9f2ef20b7f3f23efbcd2b5966131ff567c2e1907bc6c9d517b"]) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x20000, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x100800}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, 0x0, 0x800, 0x70bd2b, 0x25dfdbff}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x4) getpeername$packet(r1, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000004c0)=0x14) fchmod(r0, 0x20) r4 = getuid() prctl$PR_CAP_AMBIENT(0x2f, 0x1, 0xa) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000040)=0x2, 0x4) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000500)={{{@in6=@dev={0xfe, 0x80, [], 0x21}, @in6, 0x4e22, 0x3, 0x4e22, 0xffffffff, 0x3157cb27c9d047fd, 0xa0, 0x20, 0x2, r3, r4}, {0x7fff, 0x3, 0x3, 0xd5, 0x7, 0x45b2, 0x2, 0x2}, {0xe5a, 0x1, 0x1, 0x7}, 0x1, 0x6e6bbf, 0x1, 0x0, 0x0, 0x3}, {{@in=@empty, 0x4d6, 0x7e}, 0x2, @in6=@loopback, 0x0, 0x3, 0x3, 0x8000, 0x100000001, 0x0, 0xd643}}, 0xe8) sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="c829e7f3", @ANYRES16=r2, @ANYBLOB="000426bd7000ffdbdf250a0000000800060000000000080006000700000008000500000000008400030008000500ac1414aa14000600fe8000000000000000000000000000bb08000500ac14141714000600fe8000000000000000000000000000aa080004000000000008000400ffff000008000100020000000800010003000000140002006c6f00000000000000000000000000001400020067726574617030000000000000000000"], 0xb0}, 0x1, 0x0, 0x0, 0x80}, 0x40) 03:50:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:54 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000080)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:54 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}, 0x2c) 03:50:54 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x1000000000000000, 0x20004080}, 0x0) [ 1751.767944] binder: send failed reply for transaction 5594 to 32016:32031 [ 1751.788304] binder: undelivered TRANSACTION_COMPLETE [ 1751.807150] binder_release_work: 2 callbacks suppressed [ 1751.807156] binder: undelivered TRANSACTION_ERROR: 29201 03:50:54 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0xfffff000, 0x20004080}, 0x0) 03:50:54 executing program 1: r0 = socket$kcm(0xa, 0xffffffffffffffff, 0x0) write$smack_current(r0, &(0x7f0000000080)='-\x00', 0x2) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:54 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1751.858411] binder: 32063:32068 ioctl c018620b 0 returned -14 [ 1751.860230] binder: undelivered TRANSACTION_ERROR: 29189 [ 1751.930644] binder: 32063:32077 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:54 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) write$binfmt_misc(r0, &(0x7f0000000180)={'syz0', "d78b8fad36064f4abe52fbf12dae6a9d397dbeed8038830b741cb3719e887a3cd2c49cbf1e91951c8650fafc3e2af90c5292a2fb927375184f6845ee875817ccc403965e3f993ea9cf800c204d03000000000000003f2a4564e4f689b10255b7ecb4866a2181b0d5c42092364b1ec05a0c09517e270d429947da0b3339ef0cbb8f2eddda975a6e09b228a9593cbdf37e55f38cece18dc741577afd2510e2eb497b75eceb6600000000cca903f46886f085048a5148d6e1ed6fe4dc53d9fb9477a309fcee3c"}, 0xffffff35) [ 1751.977348] binder: 32063:32077 BC_FREE_BUFFER u0000000000000000 no match 03:50:54 executing program 1: r0 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffff9c) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000580)={{{@in=@remote, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f0000000680)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000003c0)={{{@in6=@local, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@local}}, &(0x7f00000004c0)=0xe8) syz_mount_image$jfs(&(0x7f0000000040)='jfs\x00', &(0x7f0000000080)='./file0\x00', 0xbd5, 0x2, &(0x7f0000000240)=[{&(0x7f00000000c0)="7ca8808e2d836a6ad9d7cb4f079017a70c8ba11ff89ca1296bb234bec67c34a4d2f446261d50804da26493077e3a10c7505916a5f8ec6196340ca4ffc229e563be6db2b32b9a30fa5f1078bad73e209b9b5198fc988109585779cc416725a75697200d7c2d4a86e1d4e5e7", 0x6b, 0xde3}, {&(0x7f0000000140)="22fc36c9d238d2cc5d09b9597805322231b2911043d10d370942640d64fa0857b8c522129eb47662e8cee178f2dc64f70fe3f2e581c251f49d3d91fc9fe240c2d4f1f398299db1e8384b8ec5ea080ae18ba2452c1774812e9b463d6328d826a0b3e5477840be952f2ed9cc4056fcd409b53135126f4b6ddbafa4136b5cdf46ad1307ac151a345519a37fa43997b9a5d64aed9263fb57e241077c2bc2c62e6514bf872da264ae9bbbcf7921b9ec3fbd27f9e02ec43f8fd4fa7e21c4b5592f7284c25ac9f2a9d65326f1623c133308f0acd85869570bfec1823f55e98a02a37607c87bf6622c36c461628e7eb6e5d94c7a142cbbca4494d2e497de", 0xfa, 0x568}], 0x2012000, &(0x7f0000000500)=ANY=[@ANYBLOB='errors=remount-ro,appraise,euid=', @ANYRESDEC=r1, @ANYBLOB="cc442a3823cb0505", @ANYRESDEC=r2, @ANYBLOB=',fscontext=user_u,\x00']) ioctl$KVM_GET_LAPIC(r0, 0x8400ae8e, &(0x7f00000006c0)={"6ec1b3413af5b109826fbc4f85bd07e7539a5655a19dc79ce47c03c43cf7f9d75f541abab69ae5ecd3352a89fb557953c27d0a925be346d4fe670e33d1abbd8c5158eecb09d482a0dc1a4af0a4aeb606f32556d019155c8990273369c28f8a78ad065c3463504c249202b69ab4a08300eca086abd2920a91d0f9723354ce2e7c3d55780a9b0a5705d1e91c3d976dfe035b4e183bb0911127f79fd35396fc68b00fc636714bf6c30c9c3de8d7539b12a8d43329dfcd81f9d572df9cf4d1b7798132858dc67267945e9f97de0df4c5cb676a089178c419e2841a56cc41180890d764b1e3a151944bf9dbe009fe4b21144637048f77abb0f2ebc7558f616a7d4aacf49c86894908e0072dad168f2a21f3d5fb569094b92dd115019153af35068059dbf0d7e751407f085fb86ef65d6695abc097a0a87fa1a2efce5ed86fb613c9fb815dc447f684bc6d74b14c56ac126a53bb8031bb0b5fd157a9914c7f0213f924e1a3c96a3c76f4a236a32fdf7fdcc3e0925085016efa09f1fadcf048fdaff86642f31db26d99c070a590819fd6b97dc9370dce9ac38749142dcbca4a02d7fdd2feda70ddf00ac083acb9f99c463fd2bcd7002973857fffb4b87596512f5f9ad42a14881269d0246fdd3b5a9356fdee3ee394140b7c5841e1d8b3c399d7385a9d4b01e62e43c4f331d6204a6417c19a1cfe0fab804fb9389c801c00996df4331d89b314a2bdcef83757c0c7366131d992181f729c86ab0ff6dce24a628e5024d7c01d838969c11ade5c61d57658f8189aba511b7e6296223d15273abed2d1d13c317de9d8953846c6cc9db812e954d05c3fa699682df559b0bee2c9d0950bacd8146fc16cb0bd6954c766e1d13d09fa4dbe37f86b070312d81f3a686bd779b42235ac0a3c9b53e7dd272466eb9e7603bbe34c867995b46dbed7b4c4534b9345ce2225d9d76f4627262f77bb6ef9b8ddf1f755aa89f24c9351abdf23bc2bd1b87fc234358cc3d1a391b66f0f4af2b25f8675b1c05ba47461f5694f6fae61857a2c935c9eaf15d35d12caf4f15b07d63cb5ec643c97c054ecead1a973e0608072aae33580f77613c5d5d968f453347f9c0850b293e223b7a46a17f4b598eedab30b17a6e5e5041a09af8ebbef3e275ab78edf519547a34c45353529a2ee7fe9d07d4c9df36d12ad90fe1e1e2585e0e7170841c0f5958888240d1b5cfe22903300c4f9c630e3710efd865ed471f3f188e1a82ea4047a9a82d36be61a1516d8bd62d63e961e4aab870c71918e30c5d16c2474bad5558add3d43b53cff931dfe68718518a8937cfd5122e270240a7066b5e6014f54e1e537409dd1b77bf6be81f3ddbe95c1bfe600e7efcaf4dabea399eeb14ad04735a487cdc39d6ea6b70cfaeb18a17a92632ef464e40785ebef4567de4eb13a61f662365fe88bde943ff33305a83a"}) ioctl$SG_GET_ACCESS_COUNT(r0, 0x2289, &(0x7f0000000000)) fdatasync(r0) socket$kcm(0xa, 0x103, 0x0) 03:50:54 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x1000000, 0x20004080}, 0x0) [ 1752.040168] binder: 32063:32077 got reply transaction with bad transaction stack, transaction 5597 has target 32063:0 [ 1752.091764] binder: 32063:32077 transaction failed 29201/-71, size 0-0 line 2756 03:50:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x500000000000000, 0x0}) 03:50:55 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000]}, 0x2c) 03:50:55 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB="0000000001000000", @ANYRES32, @ANYBLOB="000000d25642cb028c649c005404000100000000"]) 03:50:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:55 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0xf0ffffff, 0x20004080}, 0x0) 03:50:55 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x202, &(0x7f0000000200), 0x28}, 0x0) openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/access\x00', 0x2, 0x0) socket$kcm(0x29, 0x5, 0x0) [ 1752.658726] binder: send failed reply for transaction 5597 to 32063:32077 03:50:55 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x8, 0x20004080}, 0x0) [ 1752.702127] binder: undelivered TRANSACTION_COMPLETE [ 1752.720314] binder: undelivered TRANSACTION_ERROR: 29201 [ 1752.742129] binder: undelivered TRANSACTION_ERROR: 29189 03:50:55 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f0000000100)=""/99, &(0x7f0000000180)=0x63) r1 = socket$kcm(0xa, 0x2, 0x0) write$P9_RREMOVE(r0, &(0x7f00000001c0)={0x7, 0x7b, 0x1}, 0x7) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000080)={r1}) chdir(&(0x7f0000000280)='./file0\x00') setsockopt$bt_BT_POWER(r2, 0x112, 0x9, &(0x7f0000000240)=0xc1, 0x1) connect$llc(r0, &(0x7f0000000200)={0x1a, 0x305, 0x200, 0xa8d, 0x8001, 0x8001, @random="aefcc5b9f870"}, 0x10) sendmsg$kcm(r1, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="280000000000000002000000000000000000000000000000a40a0000000200000000000000000000031052f4127c71cec5b12cb210c1715602e0c439f49f7b138dfb7010c191a2a0956437994d33c77c409cf68d2cc7ea12c00e045c46961c4d11e6f6db83d0f76eabebc1d5925683fea6fced000bf9e36123bcbb493f3ad9adad71d7133865a85e8518029a77c887718ad8b2fe7ee0996cd719077eed5abaadd51255c977dd346971133d90d01520e8911008acf23fdbc7369b58c6d653ad5d9db337e467cc5d402df8814fc5c960ed3a23c4e9040dee9455ec1f227a0f72ec12161d55524f38876a07ecd770837b813b0775ddbfc95167d19830939558e75e5bfba43ff25cf9d1ba81e996586faa1157df6fa4bb1bc7272e72cce340be512deaaeabea16e7393673e6311f6c5117a3b07193be775d9682cf"], 0x28}, 0x0) 03:50:55 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x4000, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000100)={&(0x7f00000000c0)=[0x9, 0x100000000, 0x2, 0x50, 0xb34e, 0x200], 0x6, 0x100000001, 0x0, 0x3fce8709, 0xccfd, 0x4, {0x1, 0x8000, 0x5, 0xfffffffffffffff7, 0xffff, 0x1, 0xd957, 0x58, 0x6, 0xffffffffffffffab, 0x2, 0x2, 0x4, 0xa730, "2536ef32b0ebc692511c8bbf062adc555e153268cd49f88fff4834ee0ae5bba5"}}) 03:50:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1752.782772] binder: 32122:32124 ioctl c018620b 0 returned -14 [ 1752.867403] binder: 32122:32132 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1752.874420] binder: 32122:32132 BC_FREE_BUFFER u0000000000000000 no match 03:50:55 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) readlink(&(0x7f0000000080)='.\x00', &(0x7f00000000c0)=""/97, 0x61) r1 = syz_open_dev$dmmidi(&(0x7f0000000140)='/dev/dmmidi#\x00', 0x7fff, 0x40000) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f0000000180)) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r1, 0xc040564b, &(0x7f00000001c0)={0x1ff, 0x0, 0x2023, 0xfffffffffffffffd, 0xffffffffffff7fff, {0x3, 0x1ff}}) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000000000000000a41a000000000000000000000000000000000000000000000000"], 0x28}, 0x0) 03:50:55 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0xffffff9e, 0x20004080}, 0x0) [ 1752.940636] binder: 32122:32132 got reply transaction with bad transaction stack, transaction 5600 has target 32122:0 [ 1752.976351] binder: 32122:32132 transaction failed 29201/-71, size 0-0 line 2756 03:50:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0xffffff7f00000000, 0x0}) 03:50:55 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r1 = dup(r0) ioctl$VIDIOC_TRY_ENCODER_CMD(r1, 0xc028564e, &(0x7f0000000040)={0x3, 0x1, [0x4cd, 0x10001, 0x4, 0xf7, 0xffffffffffffff9f, 0x7, 0x9, 0x3]}) 03:50:55 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:55 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x200000000000000, 0x20004080}, 0x0) 03:50:55 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="28000000000000002900010002009d00000000000000000000000000a40000000000000008000000e5eb1f5fe053fe340673350668389d3f16e6295a2a5eaefb9c0f75a5d95eee727783e702f851cb42ef4e68407a9a9db73462000200b26b0d768b7729da142503"], 0xfffffffffffffcef}, 0x0) 03:50:55 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000]}, 0x2c) [ 1753.578903] binder: send failed reply for transaction 5600 to 32122:32132 [ 1753.624837] binder: undelivered TRANSACTION_COMPLETE [ 1753.642848] binder: undelivered TRANSACTION_ERROR: 29201 [ 1753.660836] binder: undelivered TRANSACTION_ERROR: 29189 03:50:56 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0xffffff7f, 0x20004080}, 0x0) 03:50:56 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x7, 0x82000) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000100)={0x0, 0x0, 0x100000000, 0x13, 0x7, 0x2, 0x0, 0xc5f, {0x0, @in={{0x2, 0x4e23, @empty}}, 0x60e, 0x401, 0x5, 0x0, 0x6}}, &(0x7f0000000040)=0xb0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={r2, 0x20}, &(0x7f0000000240)=0x8) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000080)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:56 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) r1 = socket$kcm(0x29, 0x5, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000040)={@dev, @multicast1, 0x0}, &(0x7f00000000c0)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000100)={'team0\x00', r2}) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1753.681623] binder: 32169:32170 ioctl c018620b 0 returned -14 03:50:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1753.741399] binder: 32169:32175 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1753.779516] binder: 32169:32175 BC_FREE_BUFFER u0000000000000000 no match 03:50:56 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x2c) 03:50:56 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f00000000c0)={0x1, 0x55a}) [ 1753.835695] binder: 32169:32175 got reply transaction with bad transaction stack, transaction 5603 has target 32169:0 [ 1753.865260] binder: 32169:32175 transaction failed 29201/-71, size 0-0 line 2756 03:50:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x4c000000, 0x0}) 03:50:56 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x1, 0x2) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000000c0)={[{0x8, 0xc8, 0x0, 0x6, 0x10000, 0x42, 0x39483266, 0x2, 0x99, 0x401, 0x3, 0x1000, 0x4}, {0x0, 0x7f, 0x9, 0x8, 0x7, 0x8001, 0x2, 0x80000000, 0x8001, 0x7, 0x1, 0xffffffff80000001, 0x654}, {0x0, 0x4, 0x1, 0x7fff, 0xffffffffffffffff, 0x0, 0xfa0, 0x4, 0x1, 0x615, 0x200, 0x9, 0x1}], 0x3ff}) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:56 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x3291, 0x20004080}, 0x0) 03:50:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:56 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x2c) 03:50:56 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040)='/dev/udmabuf\x00', 0x2) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x4000, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000006c0)=[{{&(0x7f0000000380)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000400)=""/181, 0xb5}, {&(0x7f00000004c0)=""/163, 0xa3}, {&(0x7f0000000580)=""/248, 0xf8}], 0x3}, 0x8000}], 0x1, 0x2000, &(0x7f0000000700)={0x0, 0x1c9c380}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000740)={'veth0_to_team\x00', r2}) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000100)=ANY=[@ANYBLOB="3428a15b311a4949052b2953974927ae873f55183d2f87fbca7aa2887098364d7875bf3bc0ef487903b8ad08888c3105a06e4f2de84d177179524265f85af2", @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) r3 = getpgrp(0xffffffffffffffff) r4 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x4, 0x200) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={r3, 0xffffffffffffff9c, 0x0, 0xd, &(0x7f00000001c0)='/dev/udmabuf\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={r3, r4, 0x0, 0xd, &(0x7f0000000180)='/dev/udmabuf\x00', r5}, 0x30) capget(&(0x7f0000000000)={0x20080522, r3}, &(0x7f0000000080)={0x6, 0x9, 0x9, 0x100, 0x4, 0x2}) [ 1754.486466] binder: send failed reply for transaction 5603 to 32169:32175 [ 1754.524664] binder: undelivered TRANSACTION_COMPLETE [ 1754.529919] binder: undelivered TRANSACTION_ERROR: 29201 [ 1754.573364] binder: undelivered TRANSACTION_ERROR: 29189 03:50:56 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:57 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x220000, 0x0) 03:50:57 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x9132, 0x20004080}, 0x0) [ 1754.615305] binder: 32205:32214 ioctl c018620b 0 returned -14 03:50:57 executing program 0: openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1754.668600] binder: 32205:32219 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1754.734830] binder: 32205:32219 BC_FREE_BUFFER u0000000000000000 no match [ 1754.750755] binder: 32205:32219 got reply transaction with bad transaction stack, transaction 5606 has target 32205:0 03:50:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:57 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000009c1021e2000002000000000000000000000000000000a40a00000000000000000000"], 0x28}, 0x0) [ 1754.795117] binder: 32205:32219 transaction failed 29201/-71, size 0-0 line 2756 03:50:57 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x800000000000000, 0x20004080}, 0x0) 03:50:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:57 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}, 0x2c) 03:50:57 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x60, 0x100) r2 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x40) ioctl$PIO_CMAP(r2, 0x4b71, &(0x7f0000000140)={0x3, 0x72, 0x1b7, 0x4, 0x2, 0x2}) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000100)={0x2, r2}) ioctl$RTC_ALM_READ(r2, 0x80247008, &(0x7f0000000180)) 03:50:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0xffffff7f, 0x0}) 03:50:57 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000100)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x48000, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0x4008af12, &(0x7f00000000c0)={0x0, 0x1}) syz_mount_image$f2fs(&(0x7f0000000000)='f2fs\x00', &(0x7f0000000140)='./file0\x00', 0x9, 0x7, &(0x7f00000005c0)=[{&(0x7f0000000180)="978d34f39d0cfa8294f35474b44857abb4b2da954c29ed938f1c3745d53ad429b1268b336e2825c5623fd81797cb1c35b75c7fcd6c6018cfa895c8b89a124e0083e6fafb13a368be1dbd9cec3764e036ff17e28b10b227760c2934b485f7afcc076418244760f58e828c059fedb0f581b3ef5faa4391db99547294c2f119f7778b81744c9e47807e3a6cac40124c8a8adcfc33145e0509c1fc7fd959507d896268f973b4332d", 0xa6}, {&(0x7f0000000240)="5539c79d272ceef4d9584e13a87fea98dd3aa7b552f5bd7f9bf011209028f63bfcc7f9dcea497467ed1df4f5812f448afba3445666dfe3e4cf451fe4437bc6fad47f6d6fe7e03be4325522e7498260f282f75ef52105c45af635cdf78c2c92bd7ecadffae37639847532c7df40633fc780c85d6bbc590fbeee841fadd9663d70ff8e6b72d9d41273c44162f4ea3ba29139538dceeda9f7422c9cd8bef10ecb71471bd68db5eb9b6963d0510c352e163f7ac9d890f22dd0c838cdbfc9b80c681025dc34d94dfb4f1a1fd481772bb5823b97ed94b6ea771c5d91e476b447eb8b6af3", 0xe1, 0x10000}, {&(0x7f0000000340)="151c494e968f2aabed41f78dcf995c4df4ac8acde2d76c9927e83b2447eabb858697b0cf714d95c03097492188dc8248103dea2a5584ed13", 0x38, 0x100}, {&(0x7f0000000380)="86c5a27a8d216195a08a7d0de18818a1c2c2e33f9a03c9f0a1c243e04642696e483f19c045b00f5e112c58d91bb93fe45327132eaa64d9223dea", 0x3a, 0x81}, {&(0x7f00000003c0)="ce87ffea8e45a56917df8114af8ba282e038cf531da55b642fbd996645b2f67e77e1284f257eeb8dc7386aa8661a888402bfd2f942657b6a9cae97e8aae73feefb0bd5edb264c1a889a764e5654461a9e25e96267e8b6b877afab6cb5ddb01fee2a3e44f8d5a6481697840e437c050434c4e58cca4f135b7e37d75608c0b7c00869db8f3", 0x84, 0x6}, {&(0x7f0000000480)="b155d2b93586fa6f60aa0423839d82c0d35a1ee13f53da8738a18c015f6ba7df4a07139c50bd2243177320f6f4641ab81c9c82d2ac1b6f7b649e37a3a8ee36f45cf5a63306b5", 0x46, 0x7}, {&(0x7f0000000500)="dc12ea4914209c1c33bc246631ea1476770e1c29d8653cfefa167e78ac853d1a4cb27407528cd211ac0ce50c8f7432a83201375c6a3e5fc4c0ca4ef8c7788f19d004fd760a30bae70ddbdb13aa84843e49fe03b84a882ebd794b6195bf0d5e2771fa8d8d8fb09de87785b631ef646a3fc592e364df3713d2ab7ad6b5e795dafb2cfeda2bc5a6a7a1716226f4913ae57a45687ed57936413e6ee13150c167", 0x9e, 0xff}], 0x0, &(0x7f0000000680)={[{@noextent_cache='noextent_cache'}, {@fsync_mode_posix='fsync_mode=posix'}], [{@measure='measure'}]}) [ 1755.396273] binder: send failed reply for transaction 5606 to 32205:32219 [ 1755.405137] binder: undelivered TRANSACTION_COMPLETE [ 1755.410669] binder: undelivered TRANSACTION_ERROR: 29201 [ 1755.416369] binder: undelivered TRANSACTION_ERROR: 29189 03:50:57 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x10000000, 0x20004080}, 0x0) [ 1755.481525] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1755.511149] binder: 32259:32262 ioctl c018620b 0 returned -14 [ 1755.515450] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock 03:50:57 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1755.560812] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1755.576156] binder: 32259:32265 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:50:58 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x3f00, 0x20004080}, 0x0) [ 1755.608709] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock [ 1755.614722] binder: 32259:32265 BC_FREE_BUFFER u0000000000000000 no match [ 1755.621770] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1755.623436] binder: 32259:32265 got reply transaction with bad transaction stack, transaction 5609 has target 32259:0 03:50:58 executing program 1: socket$kcm(0xa, 0x2, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x20001, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) setsockopt$inet6_dccp_buf(r0, 0x21, 0xd, &(0x7f0000000040)="4c704c8289dcf58ee13cb059f9512d3a5911b5cfd629344859df71b634b87b60aef9616b6bf9222e3be7a882ba87766ab91591f9a9297760f1d4b8f6ee", 0x3d) [ 1755.657077] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 1755.675153] binder: 32259:32265 transaction failed 29201/-71, size 0-0 line 2756 03:50:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1755.711143] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1755.736551] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock 03:50:58 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0xfffffffffffff000, 0x20004080}, 0x0) 03:50:58 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}, 0x2c) [ 1755.855637] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1755.910889] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 1756.004007] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1756.015016] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock [ 1756.036809] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1756.056533] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 1756.064346] F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 1756.079791] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock 03:50:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0xfffffdfd, 0x0}) 03:50:58 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) clone(0x210007d9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000440)={0x28, 0x0, 0x0, @hyper}, 0x10) listen(r1, 0x0) accept(r1, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:50:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:58 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0xffffff7f00000000, 0x20004080}, 0x0) 03:50:58 executing program 0: syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0xfffffffffffffff9, 0x6002) r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:50:58 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}, 0x2c) [ 1756.283182] binder: send failed reply for transaction 5609 to 32259:32265 [ 1756.334590] binder: undelivered TRANSACTION_COMPLETE 03:50:58 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x9effffff00000000, 0x20004080}, 0x0) 03:50:58 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB="0000000001000000", @ANYRES32, @ANYBLOB="000000000001000000000000000000"]) [ 1756.371957] binder: 32307:32309 ioctl c018620b 0 returned -14 03:50:58 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1756.434834] binder: 32307:32322 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1756.457037] binder: 32307:32322 BC_FREE_BUFFER u0000000000000000 no match [ 1756.495747] binder: 32307:32322 got reply transaction with bad transaction stack, transaction 5612 has target 32307:0 03:50:58 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x91320000, 0x20004080}, 0x0) 03:50:58 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000001c0)={{{@in=@empty, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@ipv4={[], [], @local}}}, &(0x7f00000002c0)=0xe8) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@loopback, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@mcast1}}, &(0x7f0000000400)=0xe8) syz_mount_image$iso9660(&(0x7f0000000040)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x3, 0x2, &(0x7f0000000180)=[{&(0x7f0000000100)="8b550fd7cd5d971351f6fe2ed0e46e5d170ea2958d327ab386e06e0a793ef5", 0x1f, 0x9}, {&(0x7f0000000140), 0x0, 0x5}], 0x0, &(0x7f0000000440)={[{@map_acorn='map=acorn'}, {@nojoliet='nojoliet'}, {@uid={'uid', 0x3d, r1}}, {@cruft='cruft'}, {@hide='hide'}], [{@context={'context', 0x3d, 'staff_u'}}, {@smackfshat={'smackfshat', 0x3d, '/dev/udmabuf\x00'}}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x39, 0x3d, 0x7d, 0x39, 0x0, 0x63, 0x77], 0x2d, [0x65, 0x66, 0x35, 0x3b], 0x2d, [0x33, 0x7b, 0x36, 0x32], 0x2d, [0x73, 0x61, 0x77, 0x3e], 0x2d, [0x0, 0x77, 0x38, 0x37, 0x76, 0x64]}}}, {@appraise='appraise'}, {@euid_eq={'euid', 0x3d, r2}}]}) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1756.544648] binder: 32307:32322 transaction failed 29201/-71, size 0-0 line 2756 03:50:58 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x2c) 03:50:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x4, 0x0}) 03:50:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00p\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:50:59 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0xf0ffffff00000000, 0x20004080}, 0x0) 03:50:59 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) setsockopt$packet_buf(r1, 0x107, 0xd, &(0x7f0000000140)="25f80cbafcd8df42587ad8f7d850cc7a03417e9ab55cd9f3d08fa74ad006e90ce1afec970717ead29812febed2e094b257116cb219163796a0698d69776defd1aee5a332bfd5e946b6a677d6b6c8e33f73a2b440d73c889c0581a10745e506b2ebb7328cfeb3c970d878e9ee4ea08248d2be6c47d0fc717caca8a42bdd8aa5cff6d8241db9714e3563b55360c91e2be8123a97194cb62d2f04812df0642dd566f13ded66d05b491e8369d76e48b555c2cabff6d7fb4831178f2afca101ce", 0xbe) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x20000, 0x0) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000100)={0x1, 0x2, [{r1, 0x0, 0xfffff000, 0x100000000}, {r2, 0x0, 0x100000000, 0xfffff000}]}) 03:50:59 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x2c) 03:50:59 executing program 1: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x210880, 0x0) setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f00000001c0)={@remote, @initdev={0xac, 0x1e, 0x45d2, 0x0}}, 0x8) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x2, "000000000000000000000000a40a000000"}], 0x28}, 0x0) r2 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0x1, 0x2) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x401, 0x0) ioctl$FS_IOC_FSGETXATTR(r2, 0x801c581f, &(0x7f0000000080)={0x1, 0x400, 0x8, 0x1, 0x3}) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, &(0x7f0000000100)=0xffffffffffffffff, 0xbe7364ed8715012) [ 1757.153350] binder: send failed reply for transaction 5612 to 32307:32322 [ 1757.160738] binder: undelivered TRANSACTION_COMPLETE [ 1757.166068] binder_release_work: 2 callbacks suppressed [ 1757.166074] binder: undelivered TRANSACTION_ERROR: 29201 [ 1757.230690] binder: undelivered TRANSACTION_ERROR: 29189 03:50:59 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x8000000, 0x20004080}, 0x0) 03:50:59 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="27800000000000000000020019000000a4080000000000000000000035b34643a1ee43f3d033f64788aee1147964431dd1d73217786cf25e4a4099b8d7ba3bb8fe8b144ba96973d7ae4f6f36911bb85657874e2b39edfdea433bb23a69d3314eabade63c08eb6f4f8820acd108d65add82d911c914aaeae0b63fd15a81e2a6549566640f36d97d6e7577bb159165de100f7e58ea48f967d6bbf29f1024799d7ea6f5797d769a0d1c76174c868e8e93a20b991880fdfde4e660bb46b46c94"], 0x28}, 0x0) 03:50:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1757.286401] binder: 32366:32369 ioctl c018620b 0 returned -14 03:50:59 executing program 0: r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x400000000000006, 0x7ffc) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f00000000c0)={{0x436, 0x30000}, 'port0\x00', 0x63, 0x40000, 0x1ff, 0x400, 0x8000, 0xffff, 0x101, 0x0, 0x2, 0x6}) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r1, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00']) [ 1757.365449] binder: 32366:32374 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1757.410623] binder: 32366:32374 BC_FREE_BUFFER u0000000000000000 no match [ 1757.440156] binder: 32366:32374 got reply transaction with bad transaction stack, transaction 5615 has target 32366:0 03:50:59 executing program 1: r0 = socket$kcm(0xa, 0x2, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f00000000c0)={{0x6, 0x20}, {0xfff, 0x2}, 0x3, 0x2, 0x3}) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="28000000000000002900000002000000004fc961d9d65909c9e1cb200a7f00000000000000000100b88e0300000000000000000000"], 0x28}, 0x0) 03:50:59 executing program 0: openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) [ 1757.503139] binder: 32366:32374 transaction failed 29201/-71, size 0-0 line 2756 03:51:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x74, 0x0}) 03:51:00 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x10, 0x20004080}, 0x0) 03:51:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:00 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000]}, 0x2c) 03:51:00 executing program 1: r0 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x0, 0x2) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f00000000c0)=0x8, 0x4) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[{0x28, 0x29, 0x80, "000000000000000000000000a40a000000"}], 0x28}, 0x0) 03:51:00 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000180)=ANY=[@ANYBLOB="00486a9300000001", @ANYRES32, @ANYBLOB="00000000000000000000000000000001000000008d3d7dd226a02914775deacc6bd046088108cd9183b1737aac97a3eea530595f41d4dcca6518912aafce1d9327dcfbe24246dbd2a7519285b82a8bc2f48ff72d00c119ed86ca3ee8b80c9ae6fc999ba51ccd0e48e432608c9a55fc171f7553379f3d9dc6f6a31baa7e1bb7f119f314d3439b0ca2836f49d57469e89e7c2053c6d6f5d7152ad3406f83c22ff6a4ca218ddce9f5073723d348df330e6383534d6158516b"]) socketpair(0x11, 0x0, 0xcbbb, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$rose(r1, &(0x7f00000000c0)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x1, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}, 0x1c) [ 1758.071122] binder: send failed reply for transaction 5615 to 32366:32374 [ 1758.078867] binder: undelivered TRANSACTION_COMPLETE [ 1758.084005] binder: undelivered TRANSACTION_ERROR: 29201 [ 1758.098120] binder: undelivered TRANSACTION_ERROR: 29189 03:51:00 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0xf0ffffffffffff, 0x20004080}, 0x0) 03:51:00 executing program 1 (fault-call:2 fault-nth:0): r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) 03:51:00 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x9, 0x800) ioctl$DRM_IOCTL_AGP_ACQUIRE(r1, 0x6430) [ 1758.194256] binder: 32412:32413 ioctl c018620b 0 returned -14 03:51:00 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000]}, 0x2c) 03:51:00 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:00 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x100000000000000, 0x20004080}, 0x0) [ 1758.285697] binder: 32412:32425 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1758.305303] binder: 32412:32425 BC_FREE_BUFFER u0000000000000000 no match [ 1758.319864] FAULT_INJECTION: forcing a failure. [ 1758.319864] name failslab, interval 1, probability 0, space 0, times 0 [ 1758.363974] CPU: 0 PID: 32424 Comm: syz-executor1 Not tainted 4.20.0 #167 [ 1758.368325] binder: 32412:32425 got reply transaction with bad transaction stack, transaction 5618 has target 32412:0 [ 1758.370976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1758.370984] Call Trace: [ 1758.371010] dump_stack+0x1d3/0x2c6 [ 1758.371034] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1758.371061] should_fail.cold.4+0xa/0x17 [ 1758.371081] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1758.406849] binder: 32412:32425 transaction failed 29201/-71, size 0-0 line 2756 [ 1758.411727] ? check_preemption_disabled+0x48/0x280 [ 1758.411751] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1758.411775] ? __lock_acquire+0x62f/0x4c20 [ 1758.411793] ? graph_lock+0x270/0x270 [ 1758.411810] ? graph_lock+0x270/0x270 [ 1758.441833] ? find_held_lock+0x36/0x1c0 [ 1758.445917] ? __lock_is_held+0xb5/0x140 [ 1758.450008] ? ___might_sleep+0x1ed/0x300 [ 1758.454182] ? arch_local_save_flags+0x40/0x40 [ 1758.458781] ? debug_smp_processor_id+0x1c/0x20 [ 1758.463474] __should_failslab+0x124/0x180 [ 1758.467726] should_failslab+0x9/0x14 [ 1758.471542] kmem_cache_alloc+0x2be/0x730 [ 1758.475713] ? debug_smp_processor_id+0x1c/0x20 [ 1758.480414] ep_insert+0x32d/0x1d40 [ 1758.484054] ? perf_trace_lock+0x7a0/0x7a0 [ 1758.488318] ? ep_send_events_proc+0xed0/0xed0 [ 1758.492917] ? lock_acquire+0x1ed/0x520 [ 1758.496902] ? __x64_sys_epoll_ctl+0x7d4/0x1080 [ 1758.501597] ? lock_release+0xa00/0xa00 [ 1758.505594] ? arch_local_save_flags+0x40/0x40 [ 1758.510196] ? find_held_lock+0x36/0x1c0 [ 1758.514292] ? __mutex_lock+0x85e/0x1700 [ 1758.518367] ? __x64_sys_epoll_ctl+0x7d4/0x1080 [ 1758.523053] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1758.528346] ? rcu_softirq_qs+0x20/0x20 [ 1758.528365] ? mutex_trylock+0x2b0/0x2b0 [ 1758.528390] ? __fget+0x4d1/0x740 [ 1758.528412] ? ksys_dup3+0x680/0x680 [ 1758.543601] ? find_held_lock+0x36/0x1c0 [ 1758.547703] ? __might_fault+0x12b/0x1e0 [ 1758.551783] ? __fget_light+0x2e9/0x430 [ 1758.555776] ? fget_raw+0x20/0x20 [ 1758.559245] ? kasan_check_write+0x14/0x20 [ 1758.563506] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 1758.568708] __x64_sys_epoll_ctl+0xeda/0x1080 [ 1758.573230] ? check_preemption_disabled+0x48/0x280 [ 1758.578261] ? __ia32_sys_epoll_create+0x70/0x70 [ 1758.583029] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1758.588569] ? fput+0x130/0x1a0 [ 1758.591855] ? do_syscall_64+0x9a/0x820 [ 1758.595836] ? lockdep_hardirqs_on+0x421/0x5c0 [ 1758.600422] ? __ia32_sys_read+0xb0/0xb0 [ 1758.604510] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1758.609882] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 1758.615357] do_syscall_64+0x1b9/0x820 [ 1758.619251] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1758.624624] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1758.629557] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1758.634405] ? trace_hardirqs_on_caller+0x310/0x310 [ 1758.639426] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1758.644459] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1758.649489] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1758.654348] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1758.659540] RIP: 0033:0x457759 [ 1758.662743] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1758.681647] RSP: 002b:00007f93d61d8c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 1758.689464] RAX: ffffffffffffffda RBX: 00007f93d61d8c90 RCX: 0000000000457759 [ 1758.696734] RDX: 0000000000000003 RSI: 0000000000000001 RDI: 0000000000000004 [ 1758.703998] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1758.711269] R10: 0000000020000280 R11: 0000000000000246 R12: 00007f93d61d96d4 [ 1758.718540] R13: 00000000004bdeba R14: 00000000004ce0c8 R15: 0000000000000005 03:51:01 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0xfff, 0x50000) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a85321, &(0x7f0000000100)={{0x100000000, 0x100000000}, 'port0\x00', 0x1e, 0x800, 0x0, 0x0, 0x7a, 0xe7b, 0x100000000, 0x0, 0x0, 0xffffffffffffffff}) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) prctl$PR_GET_ENDIAN(0x13, &(0x7f0000000040)) ioctl$UDMABUF_CREATE_LIST(r1, 0x40087543, &(0x7f00000000c0)={0x0, 0xfc, [{0xffffffffffffffff, 0x0, 0x0, 0x2000001000008}]}) 03:51:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x9effffff, 0x20004080}, 0x0) 03:51:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:01 executing program 1 (fault-call:2 fault-nth:1): r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) 03:51:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x7a00000000000000, 0x0}) 03:51:01 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}, 0x2c) [ 1758.963237] binder: send failed reply for transaction 5618 to 32412:32425 [ 1759.023517] binder: undelivered TRANSACTION_COMPLETE [ 1759.034666] binder: undelivered TRANSACTION_ERROR: 29201 [ 1759.056958] binder: undelivered TRANSACTION_ERROR: 29189 03:51:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0xf000, 0x20004080}, 0x0) 03:51:01 executing program 0: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80001}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x2, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6fe}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r2, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) [ 1759.080551] binder: 32448:32456 ioctl c018620b 0 returned -14 03:51:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1759.168550] binder: 32448:32461 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1759.195850] binder: 32448:32461 BC_FREE_BUFFER u0000000000000000 no match 03:51:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0xf0, 0x20004080}, 0x0) 03:51:01 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x2c) [ 1759.244422] binder: 32448:32461 got reply transaction with bad transaction stack, transaction 5621 has target 32448:0 03:51:01 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) 03:51:01 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000300)='/dev/udmabuf\x00', 0x2) r1 = fcntl$dupfd(r0, 0x406, r0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x0, 0x30}, &(0x7f0000000340)=0xc) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000380)={r2, 0x2, 0x7683, 0x9, 0x40000000, 0x7}, 0x14) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000040)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x8000, 0x0) sendmsg$kcm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)="5fbe0adf578e2df81227d994a9cf6e5515cf726a9db72c24306755bcae6aa8e44b75d9d91a50082c1fe6e7b7925debad97c197e893e0abbb8ea8eb2bb95644a727316f794d06489bcc4acf69d222fc6c892afab904b568ae1a94a831988858dfceaa3259467bbd889c65e29dbd93aee44a651ae686b0f82e6a8421fdf4f544fe989c8390c001b887e2ac647465e0ff360d3b80645e470df86709aba4a86bffe7cb8f66d364ba92b0c1a49d3fa874f9cc6a6f8d501bec3578d0422af43d817759f578a26dbbea22b8be19eda3e62697598b827a079ecf9881630fd19b5105d80d1d2ce022bc924eeda2924b23e31e03", 0xef}, {&(0x7f00000001c0)="5b1bd1c90f041d930163a7718fe39540e0a1c5217742a13c459ed0ed8566927a6889fb0e8047ec26fb1c30b671f2c45ea5e6d48656a945842d2bb2857fd2b88be45d9b4947acf64073c4a0876523d06a09761ca2442f0fdb09437c2557badbea83b30c364fb22efdc38e4c7d2356d6a0345b2574864c4156d25a4f926f7d69c8c298e4eb4e73b616f13af4f4b3c6ad0bd7cbd73208b632359c313c1c7b36a0936d25907c668daee3644c6ef38c6db450cb34ebd2b915af4c0f1a69c11cc42815f6151bdbe77df3c6500ae47dfac514a2a261633d63f3570913dac5", 0xdb}], 0x2, &(0x7f0000000480)=ANY=[@ANYBLOB="300000000000000017010000ffff000036f65b103904610a9e237c53f4f69c43a99f17fc3f04000000c5b50d0f141ff460000000000000000201000001000000617f4cd26786ba70e214569a6a1e9fbb537bbc52a4ffc83ac306f15c259a2e4acf29f1242295810b4d2ff0ac72cd98f1c668a731411b9d1c621b501486a3cd3f093e1ad70aa0eb4577000000000000006e5901ed14b778e6cada41392f61da08916d5dbbd23926480bd1135199b7b3961380c5f777bbf243a1dce8ed176d5a9dcd8397e0a14a8745f36bac83ee965f1d60558781c3a3670f0dbb2bd81733d87e4d366e6a5f1698ae0acfea5481d3a9587ea8a2c1a1eb6e5b6e3d91d96384e2d5630d9e9362442b2e8828115c6ccd77790608d00a336e3a96090dd0b1ed7eca84ba38b01f6d0397919e62a818978b86ff999f0743916aa763132092e943875aaa4ebc93ed687b8521b6a7633eb9ea8c8b748a54dee0b0e884811184"], 0x90}, 0x0) 03:51:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1759.351191] binder: 32448:32461 transaction failed 29201/-71, size 0-0 line 2756 03:51:01 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:01 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x4, r0, &(0x7f0000000280)={0x11}) 03:51:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x3f000000, 0x0}) 03:51:02 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000040)=ANY=[@ANYBLOB="0000000001000000", @ANYRES32, @ANYBLOB="fcff00800000000000000000000000000000616e0bfd0376b590bb0f0ef0b2fd0000"]) 03:51:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:02 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x7, r0, &(0x7f0000000280)={0x11}) 03:51:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:02 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x2c) [ 1759.866079] binder: send failed reply for transaction 5621 to 32448:32461 [ 1759.902210] binder: undelivered TRANSACTION_COMPLETE [ 1759.917950] binder: undelivered TRANSACTION_ERROR: 29201 [ 1759.938290] binder: undelivered TRANSACTION_ERROR: 29189 03:51:02 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x3, r0, &(0x7f0000000280)={0x11}) 03:51:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:02 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0) ioctl$KVM_DEASSIGN_PCI_DEVICE(r1, 0x4040ae72, &(0x7f00000001c0)={0x3, 0x9, 0xdbbf, 0x6, 0x39}) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB="0000601c01d70000", @ANYRES32, @ANYBLOB="00000001000000000000000000000000354062f7"]) r2 = dup2(r0, r0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f00000000c0)={0x5, 0x200, 0x0, 0x40, 0x0}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f0000000140)={r3, 0xff, 0x1}, 0x8) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000040)='ip6gre0\x00') 03:51:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1759.989941] binder: 32513:32515 ioctl c018620b 0 returned -14 [ 1760.064427] binder: 32513:32522 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1760.092606] binder: 32513:32522 BC_FREE_BUFFER u0000000000000000 no match 03:51:02 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x71, r0, &(0x7f0000000280)={0x11}) [ 1760.137805] binder: 32513:32522 got reply transaction with bad transaction stack, transaction 5624 has target 32513:0 03:51:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1760.189968] binder: 32513:32522 transaction failed 29201/-71, size 0-0 line 2756 03:51:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x48, 0x0}) 03:51:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:03 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000280)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000000)=ANY=[@ANYBLOB="0000000001000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000010000a3612c4a00004757a5dafa"]) 03:51:03 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x300, r0, &(0x7f0000000280)={0x11}) 03:51:03 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}, 0x2c) 03:51:03 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1760.786461] binder: send failed reply for transaction 5624 to 32513:32522 [ 1760.799849] binder: undelivered TRANSACTION_COMPLETE [ 1760.831291] binder: undelivered TRANSACTION_ERROR: 29201 03:51:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1760.851767] binder: undelivered TRANSACTION_ERROR: 29189 03:51:03 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x2, r0, &(0x7f0000000280)={0x11}) 03:51:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1760.902834] binder: 32558:32564 ioctl c018620b 0 returned -14 03:51:03 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x3, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000180)={@dev={0xfe, 0x80, [], 0x15}, 0x100000001, 0x2, 0x3, 0x4, 0x100000000, 0x2}, &(0x7f00000001c0)=0x20) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x20080, 0x0) sysinfo(&(0x7f0000001d00)=""/95) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000200), &(0x7f0000000100)=0x303) ioctl$UDMABUF_CREATE_LIST(r1, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB="0000000001000000", @ANYRES32, @ANYBLOB="00000000000100201b00"]) sendmsg$rds(r0, &(0x7f0000001cc0)={&(0x7f00000000c0)={0x2, 0x4e23, @rand_addr=0xffffffff}, 0x10, &(0x7f0000001780)=[{&(0x7f0000000240)}, {&(0x7f0000000280)=""/18, 0x12}, {&(0x7f00000002c0)=""/131, 0x83}, {&(0x7f0000000380)=""/115, 0x73}, {&(0x7f0000000400)=""/196, 0xc4}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f0000001500)=""/155, 0x9b}, {&(0x7f00000015c0)=""/127, 0x7f}, {&(0x7f0000001640)=""/107, 0x6b}, {&(0x7f00000016c0)=""/169, 0xa9}], 0xa, &(0x7f0000001b00)=[@cswp={0x58, 0x114, 0x7, {{0x3f, 0x8}, &(0x7f0000001840)=0x2, &(0x7f0000001880)=0x100, 0x8000, 0x4, 0x9, 0x6164, 0x10}}, @rdma_dest={0x18, 0x114, 0x2, {0x23, 0x89e}}, @fadd={0x58, 0x114, 0x6, {{0x4, 0xfffffffffffffbff}, &(0x7f00000018c0)=0x3, &(0x7f0000001900)=0x1ff, 0x22a5, 0x60, 0xffff, 0x1, 0x10, 0x7bf6}}, @fadd={0x58, 0x114, 0x6, {{0xfffffffffffffff8, 0x1000}, &(0x7f0000001940)=0x1, &(0x7f0000001980)=0x3, 0xffffffff00000000, 0x1, 0x600, 0xfffffffffffffff9, 0x61, 0x100000001}}, @mask_cswp={0x58, 0x114, 0x9, {{0xfffffffffffffff9, 0x80}, &(0x7f00000019c0)=0x8, &(0x7f0000001a00)=0xffffffffffff8001, 0x0, 0x3ff, 0xfffffffffffffffd, 0x4, 0x40, 0x6}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000001a40)=""/88, 0x58}, &(0x7f0000001ac0), 0x40}}], 0x1a8, 0x4}, 0x4) 03:51:03 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1760.980492] binder: 32558:32568 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1761.024680] binder: 32558:32568 BC_FREE_BUFFER u0000000000000000 no match [ 1761.063381] binder: 32558:32568 got reply transaction with bad transaction stack, transaction 5627 has target 32558:0 03:51:03 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x71}) [ 1761.106441] binder: 32558:32568 transaction failed 29201/-71, size 0-0 line 2756 03:51:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x20000000, 0x0}) 03:51:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:04 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x2c) 03:51:04 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000100)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000180)=ANY=[@ANYBLOB="0000000001000000", @ANYRES32, @ANYBLOB="0000080000000008000000000000000100000002a8eb539922042dc375bbda307676045295c2a38c08de20c21cc19c9248608bf6d3f312f80ca3c6a5effee7a23cac45095d19ac37e5ecd18a7ec7d22383df34bbdcd014fde6ed2a5051e7e13e0346461ee4a71dbc2bacf31673277c7c99c31c86e559e6b75fe02ea1a15bb58453019e810b74a8b50cd55aaa7b784063375eba929ea19d3940ce91f8105449d3d29e51c8e82b9c345c18b5e6814438fe300276c2425f40ff0266524be9f45efcaefa276702b4712eaaa9c42e3f6dc6811bb00b8a199851113928c4729510"]) 03:51:04 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:04 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x6000000000000000}) [ 1761.707475] binder: send failed reply for transaction 5627 to 32558:32568 [ 1761.758213] binder: undelivered TRANSACTION_COMPLETE 03:51:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:04 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x5000000}) [ 1761.821419] binder: 32602:32608 ioctl c018620b 0 returned -14 03:51:04 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB="fa72030000002000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x100, 0x0) ioctl$PIO_FONTX(r1, 0x4b6c, &(0x7f0000000140)="b747759396f57d2b8ca1a13bddfa7239148c9b57fcd6142725ff22e1b3b913bf12d6b4a866d1ca77a7ad66bdd4fc05bd2a874e0b8d77d1ae8b22113d8070ab3cf50b20a76b2bab714900f40a704fb5a69fabe3e6cca0c002ebee71877f8d10ad07eda15585770cb13d4cabe9f35b9133754ad9d9667e75916f13b9d0e37f3c80d8cc3b0b79033beec250d11a923d56623443f9265b6c5a5c0314b73b94148a408afd2d1012e9623b7058e238717fe6a964e194f120b2da48e45ca60487b5548a19ed0d7f") r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) ioctl$TIOCMBIS(r2, 0x5416, &(0x7f00000000c0)=0x7) 03:51:04 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1761.912501] binder: 32602:32618 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:51:04 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]}, 0x2c) [ 1761.955601] binder: 32602:32618 BC_FREE_BUFFER u0000000000000000 no match [ 1761.978298] binder: 32602:32618 got reply transaction with bad transaction stack, transaction 5630 has target 32602:0 03:51:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1762.007122] binder: 32602:32618 transaction failed 29201/-71, size 0-0 line 2756 03:51:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x3000000, 0x0}) 03:51:04 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x700}) 03:51:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:04 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:04 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200)='/dev/udmabuf\x00', 0x2) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhci\x00', 0x301002, 0x0) ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f00000000c0)="e863b647a9e173f8daaf5ed165173425d452b32129ccdc5c1ce230978d91591c18f46679142340731b441a852e21b1f6d63313404adb921852bbf66f6c817584f46ce5a3f0429e43435070372b52c3989d8dea893617294a6b095dd356c870827f718e4e1eb67e21ffa070dd5152c7003b6713e7e93a147ec01862915e1b8a72d243733886d466bfb6e19ea6ef163ec26f60cc14f44e0c86fca234385e30631e1070d82bf791d0be334d36d5729eb55a2c98038f82764d477f21b847c41cfa") ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:51:04 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}, 0x2c) [ 1762.585981] binder: send failed reply for transaction 5630 to 32602:32618 [ 1762.605454] binder: undelivered TRANSACTION_COMPLETE [ 1762.610613] binder_release_work: 2 callbacks suppressed [ 1762.610620] binder: undelivered TRANSACTION_ERROR: 29201 [ 1762.649310] binder: undelivered TRANSACTION_ERROR: 29189 03:51:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:05 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/udmabuf\x00', 0x2) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x403, 0x0) accept4$tipc(r1, &(0x7f00000000c0)=@id, &(0x7f0000000100)=0x10, 0x800) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000000)=ANY=[@ANYBLOB="0000000001000000e943deffffff7f8c22ab316acfc999629e5d93e49879ab5f48e0c942d00800c2959a836dc10ec51b93b1c13102840ff48d0000000000000040000000000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) [ 1762.699945] binder: 32651:32652 ioctl c018620b 0 returned -14 03:51:05 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x500}) 03:51:05 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1762.772489] binder: 32651:32661 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1762.795612] binder: 32651:32661 BC_FREE_BUFFER u0000000000000000 no match 03:51:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1762.849086] binder: 32651:32661 got reply transaction with bad transaction stack, transaction 5633 has target 32651:0 03:51:05 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x208100, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000100)=@raw={'raw\x00', 0x9, 0x3, 0x3a8, 0x1a0, 0x0, 0x1a0, 0x0, 0x1a0, 0x2d8, 0x2d8, 0x2d8, 0x2d8, 0x2d8, 0x3, &(0x7f00000000c0), {[{{@uncond, 0x0, 0x138, 0x1a0, 0x0, {}, [@common=@dst={0x48, 'dst\x00', 0x0, {0xe5e4, 0x1, 0x1, [0x20, 0xfffffffffffff800, 0x6, 0xd8, 0x400, 0x4000000000000000, 0x401, 0x2, 0x4, 0x400, 0x8, 0x3, 0x9, 0x3f, 0x6, 0xaa3a], 0xe}}, @common=@icmp6={0x28, 'icmp6\x00', 0x0, {0x3, 0x8000, 0x2, 0x1}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x8, 0x80000000, 0x8, 0x5958a886, 'snmp_trap\x00', 'syz0\x00', 0x7f}}}, {{@uncond, 0x0, 0x118, 0x138, 0x0, {}, [@common=@icmp6={0x28, 'icmp6\x00', 0x0, {0xb, 0x7, 0x2, 0x1}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x3}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x408) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{r1, 0x0, 0x0, 0x1000000}]}) [ 1762.898124] binder: 32651:32661 transaction failed 29201/-71, size 0-0 line 2756 03:51:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x7400, 0x0}) 03:51:05 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x3}) 03:51:05 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}, 0x2c) 03:51:05 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffff9c, 0x84, 0x6, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e21, @loopback}}}, &(0x7f0000000180)=0x84) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) 03:51:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:05 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1763.474142] binder: send failed reply for transaction 5633 to 32651:32661 03:51:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:05 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB="0000000001000000", @ANYRES32, @ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYPTR64=&(0x7f0000000000)=ANY=[@ANYRESOCT=0x0, @ANYRES32=r0], @ANYRESDEC=r0, @ANYRES64=0x0]]) [ 1763.533491] binder: undelivered TRANSACTION_COMPLETE [ 1763.536424] binder: 32697:32700 ioctl c018620b 0 returned -14 [ 1763.554447] binder: undelivered TRANSACTION_ERROR: 29201 [ 1763.569992] binder: undelivered TRANSACTION_ERROR: 29189 03:51:06 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:06 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x5}) [ 1763.652414] binder: 32697:32708 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1763.693312] binder: 32697:32708 BC_FREE_BUFFER u0000000000000000 no match 03:51:06 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000240)=ANY=[@ANYBLOB="0300000000000000765f3a813021b0d49293dd047e60ced012134d772d843c7bb8f5a559d6fd626d0a5f12d2250a0291225eda742e8e8444a4fae130a59e0aa1c8a9ee1c015b961b15c4eff0753c983d2c9747224004f9578b9ad5fea1bada0f0d009e2935ca5ef5099d67837ba73934d19cec1a22917aec544e94e89bdb8d0af80b618c1fd579f883ce00931885f33afe3bc44ba0a2b2ba2f988a585b3bf8172f5601692f7121d349be7ae21c78795c984df3bd8a086c68bcf3"]) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x200000) ioctl$VIDIOC_S_DV_TIMINGS(r1, 0xc0845657, &(0x7f00000000c0)={0x0, @reserved}) [ 1763.745072] binder: 32697:32708 got reply transaction with bad transaction stack, transaction 5636 has target 32697:0 [ 1763.775337] binder: 32697:32708 transaction failed 29201/-71, size 0-0 line 2756 03:51:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x200000000000000, 0x0}) 03:51:06 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x700000000000000}) 03:51:06 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:06 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x2c) 03:51:06 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/udmabuf\x00', 0x2) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x20000, 0x0) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f00000001c0)={0x9, @sdr={0x7a734f4e, 0x7}}) r2 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x2, 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000100)={0x4000000000000004, 0x26c, [{r2, 0x0, 0x11004, 0xfffffffff0000000}, {r2, 0x0, 0x10000, 0xfffff000}, {r2, 0x0, 0xfffffffffffff000, 0x1000000001000}, {r2, 0x0, 0xfffff000, 0x2002}, {r2, 0x0, 0x1ffc, 0xfffffffffffffffe}, {r2, 0x0, 0xfffffffffffff004, 0xfffffffff0018000}]}) [ 1764.345574] binder: send failed reply for transaction 5636 to 32697:32708 [ 1764.364686] binder: undelivered TRANSACTION_COMPLETE [ 1764.369855] binder: undelivered TRANSACTION_ERROR: 29201 [ 1764.411147] binder: undelivered TRANSACTION_ERROR: 29189 03:51:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:06 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x6000}) 03:51:06 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1764.484940] binder: 32747:32751 ioctl c018620b 0 returned -14 03:51:06 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000140)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{0xffffffffffffffff, 0x0, 0x0, 0x1000000}]}) io_setup(0x53, &(0x7f0000000000)=0x0) io_destroy(r1) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040)='/dev/udmabuf\x00', 0x2) [ 1764.570563] binder: 32747:32759 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1764.590673] binder: 32747:32759 BC_FREE_BUFFER u0000000000000000 no match 03:51:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:07 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1764.657044] binder: 32747:32759 got reply transaction with bad transaction stack, transaction 5639 has target 32747:0 [ 1764.691599] binder: 32747:32759 transaction failed 29201/-71, size 0-0 line 2756 03:51:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x4800000000000000, 0x0}) 03:51:07 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x600}) 03:51:07 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000]}, 0x2c) 03:51:07 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB="010000000128004f", @ANYRES32, @ANYBLOB="004e20a3f200003da700000100000200"]) 03:51:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:07 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1765.264089] binder: send failed reply for transaction 5639 to 32747:32759 [ 1765.319707] binder: undelivered TRANSACTION_COMPLETE [ 1765.334672] binder: undelivered TRANSACTION_ERROR: 29201 [ 1765.351535] binder: undelivered TRANSACTION_ERROR: 29189 03:51:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:07 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x7}) 03:51:07 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write$FUSE_OPEN(r1, &(0x7f00000000c0)={0x20, 0xfffffffffffffffe, 0x8, {0x0, 0x3}}, 0x20) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB="200000001d000000", @ANYRES32, @ANYBLOB="dac69ffc0a73ef2d0ba800000000000000000000"]) 03:51:07 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00p\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1765.383062] binder: 319:330 ioctl c018620b 0 returned -14 [ 1765.464341] binder: 319:338 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1765.489218] binder: 319:338 BC_FREE_BUFFER u0000000000000000 no match 03:51:07 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x2c) 03:51:07 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0xffffffff00000000}) [ 1765.527361] binder: 319:338 got reply transaction with bad transaction stack, transaction 5642 has target 319:0 [ 1765.568816] binder: 319:338 transaction failed 29201/-71, size 0-0 line 2756 03:51:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x6c00, 0x0}) 03:51:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:08 executing program 0: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) 03:51:08 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:08 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x200000000000000}) 03:51:08 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x2c) [ 1766.178263] binder: send failed reply for transaction 5642 to 319:338 [ 1766.234686] binder: undelivered TRANSACTION_COMPLETE [ 1766.239865] binder: undelivered TRANSACTION_ERROR: 29201 [ 1766.264834] binder: undelivered TRANSACTION_ERROR: 29189 03:51:08 executing program 0: ioctl$UDMABUF_CREATE_LIST(0xffffffffffffffff, 0x40087543, &(0x7f0000000080)=ANY=[@ANYBLOB="0008f377544116b7", @ANYRES32, @ANYBLOB="0000000000000000000000000000000100000000"]) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x1, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x0) 03:51:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:08 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x300000000000000}) [ 1766.300554] binder: 369:377 ioctl c018620b 0 returned -14 03:51:08 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1766.377376] binder: 369:381 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1766.384034] binder: 369:381 BC_FREE_BUFFER u0000000000000000 no match 03:51:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1766.466592] binder: 369:381 got reply transaction with bad transaction stack, transaction 5645 has target 369:0 [ 1766.489490] binder: 369:381 transaction failed 29201/-71, size 0-0 line 2756 03:51:08 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x600000000000000}) 03:51:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x2000, 0x0}) 03:51:09 executing program 0 (fault-call:3 fault-nth:0): r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab03) 03:51:09 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x2c) 03:51:09 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:09 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:09 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x7000000}) [ 1767.089144] binder: send failed reply for transaction 5645 to 369:381 [ 1767.121320] binder: undelivered TRANSACTION_COMPLETE [ 1767.135421] FAULT_INJECTION: forcing a failure. [ 1767.135421] name failslab, interval 1, probability 0, space 0, times 0 [ 1767.194646] CPU: 0 PID: 414 Comm: syz-executor0 Not tainted 4.20.0 #167 [ 1767.201467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1767.210938] Call Trace: [ 1767.213544] dump_stack+0x1d3/0x2c6 [ 1767.217191] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1767.222412] should_fail.cold.4+0xa/0x17 [ 1767.226505] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1767.231625] ? print_usage_bug+0xc0/0xc0 [ 1767.235701] ? graph_lock+0x270/0x270 [ 1767.239519] ? graph_lock+0x270/0x270 [ 1767.243329] ? __lock_acquire+0x62f/0x4c20 [ 1767.247578] ? find_held_lock+0x36/0x1c0 [ 1767.251642] ? __lock_is_held+0xb5/0x140 [ 1767.255723] ? ___might_sleep+0x1ed/0x300 [ 1767.259879] ? arch_local_save_flags+0x40/0x40 [ 1767.264466] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1767.270022] __should_failslab+0x124/0x180 [ 1767.274263] should_failslab+0x9/0x14 [ 1767.278072] kmem_cache_alloc+0x2be/0x730 [ 1767.282229] ? perf_trace_lock+0x7a0/0x7a0 [ 1767.286475] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 1767.291572] __kernfs_new_node+0x127/0x8d0 [ 1767.295820] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 1767.300582] ? graph_lock+0x270/0x270 [ 1767.304388] ? lock_acquire+0x1ed/0x520 [ 1767.308382] ? find_held_lock+0x36/0x1c0 [ 1767.312458] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1767.318118] ? check_preemption_disabled+0x48/0x280 [ 1767.323145] ? debug_smp_processor_id+0x1c/0x20 [ 1767.327824] ? perf_trace_lock_acquire+0x15b/0x800 [ 1767.332760] ? lock_downgrade+0x900/0x900 [ 1767.336909] ? check_preemption_disabled+0x48/0x280 [ 1767.341941] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1767.347225] ? rcu_softirq_qs+0x20/0x20 [ 1767.351208] ? graph_lock+0x270/0x270 [ 1767.355026] kernfs_new_node+0x95/0x120 [ 1767.359018] __kernfs_create_file+0x5a/0x340 [ 1767.363442] sysfs_add_file_mode_ns+0x222/0x530 [ 1767.368142] sysfs_create_file_ns+0x1a3/0x270 [ 1767.372649] ? sysfs_add_file_mode_ns+0x530/0x530 [ 1767.377498] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 1767.382954] ? __lock_is_held+0xb5/0x140 [ 1767.387029] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1767.392576] device_create_file+0xf4/0x1e0 [ 1767.396878] nbd_start_device+0x3a8/0xcd0 [ 1767.401040] ? sock_shutdown+0x250/0x250 [ 1767.405110] nbd_ioctl+0x6af/0xd40 [ 1767.408659] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1767.413598] ? nbd_release+0x140/0x140 [ 1767.417494] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1767.422433] ? kasan_check_read+0x11/0x20 [ 1767.426593] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1767.431878] ? rcu_softirq_qs+0x20/0x20 [ 1767.435868] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1767.441497] ? avc_has_extended_perms+0xab2/0x15a0 [ 1767.446441] ? nbd_release+0x140/0x140 [ 1767.450379] blkdev_ioctl+0xd8a/0x21b0 [ 1767.454283] ? blkpg_ioctl+0xc10/0xc10 [ 1767.458178] ? avc_ss_reset+0x190/0x190 [ 1767.462163] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1767.467096] ? kasan_check_read+0x11/0x20 [ 1767.471251] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1767.476535] ? rcu_softirq_qs+0x20/0x20 [ 1767.480550] ? ___might_sleep+0x1ed/0x300 [ 1767.484703] ? arch_local_save_flags+0x40/0x40 [ 1767.489339] block_ioctl+0xee/0x130 [ 1767.492974] ? blkdev_fallocate+0x400/0x400 [ 1767.497298] do_vfs_ioctl+0x1de/0x1790 [ 1767.501209] ? ioctl_preallocate+0x300/0x300 [ 1767.505625] ? selinux_file_mprotect+0x620/0x620 [ 1767.510412] ? __sb_end_write+0xd9/0x110 [ 1767.514487] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1767.520027] ? fput+0x130/0x1a0 [ 1767.523309] ? do_syscall_64+0x9a/0x820 [ 1767.527294] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1767.532834] ? security_file_ioctl+0x94/0xc0 [ 1767.537254] ksys_ioctl+0xa9/0xd0 [ 1767.540718] __x64_sys_ioctl+0x73/0xb0 [ 1767.544611] do_syscall_64+0x1b9/0x820 [ 1767.548502] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1767.553873] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1767.558804] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1767.563653] ? trace_hardirqs_on_caller+0x310/0x310 [ 1767.568766] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1767.573790] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1767.578820] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1767.583673] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1767.588867] RIP: 0033:0x457759 [ 1767.592075] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1767.610987] RSP: 002b:00007f89432e3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1767.618700] RAX: ffffffffffffffda RBX: 00007f89432e3c90 RCX: 0000000000457759 [ 1767.625972] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000004 [ 1767.633239] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 03:51:10 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1767.640507] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f89432e46d4 [ 1767.647777] R13: 00000000004c0b40 R14: 00000000004d2388 R15: 0000000000000005 03:51:10 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:10 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x1000000}) [ 1767.697493] binder: 420:425 ioctl c018620b 0 returned -14 03:51:10 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}, 0x2c) [ 1767.778780] block nbd0: device_create_file failed! [ 1767.798941] binder: 420:425 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1767.810976] block nbd0: shutting down sockets [ 1767.817323] binder: 420:425 BC_FREE_BUFFER u0000000000000000 no match 03:51:10 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1767.833203] binder: 420:425 got reply transaction with bad transaction stack, transaction 5648 has target 420:0 [ 1767.843812] binder: 420:425 transaction failed 29201/-71, size 0-0 line 2756 03:51:10 executing program 0 (fault-call:3 fault-nth:1): r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab03) 03:51:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x4800, 0x0}) 03:51:10 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x3f00}) 03:51:10 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1767.988248] binder: send failed reply for transaction 5648 to 420:425 [ 1767.998505] binder: undelivered TRANSACTION_COMPLETE [ 1767.998521] binder_release_work: 2 callbacks suppressed [ 1767.998525] binder: undelivered TRANSACTION_ERROR: 29201 [ 1768.051741] FAULT_INJECTION: forcing a failure. [ 1768.051741] name failslab, interval 1, probability 0, space 0, times 0 [ 1768.064169] CPU: 1 PID: 453 Comm: syz-executor0 Not tainted 4.20.0 #167 [ 1768.066826] binder: undelivered TRANSACTION_ERROR: 29189 [ 1768.070931] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1768.085780] Call Trace: [ 1768.088397] dump_stack+0x1d3/0x2c6 [ 1768.092061] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1768.097278] should_fail.cold.4+0xa/0x17 [ 1768.101368] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1768.106496] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1768.112046] ? check_preemption_disabled+0x48/0x280 [ 1768.117079] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1768.122629] ? check_preemption_disabled+0x48/0x280 [ 1768.127660] ? perf_trace_lock_acquire+0x15b/0x800 [ 1768.132610] ? debug_smp_processor_id+0x1c/0x20 [ 1768.137294] ? perf_trace_lock_acquire+0x15b/0x800 [ 1768.142242] ? perf_trace_lock+0x7a0/0x7a0 [ 1768.146495] ? perf_trace_lock+0x7a0/0x7a0 [ 1768.150769] ? print_usage_bug+0xc0/0xc0 [ 1768.154843] ? graph_lock+0x270/0x270 [ 1768.154864] ? __lock_acquire+0x62f/0x4c20 [ 1768.154885] ? print_usage_bug+0xc0/0xc0 [ 1768.154916] __should_failslab+0x124/0x180 [ 1768.162940] should_failslab+0x9/0x14 [ 1768.162958] kmem_cache_alloc+0x47/0x730 [ 1768.162975] ? lock_downgrade+0x900/0x900 [ 1768.163001] radix_tree_node_alloc.constprop.19+0x1f7/0x370 [ 1768.188964] idr_get_free+0x7a4/0xf70 [ 1768.192809] ? radix_tree_iter_tag_clear+0x90/0x90 [ 1768.197761] ? __save_stack_trace+0x8d/0xf0 [ 1768.202099] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1768.207646] ? check_preemption_disabled+0x48/0x280 [ 1768.212680] ? debug_smp_processor_id+0x1c/0x20 [ 1768.217374] ? perf_trace_lock_acquire+0x15b/0x800 [ 1768.222843] ? save_stack+0xa9/0xd0 [ 1768.226504] ? sysfs_add_file_mode_ns+0x222/0x530 [ 1768.231372] ? device_create_file+0xf4/0x1e0 [ 1768.235796] ? nbd_start_device+0x3a8/0xcd0 [ 1768.240125] ? nbd_ioctl+0x6af/0xd40 [ 1768.243844] ? blkdev_ioctl+0xd8a/0x21b0 [ 1768.247922] ? block_ioctl+0xee/0x130 03:51:10 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:10 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x4000}) 03:51:10 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000]}, 0x2c) 03:51:10 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1768.251736] ? ksys_ioctl+0xa9/0xd0 [ 1768.255376] ? __x64_sys_ioctl+0x73/0xb0 [ 1768.259448] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1768.264839] idr_alloc_u32+0x1d4/0x3a0 [ 1768.268749] ? __fprop_inc_percpu_max+0x2d0/0x2d0 [ 1768.273608] ? lock_acquire+0x1ed/0x520 [ 1768.277594] ? __kernfs_new_node+0x14e/0x8d0 [ 1768.282035] idr_alloc_cyclic+0x166/0x350 [ 1768.286210] ? idr_alloc+0x1b0/0x1b0 [ 1768.289938] ? __radix_tree_preload+0x1f7/0x280 [ 1768.294619] __kernfs_new_node+0x1ee/0x8d0 [ 1768.294640] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 1768.294658] ? graph_lock+0x270/0x270 [ 1768.294673] ? lock_acquire+0x1ed/0x520 [ 1768.294694] ? find_held_lock+0x36/0x1c0 [ 1768.315478] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1768.321025] ? check_preemption_disabled+0x48/0x280 [ 1768.326063] ? debug_smp_processor_id+0x1c/0x20 [ 1768.327741] binder: 458:466 ioctl c018620b 0 returned -14 [ 1768.330739] ? perf_trace_lock_acquire+0x15b/0x800 [ 1768.330758] ? lock_downgrade+0x900/0x900 [ 1768.330773] ? check_preemption_disabled+0x48/0x280 [ 1768.330795] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1768.330812] ? rcu_softirq_qs+0x20/0x20 [ 1768.359665] ? graph_lock+0x270/0x270 [ 1768.363492] kernfs_new_node+0x95/0x120 [ 1768.367492] __kernfs_create_file+0x5a/0x340 [ 1768.371935] sysfs_add_file_mode_ns+0x222/0x530 [ 1768.376627] sysfs_create_file_ns+0x1a3/0x270 [ 1768.381148] ? sysfs_add_file_mode_ns+0x530/0x530 [ 1768.386025] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 1768.391488] ? __lock_is_held+0xb5/0x140 [ 1768.395563] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 03:51:10 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1768.401123] device_create_file+0xf4/0x1e0 [ 1768.405381] nbd_start_device+0x3a8/0xcd0 [ 1768.409559] ? sock_shutdown+0x250/0x250 [ 1768.413663] nbd_ioctl+0x6af/0xd40 [ 1768.417219] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1768.422189] ? nbd_release+0x140/0x140 [ 1768.426091] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1768.431030] ? kasan_check_read+0x11/0x20 [ 1768.435189] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1768.440495] ? rcu_softirq_qs+0x20/0x20 [ 1768.444499] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1768.450056] ? avc_has_extended_perms+0xab2/0x15a0 [ 1768.455002] ? nbd_release+0x140/0x140 [ 1768.458907] blkdev_ioctl+0xd8a/0x21b0 [ 1768.461101] binder: 458:477 transaction failed 29189/-22, size 24-0 line 2834 [ 1768.462803] ? blkpg_ioctl+0xc10/0xc10 [ 1768.462833] ? avc_ss_reset+0x190/0x190 [ 1768.462854] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1768.462866] ? kasan_check_read+0x11/0x20 [ 1768.462888] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1768.492336] ? rcu_softirq_qs+0x20/0x20 [ 1768.496352] ? ___might_sleep+0x1ed/0x300 [ 1768.500515] ? arch_local_save_flags+0x40/0x40 [ 1768.505119] block_ioctl+0xee/0x130 [ 1768.508758] ? blkdev_fallocate+0x400/0x400 [ 1768.513089] do_vfs_ioctl+0x1de/0x1790 [ 1768.516992] ? ioctl_preallocate+0x300/0x300 [ 1768.518474] binder: 458:479 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1768.521410] ? selinux_file_mprotect+0x620/0x620 [ 1768.521434] ? __sb_end_write+0xd9/0x110 [ 1768.521455] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1768.521470] ? fput+0x130/0x1a0 [ 1768.542428] ? do_syscall_64+0x9a/0x820 [ 1768.542452] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1768.542470] ? security_file_ioctl+0x94/0xc0 [ 1768.549717] ksys_ioctl+0xa9/0xd0 [ 1768.549740] __x64_sys_ioctl+0x73/0xb0 [ 1768.549760] do_syscall_64+0x1b9/0x820 [ 1768.549778] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1768.576275] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1768.581219] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1768.586092] ? trace_hardirqs_on_caller+0x310/0x310 [ 1768.591120] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1768.591140] ? prepare_exit_to_usermode+0x291/0x3b0 03:51:10 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:10 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x4}) [ 1768.591164] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1768.591191] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1768.591207] RIP: 0033:0x457759 [ 1768.612989] binder: 458:479 BC_FREE_BUFFER u0000000000000000 no match [ 1768.614501] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1768.614511] RSP: 002b:00007f89432e3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1768.614528] RAX: ffffffffffffffda RBX: 00007f89432e3c90 RCX: 0000000000457759 [ 1768.614537] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000004 [ 1768.614547] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1768.614557] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f89432e46d4 [ 1768.614566] R13: 00000000004c0b40 R14: 00000000004d2388 R15: 0000000000000005 03:51:11 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1768.712279] binder: 458:479 got reply transaction with no transaction stack [ 1768.745091] binder: 458:479 transaction failed 29201/-71, size 0-0 line 2741 [ 1768.811940] block nbd0: Receive control failed (result -22) [ 1768.838900] block nbd0: shutting down sockets 03:51:11 executing program 0 (fault-call:3 fault-nth:2): r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab03) [ 1768.940742] FAULT_INJECTION: forcing a failure. [ 1768.940742] name failslab, interval 1, probability 0, space 0, times 0 [ 1768.953025] CPU: 0 PID: 503 Comm: syz-executor0 Not tainted 4.20.0 #167 [ 1768.959802] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1768.969157] Call Trace: [ 1768.971742] dump_stack+0x1d3/0x2c6 [ 1768.975369] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1768.980561] should_fail.cold.4+0xa/0x17 [ 1768.984626] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1768.989719] ? sysfs_create_file_ns+0x1a3/0x270 [ 1768.994382] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1768.999738] ? graph_lock+0x270/0x270 [ 1769.003540] ? find_held_lock+0x36/0x1c0 [ 1769.007592] ? __lock_is_held+0xb5/0x140 [ 1769.011648] ? ___might_sleep+0x1ed/0x300 [ 1769.015784] ? arch_local_save_flags+0x40/0x40 [ 1769.020358] ? perf_trace_lock_acquire+0x15b/0x800 [ 1769.025278] ? kmem_cache_alloc+0x33a/0x730 [ 1769.029654] __should_failslab+0x124/0x180 [ 1769.033889] should_failslab+0x9/0x14 [ 1769.037684] kmem_cache_alloc+0x2be/0x730 [ 1769.041824] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1769.047367] ? graph_lock+0x270/0x270 [ 1769.051188] __d_alloc+0xc8/0xb90 [ 1769.054644] ? shrink_dcache_for_umount+0x2b0/0x2b0 [ 1769.059650] ? mark_held_locks+0x130/0x130 [ 1769.063898] ? mark_held_locks+0x130/0x130 [ 1769.068173] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1769.073709] ? check_preemption_disabled+0x48/0x280 [ 1769.078722] ? debug_smp_processor_id+0x1c/0x20 [ 1769.083398] ? perf_trace_lock_acquire+0x15b/0x800 [ 1769.088353] d_alloc+0x96/0x380 [ 1769.091650] ? debug_smp_processor_id+0x1c/0x20 [ 1769.096370] ? __d_alloc+0xb90/0xb90 [ 1769.099426] binder: undelivered TRANSACTION_ERROR: 29189 [ 1769.100098] d_alloc_parallel+0x15a/0x1f40 [ 1769.105825] binder: undelivered TRANSACTION_ERROR: 29201 [ 1769.109776] ? find_held_lock+0x36/0x1c0 [ 1769.109794] ? graph_lock+0x270/0x270 [ 1769.109812] ? find_held_lock+0x36/0x1c0 [ 1769.109834] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1769.127205] ? __d_lookup_rcu+0xaa0/0xaa0 [ 1769.136979] ? find_held_lock+0x36/0x1c0 03:51:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x60, 0x0}) 03:51:11 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:11 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}, 0x2c) 03:51:11 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x6}) 03:51:11 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1769.137003] ? __d_lookup+0x591/0x9e0 [ 1769.137021] ? lock_downgrade+0x900/0x900 [ 1769.137041] ? check_preemption_disabled+0x48/0x280 [ 1769.154030] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1769.158974] ? kasan_check_read+0x11/0x20 [ 1769.163143] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1769.168436] ? rcu_softirq_qs+0x20/0x20 [ 1769.172444] ? __lockdep_init_map+0x105/0x590 [ 1769.176960] ? __lockdep_init_map+0x105/0x590 [ 1769.181479] ? lockdep_init_map+0x9/0x10 [ 1769.185553] ? __init_waitqueue_head+0x9e/0x150 03:51:11 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1769.190237] ? init_wait_entry+0x1c0/0x1c0 [ 1769.194493] ? d_lookup+0x255/0x300 [ 1769.198127] ? d_lookup+0x255/0x300 [ 1769.201764] ? lockdep_hardirqs_on+0x421/0x5c0 [ 1769.206468] __lookup_slow+0x1e6/0x540 [ 1769.210373] ? vfs_unlink+0x510/0x510 [ 1769.214189] ? d_lookup+0x20d/0x300 [ 1769.217959] lookup_one_len+0x1d8/0x220 [ 1769.221950] ? lookup_one_len_unlocked+0x100/0x100 [ 1769.227022] ? down_write+0x8a/0x130 [ 1769.227100] ? start_creating+0xb1/0x200 [ 1769.227118] ? down_read+0x120/0x120 [ 1769.234874] ? mntput+0x74/0xa0 [ 1769.234899] start_creating+0xc6/0x200 [ 1769.234916] debugfs_create_dir+0x23/0x3c0 [ 1769.234936] nbd_start_device+0x43b/0xcd0 [ 1769.234960] ? sock_shutdown+0x250/0x250 [ 1769.258352] nbd_ioctl+0x6af/0xd40 [ 1769.261916] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1769.266873] ? nbd_release+0x140/0x140 [ 1769.270865] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1769.275806] ? kasan_check_read+0x11/0x20 [ 1769.279974] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1769.285280] ? rcu_softirq_qs+0x20/0x20 [ 1769.289298] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1769.294853] ? avc_has_extended_perms+0xab2/0x15a0 [ 1769.299794] ? nbd_release+0x140/0x140 [ 1769.303686] blkdev_ioctl+0xd8a/0x21b0 [ 1769.307592] ? blkpg_ioctl+0xc10/0xc10 [ 1769.311486] ? avc_ss_reset+0x190/0x190 [ 1769.315470] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1769.320430] ? kasan_check_read+0x11/0x20 [ 1769.324606] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1769.329877] ? rcu_softirq_qs+0x20/0x20 [ 1769.333885] ? ___might_sleep+0x1ed/0x300 [ 1769.338036] ? arch_local_save_flags+0x40/0x40 [ 1769.342719] block_ioctl+0xee/0x130 [ 1769.346356] ? blkdev_fallocate+0x400/0x400 [ 1769.350688] do_vfs_ioctl+0x1de/0x1790 [ 1769.354584] ? ioctl_preallocate+0x300/0x300 [ 1769.359000] ? selinux_file_mprotect+0x620/0x620 [ 1769.363769] ? __sb_end_write+0xd9/0x110 [ 1769.367846] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1769.373376] ? fput+0x130/0x1a0 [ 1769.376677] ? do_syscall_64+0x9a/0x820 [ 1769.380666] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1769.386210] ? security_file_ioctl+0x94/0xc0 [ 1769.390626] ksys_ioctl+0xa9/0xd0 [ 1769.394100] __x64_sys_ioctl+0x73/0xb0 [ 1769.397993] do_syscall_64+0x1b9/0x820 [ 1769.401883] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1769.407251] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1769.412193] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1769.417041] ? trace_hardirqs_on_caller+0x310/0x310 [ 1769.422065] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1769.427086] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1769.432113] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1769.437055] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1769.442244] RIP: 0033:0x457759 [ 1769.445471] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1769.464373] RSP: 002b:00007f89432e3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1769.472084] RAX: ffffffffffffffda RBX: 00007f89432e3c90 RCX: 0000000000457759 [ 1769.479355] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000004 [ 1769.486628] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1769.493896] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f89432e46d4 [ 1769.501171] R13: 00000000004c0b40 R14: 00000000004d2388 R15: 0000000000000005 03:51:11 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x300}) [ 1769.538089] block nbd0: Failed to create debugfs dir for 'nbd0' [ 1769.544697] block nbd0: Receive control failed (result -22) [ 1769.560661] block nbd0: shutting down sockets 03:51:11 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1769.604577] binder: 504:520 ioctl c018620b 0 returned -14 03:51:12 executing program 0 (fault-call:3 fault-nth:3): r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab03) 03:51:12 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1769.650629] binder: 504:525 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:51:12 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x2c) [ 1769.718945] binder: 504:525 BC_FREE_BUFFER u0000000000000000 no match 03:51:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1769.763118] binder: 504:525 got reply transaction with bad transaction stack, transaction 5654 has target 504:0 [ 1769.812090] binder: 504:525 transaction failed 29201/-71, size 0-0 line 2756 [ 1769.888746] FAULT_INJECTION: forcing a failure. [ 1769.888746] name failslab, interval 1, probability 0, space 0, times 0 [ 1769.901733] CPU: 0 PID: 544 Comm: syz-executor0 Not tainted 4.20.0 #167 [ 1769.908518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1769.917884] Call Trace: [ 1769.920492] dump_stack+0x1d3/0x2c6 [ 1769.924138] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1769.929353] should_fail.cold.4+0xa/0x17 [ 1769.933430] ? fault_create_debugfs_attr+0x1f0/0x1f0 03:51:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0xfdfdffff00000000, 0x0}) 03:51:12 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x3f00000000000000}) 03:51:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x2000000) [ 1769.935844] binder: send failed reply for transaction 5654 to 504:525 [ 1769.938540] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1769.938574] ? graph_lock+0x270/0x270 [ 1769.954209] ? __lockdep_init_map+0x105/0x590 [ 1769.958720] ? find_held_lock+0x36/0x1c0 [ 1769.958742] ? __lock_is_held+0xb5/0x140 [ 1769.958773] ? ___might_sleep+0x1ed/0x300 [ 1769.971026] ? arch_local_save_flags+0x40/0x40 [ 1769.975625] __should_failslab+0x124/0x180 [ 1769.979853] should_failslab+0x9/0x14 [ 1769.983642] kmem_cache_alloc+0x2be/0x730 [ 1769.987787] alloc_inode+0xb2/0x190 [ 1769.991404] new_inode_pseudo+0x71/0x1a0 [ 1769.995454] ? prune_icache_sb+0x1c0/0x1c0 [ 1769.999682] ? down_read+0x120/0x120 [ 1770.003383] ? mntput+0x74/0xa0 [ 1770.006690] new_inode+0x1c/0x40 [ 1770.010051] debugfs_get_inode+0x19/0x120 [ 1770.014207] debugfs_create_dir+0x75/0x3c0 [ 1770.018443] nbd_start_device+0x43b/0xcd0 [ 1770.022586] ? sock_shutdown+0x250/0x250 [ 1770.026644] nbd_ioctl+0x6af/0xd40 [ 1770.030177] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1770.035100] ? nbd_release+0x140/0x140 [ 1770.038994] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1770.043912] ? kasan_check_read+0x11/0x20 [ 1770.048050] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1770.053315] ? rcu_softirq_qs+0x20/0x20 [ 1770.057777] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1770.063307] ? avc_has_extended_perms+0xab2/0x15a0 [ 1770.068234] ? nbd_release+0x140/0x140 [ 1770.072116] blkdev_ioctl+0xd8a/0x21b0 [ 1770.075997] ? blkpg_ioctl+0xc10/0xc10 [ 1770.079871] ? avc_ss_reset+0x190/0x190 [ 1770.083847] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1770.088769] ? kasan_check_read+0x11/0x20 [ 1770.092907] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1770.098172] ? rcu_softirq_qs+0x20/0x20 [ 1770.102153] ? ___might_sleep+0x1ed/0x300 [ 1770.106301] ? arch_local_save_flags+0x40/0x40 [ 1770.110883] block_ioctl+0xee/0x130 [ 1770.114505] ? blkdev_fallocate+0x400/0x400 [ 1770.118819] do_vfs_ioctl+0x1de/0x1790 [ 1770.122699] ? ioctl_preallocate+0x300/0x300 [ 1770.127102] ? selinux_file_mprotect+0x620/0x620 [ 1770.131852] ? __sb_end_write+0xd9/0x110 [ 1770.135909] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1770.141432] ? fput+0x130/0x1a0 [ 1770.144701] ? do_syscall_64+0x9a/0x820 [ 1770.148672] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1770.154215] ? security_file_ioctl+0x94/0xc0 [ 1770.158627] ksys_ioctl+0xa9/0xd0 [ 1770.162076] __x64_sys_ioctl+0x73/0xb0 [ 1770.165954] do_syscall_64+0x1b9/0x820 [ 1770.169842] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1770.175206] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1770.180138] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1770.184973] ? trace_hardirqs_on_caller+0x310/0x310 [ 1770.189980] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1770.194990] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1770.200001] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1770.204839] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1770.210027] RIP: 0033:0x457759 [ 1770.213219] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1770.232473] RSP: 002b:00007f89432e3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1770.240609] RAX: ffffffffffffffda RBX: 00007f89432e3c90 RCX: 0000000000457759 [ 1770.247866] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000004 [ 1770.255124] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1770.262384] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f89432e46d4 [ 1770.269640] R13: 00000000004c0b40 R14: 00000000004d2388 R15: 0000000000000005 03:51:12 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1770.284968] block nbd0: Failed to create debugfs dir for 'nbd0' [ 1770.291314] block nbd0: Receive control failed (result -22) [ 1770.331646] block nbd0: shutting down sockets 03:51:12 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x2c) 03:51:12 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x100000000000000}) [ 1770.395243] binder: 546:560 ioctl c018620b 0 returned -14 03:51:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x9effffff) 03:51:12 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1770.484235] binder: 546:566 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1770.504794] binder: 546:566 BC_FREE_BUFFER u0000000000000000 no match [ 1770.534846] binder: 546:566 got reply transaction with bad transaction stack, transaction 5657 has target 546:0 [ 1770.584636] binder: 546:566 transaction failed 29201/-71, size 0-0 line 2756 [ 1770.610871] binder: undelivered TRANSACTION_COMPLETE [ 1770.617900] binder: undelivered TRANSACTION_ERROR: 29201 [ 1770.633644] binder: undelivered TRANSACTION_ERROR: 29189 03:51:13 executing program 0 (fault-call:3 fault-nth:4): r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab03) 03:51:13 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}, 0x2c) 03:51:13 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x6000000}) 03:51:13 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x8) [ 1770.772342] FAULT_INJECTION: forcing a failure. [ 1770.772342] name failslab, interval 1, probability 0, space 0, times 0 [ 1770.812553] CPU: 1 PID: 592 Comm: syz-executor0 Not tainted 4.20.0 #167 [ 1770.819362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1770.828730] Call Trace: [ 1770.831334] dump_stack+0x1d3/0x2c6 [ 1770.835068] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1770.840289] should_fail.cold.4+0xa/0x17 [ 1770.844364] ? find_held_lock+0x36/0x1c0 [ 1770.848442] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1770.853559] ? is_bpf_text_address+0xac/0x170 [ 1770.858068] ? lock_downgrade+0x900/0x900 [ 1770.862223] ? check_preemption_disabled+0x48/0x280 [ 1770.867252] ? graph_lock+0x270/0x270 [ 1770.871054] ? kasan_check_read+0x11/0x20 [ 1770.875212] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1770.880499] ? rcu_softirq_qs+0x20/0x20 [ 1770.884485] ? rcu_softirq_qs+0x20/0x20 [ 1770.888465] ? unwind_dump+0x190/0x190 [ 1770.892380] ? __lock_is_held+0xb5/0x140 [ 1770.896477] ? unwind_get_return_address+0x61/0xa0 [ 1770.901419] ? ___might_sleep+0x1ed/0x300 [ 1770.905581] ? arch_local_save_flags+0x40/0x40 [ 1770.910195] __should_failslab+0x124/0x180 [ 1770.914453] should_failslab+0x9/0x14 [ 1770.918271] kmem_cache_alloc+0x2be/0x730 [ 1770.922430] ? new_inode+0x1c/0x40 [ 1770.925976] ? debugfs_get_inode+0x19/0x120 [ 1770.930305] ? debugfs_create_dir+0x75/0x3c0 [ 1770.934721] ? nbd_start_device+0x43b/0xcd0 [ 1770.939064] ? nbd_ioctl+0x6af/0xd40 [ 1770.942785] ? blkdev_ioctl+0xd8a/0x21b0 [ 1770.946856] ? block_ioctl+0xee/0x130 [ 1770.950669] ? do_vfs_ioctl+0x1de/0x1790 [ 1770.954747] selinux_inode_alloc_security+0x107/0x3a0 [ 1770.959950] ? inode_free_rcu+0x20/0x20 [ 1770.963944] ? __put_user_ns+0x60/0x60 [ 1770.967868] ? kasan_check_read+0x11/0x20 [ 1770.972101] security_inode_alloc+0x73/0xd0 [ 1770.976417] inode_init_always+0x68f/0xd80 [ 1770.980643] ? get_nr_inodes+0x120/0x120 [ 1770.984706] ? __lock_is_held+0xb5/0x140 [ 1770.988790] ? rcu_read_lock_sched_held+0x108/0x120 [ 1770.993795] ? kmem_cache_alloc+0x33a/0x730 [ 1770.998124] alloc_inode+0x80/0x190 [ 1771.001751] new_inode_pseudo+0x71/0x1a0 [ 1771.005804] ? prune_icache_sb+0x1c0/0x1c0 [ 1771.010028] ? down_read+0x120/0x120 [ 1771.013729] ? mntput+0x74/0xa0 [ 1771.017006] new_inode+0x1c/0x40 [ 1771.020360] debugfs_get_inode+0x19/0x120 [ 1771.024508] debugfs_create_dir+0x75/0x3c0 [ 1771.028734] nbd_start_device+0x43b/0xcd0 [ 1771.032873] ? sock_shutdown+0x250/0x250 [ 1771.036931] nbd_ioctl+0x6af/0xd40 [ 1771.040465] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1771.045391] ? nbd_release+0x140/0x140 [ 1771.049268] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1771.054186] ? kasan_check_read+0x11/0x20 [ 1771.058327] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1771.063591] ? rcu_softirq_qs+0x20/0x20 [ 1771.067567] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1771.073093] ? avc_has_extended_perms+0xab2/0x15a0 [ 1771.078011] ? nbd_release+0x140/0x140 [ 1771.081999] blkdev_ioctl+0xd8a/0x21b0 [ 1771.085879] ? blkpg_ioctl+0xc10/0xc10 [ 1771.089757] ? avc_ss_reset+0x190/0x190 [ 1771.093722] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1771.098641] ? kasan_check_read+0x11/0x20 [ 1771.102778] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1771.108046] ? rcu_softirq_qs+0x20/0x20 [ 1771.112025] ? ___might_sleep+0x1ed/0x300 [ 1771.116175] ? arch_local_save_flags+0x40/0x40 [ 1771.120756] block_ioctl+0xee/0x130 [ 1771.124371] ? blkdev_fallocate+0x400/0x400 [ 1771.128691] do_vfs_ioctl+0x1de/0x1790 [ 1771.132587] ? ioctl_preallocate+0x300/0x300 [ 1771.137008] ? selinux_file_mprotect+0x620/0x620 [ 1771.141755] ? __sb_end_write+0xd9/0x110 [ 1771.145825] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1771.151349] ? fput+0x130/0x1a0 [ 1771.154619] ? do_syscall_64+0x9a/0x820 [ 1771.158588] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1771.164134] ? security_file_ioctl+0x94/0xc0 [ 1771.168537] ksys_ioctl+0xa9/0xd0 [ 1771.171998] __x64_sys_ioctl+0x73/0xb0 [ 1771.175878] do_syscall_64+0x1b9/0x820 [ 1771.179860] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1771.185215] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1771.190222] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1771.195057] ? trace_hardirqs_on_caller+0x310/0x310 [ 1771.200066] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1771.205072] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1771.210085] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1771.214922] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1771.220117] RIP: 0033:0x457759 [ 1771.223825] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1771.242733] RSP: 002b:00007f89432e3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1771.250434] RAX: ffffffffffffffda RBX: 00007f89432e3c90 RCX: 0000000000457759 [ 1771.257692] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000004 [ 1771.264952] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1771.272208] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f89432e46d4 [ 1771.279467] R13: 00000000004c0b40 R14: 00000000004d2388 R15: 0000000000000005 [ 1771.294623] block nbd0: Failed to create debugfs dir for 'nbd0' 03:51:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x2000000000000000, 0x0}) 03:51:13 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:13 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x40000000}) 03:51:13 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x100000000000000) 03:51:13 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]}, 0x2c) [ 1771.319647] block nbd0: Receive control failed (result -22) [ 1771.329193] binder: send failed reply for transaction 5657 to 546:566 [ 1771.337735] block nbd0: shutting down sockets [ 1771.343316] binder: undelivered TRANSACTION_COMPLETE 03:51:13 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x800000000000000) [ 1771.384170] binder: undelivered TRANSACTION_ERROR: 29201 [ 1771.412358] binder: undelivered TRANSACTION_ERROR: 29189 03:51:13 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x3000000}) 03:51:13 executing program 0 (fault-call:3 fault-nth:5): r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab03) [ 1771.459082] binder: 606:612 ioctl c018620b 0 returned -14 03:51:13 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0xf0ffffff) 03:51:13 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1771.532898] binder: 606:617 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1771.564620] binder: 606:617 BC_FREE_BUFFER u0000000000000000 no match [ 1771.575478] binder: 606:617 got reply transaction with bad transaction stack, transaction 5660 has target 606:0 [ 1771.621953] binder: 606:617 transaction failed 29201/-71, size 0-0 line 2756 [ 1771.636871] FAULT_INJECTION: forcing a failure. [ 1771.636871] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1771.666752] CPU: 1 PID: 621 Comm: syz-executor0 Not tainted 4.20.0 #167 [ 1771.673567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1771.683024] Call Trace: [ 1771.685636] dump_stack+0x1d3/0x2c6 [ 1771.689291] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1771.694490] ? debug_smp_processor_id+0x1c/0x20 [ 1771.699178] ? perf_trace_lock_acquire+0x15b/0x800 [ 1771.704162] should_fail.cold.4+0xa/0x17 [ 1771.708241] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1771.713360] ? graph_lock+0x270/0x270 [ 1771.717175] ? graph_lock+0x270/0x270 [ 1771.720988] ? mark_held_locks+0x130/0x130 [ 1771.725235] ? mark_held_locks+0x130/0x130 [ 1771.729492] ? __lock_is_held+0xb5/0x140 [ 1771.733564] ? kill_ioctx+0x150/0x4d0 [ 1771.737385] ? ___might_sleep+0x1ed/0x300 [ 1771.741546] ? lock_release+0xa00/0xa00 [ 1771.745536] ? arch_local_save_flags+0x40/0x40 [ 1771.750145] ? __might_sleep+0x95/0x190 [ 1771.754146] __alloc_pages_nodemask+0x366/0xea0 [ 1771.758851] ? __alloc_pages_slowpath+0x2df0/0x2df0 [ 1771.763902] ? find_held_lock+0x36/0x1c0 [ 1771.767991] ? lock_downgrade+0x900/0x900 [ 1771.772151] ? kasan_check_read+0x11/0x20 [ 1771.776292] ? do_raw_spin_unlock+0xa7/0x330 [ 1771.780689] ? do_raw_spin_trylock+0x270/0x270 [ 1771.785263] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 1771.790805] alloc_pages_current+0x10c/0x210 [ 1771.795207] __get_free_pages+0xc/0x40 [ 1771.799096] inode_doinit_with_dentry+0xb8a/0x1480 [ 1771.804635] ? selinux_capset+0x120/0x120 [ 1771.808774] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1771.814304] ? timespec64_trunc+0xea/0x180 [ 1771.818529] ? inode_init_owner+0x340/0x340 [ 1771.822841] ? _raw_spin_unlock+0x2c/0x50 [ 1771.826985] ? current_time+0x131/0x1b0 [ 1771.830955] selinux_d_instantiate+0x27/0x40 [ 1771.835439] security_d_instantiate+0x5c/0xf0 [ 1771.839939] d_instantiate+0x5e/0xa0 [ 1771.843649] debugfs_create_dir+0x120/0x3c0 [ 1771.847963] nbd_start_device+0x43b/0xcd0 [ 1771.852110] ? sock_shutdown+0x250/0x250 [ 1771.856169] nbd_ioctl+0x6af/0xd40 [ 1771.859703] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1771.864634] ? nbd_release+0x140/0x140 [ 1771.868512] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1771.873430] ? kasan_check_read+0x11/0x20 [ 1771.877571] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1771.882838] ? rcu_softirq_qs+0x20/0x20 [ 1771.886902] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1771.892431] ? avc_has_extended_perms+0xab2/0x15a0 [ 1771.897351] ? nbd_release+0x140/0x140 [ 1771.901229] blkdev_ioctl+0xd8a/0x21b0 [ 1771.905197] ? blkpg_ioctl+0xc10/0xc10 [ 1771.909084] ? avc_ss_reset+0x190/0x190 [ 1771.913060] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1771.917995] ? kasan_check_read+0x11/0x20 [ 1771.922133] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1771.927400] ? rcu_softirq_qs+0x20/0x20 [ 1771.931382] ? ___might_sleep+0x1ed/0x300 [ 1771.935519] ? arch_local_save_flags+0x40/0x40 [ 1771.940105] block_ioctl+0xee/0x130 [ 1771.943723] ? blkdev_fallocate+0x400/0x400 [ 1771.948045] do_vfs_ioctl+0x1de/0x1790 [ 1771.951932] ? ioctl_preallocate+0x300/0x300 [ 1771.956334] ? selinux_file_mprotect+0x620/0x620 [ 1771.961089] ? __sb_end_write+0xd9/0x110 [ 1771.965155] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1771.970678] ? fput+0x130/0x1a0 [ 1771.973948] ? do_syscall_64+0x9a/0x820 [ 1771.977927] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1771.983453] ? security_file_ioctl+0x94/0xc0 [ 1771.987854] ksys_ioctl+0xa9/0xd0 [ 1771.991303] __x64_sys_ioctl+0x73/0xb0 [ 1771.995186] do_syscall_64+0x1b9/0x820 [ 1771.999074] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1772.004428] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1772.009347] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1772.014185] ? trace_hardirqs_on_caller+0x310/0x310 [ 1772.019194] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1772.024204] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1772.029220] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1772.034058] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1772.039247] RIP: 0033:0x457759 [ 1772.042430] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1772.061746] RSP: 002b:00007f89432e3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 03:51:14 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x9132) 03:51:14 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x200700}) [ 1772.069448] RAX: ffffffffffffffda RBX: 00007f89432e3c90 RCX: 0000000000457759 [ 1772.076708] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000004 [ 1772.083966] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1772.091223] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f89432e46d4 [ 1772.098482] R13: 00000000004c0b40 R14: 00000000004d2388 R15: 0000000000000005 [ 1772.220944] block nbd0: Receive control failed (result -22) [ 1772.262307] block nbd0: shutting down sockets 03:51:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x6000000, 0x0}) 03:51:14 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x72000}) 03:51:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1772.303962] binder: send failed reply for transaction 5660 to 606:617 03:51:14 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0xffffff9e) [ 1772.345048] binder: undelivered TRANSACTION_COMPLETE 03:51:14 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x2c) 03:51:14 executing program 0 (fault-call:3 fault-nth:6): r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab03) [ 1772.384584] binder: undelivered TRANSACTION_ERROR: 29201 [ 1772.441766] binder: 653:655 ioctl c018620b 0 returned -14 [ 1772.444684] binder: undelivered TRANSACTION_ERROR: 29189 03:51:14 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x400000000000000}) [ 1772.494574] binder: 653:663 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1772.505882] FAULT_INJECTION: forcing a failure. [ 1772.505882] name failslab, interval 1, probability 0, space 0, times 0 [ 1772.523017] CPU: 0 PID: 664 Comm: syz-executor0 Not tainted 4.20.0 #167 [ 1772.529967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 03:51:14 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0xf0ffffff00000000) [ 1772.533739] binder: 653:663 BC_FREE_BUFFER u0000000000000000 no match [ 1772.539337] Call Trace: [ 1772.539365] dump_stack+0x1d3/0x2c6 [ 1772.539393] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1772.539420] should_fail.cold.4+0xa/0x17 [ 1772.539441] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1772.566610] ? find_held_lock+0x36/0x1c0 [ 1772.570822] ? graph_lock+0x270/0x270 [ 1772.570841] ? print_usage_bug+0xc0/0xc0 [ 1772.570858] ? _raw_spin_unlock_irq+0x27/0x80 [ 1772.578694] ? _raw_spin_unlock_irq+0x27/0x80 [ 1772.578717] ? find_held_lock+0x36/0x1c0 [ 1772.578740] ? __lock_is_held+0xb5/0x140 [ 1772.595838] ? ___might_sleep+0x1ed/0x300 [ 1772.599996] ? arch_local_save_flags+0x40/0x40 [ 1772.604613] __should_failslab+0x124/0x180 [ 1772.608863] should_failslab+0x9/0x14 [ 1772.612683] kmem_cache_alloc+0x2be/0x730 [ 1772.613686] binder: 653:663 got reply transaction with bad transaction stack, transaction 5663 has target 653:0 [ 1772.616836] ? __lock_acquire+0x62f/0x4c20 [ 1772.616857] ? __lock_acquire+0x62f/0x4c20 [ 1772.616878] __d_alloc+0xc8/0xb90 [ 1772.616896] ? __lock_acquire+0x62f/0x4c20 03:51:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x8000000) [ 1772.616910] ? shrink_dcache_for_umount+0x2b0/0x2b0 [ 1772.616929] ? mark_held_locks+0x130/0x130 [ 1772.652667] ? print_usage_bug+0xc0/0xc0 [ 1772.656753] ? mark_held_locks+0x130/0x130 [ 1772.660999] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1772.663768] binder: 653:663 transaction failed 29201/-71, size 0-0 line 2756 [ 1772.666549] ? check_preemption_disabled+0x48/0x280 [ 1772.666569] ? debug_smp_processor_id+0x1c/0x20 [ 1772.666588] ? perf_trace_lock_acquire+0x15b/0x800 [ 1772.666615] d_alloc+0x96/0x380 [ 1772.666632] ? debug_smp_processor_id+0x1c/0x20 [ 1772.666644] ? __d_alloc+0xb90/0xb90 [ 1772.666667] d_alloc_parallel+0x15a/0x1f40 [ 1772.683517] ? graph_lock+0x270/0x270 [ 1772.700080] ? find_held_lock+0x36/0x1c0 [ 1772.712162] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1772.717714] ? __d_lookup_rcu+0xaa0/0xaa0 [ 1772.721885] ? find_held_lock+0x36/0x1c0 [ 1772.725966] ? __d_lookup+0x591/0x9e0 [ 1772.729786] ? lock_downgrade+0x900/0x900 [ 1772.733949] ? check_preemption_disabled+0x48/0x280 [ 1772.738986] ? rcu_read_unlock_special+0x1d0/0x1d0 03:51:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x1000000000000000) [ 1772.743935] ? kasan_check_read+0x11/0x20 [ 1772.748101] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1772.753392] ? rcu_softirq_qs+0x20/0x20 [ 1772.757391] ? __lockdep_init_map+0x105/0x590 [ 1772.761899] ? __lockdep_init_map+0x105/0x590 [ 1772.766413] ? lockdep_init_map+0x9/0x10 [ 1772.770483] ? __init_waitqueue_head+0x9e/0x150 [ 1772.770500] ? init_wait_entry+0x1c0/0x1c0 [ 1772.770516] ? d_lookup+0x255/0x300 [ 1772.770530] ? d_lookup+0x255/0x300 [ 1772.770548] ? lockdep_hardirqs_on+0x421/0x5c0 [ 1772.770569] __lookup_slow+0x1e6/0x540 [ 1772.770585] ? vfs_unlink+0x510/0x510 [ 1772.770602] ? do_raw_spin_unlock+0xa7/0x330 [ 1772.779514] ? d_lookup+0x20d/0x300 [ 1772.779557] lookup_one_len+0x1d8/0x220 [ 1772.779576] ? lookup_one_len_unlocked+0x100/0x100 [ 1772.779596] ? down_write+0x8a/0x130 [ 1772.779613] ? start_creating+0xb1/0x200 [ 1772.823786] ? down_read+0x120/0x120 [ 1772.827518] ? mntput+0x74/0xa0 [ 1772.830824] start_creating+0xc6/0x200 [ 1772.834741] __debugfs_create_file+0x63/0x400 [ 1772.839253] debugfs_create_file+0x57/0x70 03:51:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0xf0ffffffffffff) [ 1772.843503] nbd_start_device+0x495/0xcd0 [ 1772.847685] ? sock_shutdown+0x250/0x250 [ 1772.851768] nbd_ioctl+0x6af/0xd40 [ 1772.855320] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1772.855345] ? nbd_release+0x140/0x140 [ 1772.855363] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1772.855377] ? kasan_check_read+0x11/0x20 [ 1772.855394] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1772.855410] ? rcu_softirq_qs+0x20/0x20 [ 1772.855437] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1772.855455] ? avc_has_extended_perms+0xab2/0x15a0 03:51:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x3f000000) [ 1772.864261] ? nbd_release+0x140/0x140 [ 1772.897011] blkdev_ioctl+0xd8a/0x21b0 [ 1772.900933] ? blkpg_ioctl+0xc10/0xc10 [ 1772.904838] ? avc_ss_reset+0x190/0x190 [ 1772.908839] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1772.913782] ? kasan_check_read+0x11/0x20 [ 1772.917970] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1772.923353] ? rcu_softirq_qs+0x20/0x20 [ 1772.927382] ? ___might_sleep+0x1ed/0x300 [ 1772.931558] ? arch_local_save_flags+0x40/0x40 [ 1772.936168] block_ioctl+0xee/0x130 [ 1772.939922] ? blkdev_fallocate+0x400/0x400 [ 1772.944257] do_vfs_ioctl+0x1de/0x1790 [ 1772.944283] ? ioctl_preallocate+0x300/0x300 [ 1772.944305] ? selinux_file_mprotect+0x620/0x620 [ 1772.944328] ? __sb_end_write+0xd9/0x110 [ 1772.952642] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1772.952657] ? fput+0x130/0x1a0 [ 1772.952675] ? do_syscall_64+0x9a/0x820 [ 1772.952698] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1772.952714] ? security_file_ioctl+0x94/0xc0 [ 1772.952734] ksys_ioctl+0xa9/0xd0 [ 1772.987761] __x64_sys_ioctl+0x73/0xb0 [ 1772.991778] do_syscall_64+0x1b9/0x820 [ 1772.995681] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1773.001068] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1773.006020] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1773.010883] ? trace_hardirqs_on_caller+0x310/0x310 [ 1773.015909] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1773.020936] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1773.025967] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1773.030830] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1773.036021] RIP: 0033:0x457759 [ 1773.036042] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1773.036050] RSP: 002b:00007f89432e3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1773.036065] RAX: ffffffffffffffda RBX: 00007f89432e3c90 RCX: 0000000000457759 [ 1773.036073] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000004 [ 1773.036087] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1773.088186] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f89432e46d4 [ 1773.095471] R13: 00000000004c0b40 R14: 00000000004d2388 R15: 0000000000000005 [ 1773.105284] block nbd0: Receive control failed (result -22) [ 1773.138682] block nbd0: shutting down sockets 03:51:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x10000000, 0x0}) 03:51:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x3291) 03:51:15 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x500000000000000}) 03:51:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:15 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}, 0x2c) 03:51:15 executing program 0 (fault-call:3 fault-nth:7): r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab03) [ 1773.249797] binder: send failed reply for transaction 5663 to 653:663 [ 1773.291527] binder: undelivered TRANSACTION_COMPLETE [ 1773.300425] FAULT_INJECTION: forcing a failure. [ 1773.300425] name failslab, interval 1, probability 0, space 0, times 0 [ 1773.326175] binder: 702:703 ioctl c018620b 0 returned -14 [ 1773.332213] binder: undelivered TRANSACTION_ERROR: 29201 03:51:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1773.344762] binder: undelivered TRANSACTION_ERROR: 29189 [ 1773.365419] CPU: 1 PID: 698 Comm: syz-executor0 Not tainted 4.20.0 #167 [ 1773.372227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1773.381684] Call Trace: [ 1773.381711] dump_stack+0x1d3/0x2c6 [ 1773.381737] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1773.381767] should_fail.cold.4+0xa/0x17 [ 1773.381787] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1773.381804] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1773.381836] ? graph_lock+0x270/0x270 [ 1773.411547] ? __lockdep_init_map+0x105/0x590 [ 1773.416073] ? find_held_lock+0x36/0x1c0 [ 1773.420152] ? __lock_is_held+0xb5/0x140 [ 1773.424244] ? ___might_sleep+0x1ed/0x300 [ 1773.428423] ? arch_local_save_flags+0x40/0x40 [ 1773.433051] __should_failslab+0x124/0x180 [ 1773.437294] should_failslab+0x9/0x14 [ 1773.437312] kmem_cache_alloc+0x2be/0x730 [ 1773.437340] alloc_inode+0xb2/0x190 [ 1773.437357] new_inode_pseudo+0x71/0x1a0 [ 1773.437375] ? prune_icache_sb+0x1c0/0x1c0 [ 1773.445308] ? down_read+0x120/0x120 [ 1773.445322] ? mntput+0x74/0xa0 [ 1773.445344] new_inode+0x1c/0x40 [ 1773.445361] debugfs_get_inode+0x19/0x120 [ 1773.445383] __debugfs_create_file+0xb5/0x400 [ 1773.476264] debugfs_create_file+0x57/0x70 [ 1773.480520] nbd_start_device+0x495/0xcd0 [ 1773.484688] ? sock_shutdown+0x250/0x250 [ 1773.488771] nbd_ioctl+0x6af/0xd40 [ 1773.492329] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1773.497279] ? nbd_release+0x140/0x140 [ 1773.501185] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1773.506130] ? kasan_check_read+0x11/0x20 [ 1773.510290] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 03:51:15 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x4000000000000000}) [ 1773.515578] ? rcu_softirq_qs+0x20/0x20 [ 1773.519590] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1773.525142] ? avc_has_extended_perms+0xab2/0x15a0 [ 1773.530088] ? nbd_release+0x140/0x140 [ 1773.533994] blkdev_ioctl+0xd8a/0x21b0 [ 1773.537894] ? blkpg_ioctl+0xc10/0xc10 [ 1773.541794] ? avc_ss_reset+0x190/0x190 [ 1773.545783] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1773.550722] ? kasan_check_read+0x11/0x20 [ 1773.554886] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1773.560174] ? rcu_softirq_qs+0x20/0x20 [ 1773.564190] ? ___might_sleep+0x1ed/0x300 [ 1773.568354] ? arch_local_save_flags+0x40/0x40 [ 1773.572965] block_ioctl+0xee/0x130 [ 1773.576606] ? blkdev_fallocate+0x400/0x400 [ 1773.580941] do_vfs_ioctl+0x1de/0x1790 [ 1773.584882] ? ioctl_preallocate+0x300/0x300 [ 1773.589303] ? selinux_file_mprotect+0x620/0x620 [ 1773.594155] ? __sb_end_write+0xd9/0x110 [ 1773.598222] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1773.603743] ? fput+0x130/0x1a0 [ 1773.607012] ? do_syscall_64+0x9a/0x820 [ 1773.610984] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1773.616512] ? security_file_ioctl+0x94/0xc0 [ 1773.620913] ksys_ioctl+0xa9/0xd0 [ 1773.624366] __x64_sys_ioctl+0x73/0xb0 [ 1773.628246] do_syscall_64+0x1b9/0x820 [ 1773.632123] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1773.637477] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1773.642395] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1773.647229] ? trace_hardirqs_on_caller+0x310/0x310 [ 1773.652233] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1773.657239] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1773.662249] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1773.667091] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1773.672265] RIP: 0033:0x457759 [ 1773.675447] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1773.694431] RSP: 002b:00007f89432e3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1773.702129] RAX: ffffffffffffffda RBX: 00007f89432e3c90 RCX: 0000000000457759 [ 1773.709388] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000004 03:51:16 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x10) [ 1773.716645] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1773.723913] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f89432e46d4 [ 1773.731191] R13: 00000000004c0b40 R14: 00000000004d2388 R15: 0000000000000005 [ 1773.745186] binder: 702:718 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1773.764201] binder: 702:718 BC_FREE_BUFFER u0000000000000000 no match 03:51:16 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x2) 03:51:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:16 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x3f00) [ 1773.809848] binder: 702:718 got reply transaction with bad transaction stack, transaction 5666 has target 702:0 [ 1773.875047] binder: 702:718 transaction failed 29201/-71, size 0-0 line 2756 [ 1773.909559] block nbd0: Receive control failed (result -22) [ 1773.941884] block nbd0: shutting down sockets 03:51:16 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000]}, 0x2c) 03:51:16 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x4000000}) 03:51:16 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:16 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0xffffff7f00000000) 03:51:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x1000000, 0x0}) 03:51:16 executing program 0 (fault-call:3 fault-nth:8): r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab03) [ 1774.116567] binder: send failed reply for transaction 5666 to 702:718 [ 1774.141769] binder: undelivered TRANSACTION_COMPLETE [ 1774.166682] FAULT_INJECTION: forcing a failure. [ 1774.166682] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1774.177124] binder: undelivered TRANSACTION_ERROR: 29201 [ 1774.178680] CPU: 1 PID: 741 Comm: syz-executor0 Not tainted 4.20.0 #167 [ 1774.178692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1774.178698] Call Trace: [ 1774.178729] dump_stack+0x1d3/0x2c6 [ 1774.178754] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1774.184192] binder: undelivered TRANSACTION_ERROR: 29189 [ 1774.190947] ? perf_trace_lock_acquire+0x15b/0x800 [ 1774.190963] ? graph_lock+0x270/0x270 [ 1774.190990] should_fail.cold.4+0xa/0x17 [ 1774.191011] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1774.191030] ? check_preemption_disabled+0x48/0x280 [ 1774.240612] ? debug_smp_processor_id+0x1c/0x20 [ 1774.245291] ? perf_trace_lock_acquire+0x15b/0x800 [ 1774.250260] ? perf_trace_lock+0x7a0/0x7a0 [ 1774.254507] ? find_held_lock+0x36/0x1c0 [ 1774.258580] ? graph_lock+0x270/0x270 [ 1774.262392] ? get_mem_cgroup_from_mm+0x1e9/0x440 [ 1774.267242] ? lock_downgrade+0x900/0x900 [ 1774.271395] ? check_preemption_disabled+0x48/0x280 [ 1774.276441] ? rcu_read_unlock+0x16/0x60 [ 1774.280529] __alloc_pages_nodemask+0x366/0xea0 [ 1774.285206] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1774.290223] ? kasan_check_read+0x11/0x20 [ 1774.294380] ? __alloc_pages_slowpath+0x2df0/0x2df0 [ 1774.299399] ? __lock_is_held+0xb5/0x140 [ 1774.303509] ? ___might_sleep+0x1ed/0x300 [ 1774.307668] ? trace_hardirqs_off+0xb8/0x310 [ 1774.312106] cache_grow_begin+0x91/0x8c0 [ 1774.316174] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1774.321727] kmem_cache_alloc+0x665/0x730 [ 1774.325899] alloc_inode+0xb2/0x190 [ 1774.329540] new_inode_pseudo+0x71/0x1a0 [ 1774.333606] ? prune_icache_sb+0x1c0/0x1c0 [ 1774.337851] ? down_read+0x120/0x120 [ 1774.341574] ? mntput+0x74/0xa0 [ 1774.344866] new_inode+0x1c/0x40 [ 1774.348249] debugfs_get_inode+0x19/0x120 [ 1774.352404] __debugfs_create_file+0xb5/0x400 [ 1774.356924] debugfs_create_file+0x57/0x70 [ 1774.361167] nbd_start_device+0x495/0xcd0 [ 1774.365331] ? sock_shutdown+0x250/0x250 [ 1774.369410] nbd_ioctl+0x6af/0xd40 [ 1774.373055] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1774.378008] ? nbd_release+0x140/0x140 [ 1774.381904] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1774.386837] ? kasan_check_read+0x11/0x20 [ 1774.390989] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1774.396274] ? rcu_softirq_qs+0x20/0x20 [ 1774.400266] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1774.405909] ? avc_has_extended_perms+0xab2/0x15a0 [ 1774.410860] ? nbd_release+0x140/0x140 [ 1774.414763] blkdev_ioctl+0xd8a/0x21b0 [ 1774.418663] ? blkpg_ioctl+0xc10/0xc10 [ 1774.422554] ? avc_ss_reset+0x190/0x190 [ 1774.426550] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1774.431483] ? kasan_check_read+0x11/0x20 [ 1774.435653] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1774.440933] ? rcu_softirq_qs+0x20/0x20 [ 1774.444945] ? ___might_sleep+0x1ed/0x300 [ 1774.449104] ? arch_local_save_flags+0x40/0x40 [ 1774.453702] block_ioctl+0xee/0x130 [ 1774.457335] ? blkdev_fallocate+0x400/0x400 [ 1774.461663] do_vfs_ioctl+0x1de/0x1790 [ 1774.465572] ? ioctl_preallocate+0x300/0x300 [ 1774.469987] ? selinux_file_mprotect+0x620/0x620 [ 1774.474749] ? __sb_end_write+0xd9/0x110 [ 1774.478818] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1774.484355] ? fput+0x130/0x1a0 [ 1774.487640] ? do_syscall_64+0x9a/0x820 [ 1774.491630] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1774.497175] ? security_file_ioctl+0x94/0xc0 [ 1774.501597] ksys_ioctl+0xa9/0xd0 [ 1774.505066] __x64_sys_ioctl+0x73/0xb0 [ 1774.508980] do_syscall_64+0x1b9/0x820 [ 1774.512884] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1774.518258] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1774.523191] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1774.528048] ? trace_hardirqs_on_caller+0x310/0x310 [ 1774.533078] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1774.538106] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1774.543135] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1774.547986] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1774.553178] RIP: 0033:0x457759 [ 1774.556376] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1774.575371] RSP: 002b:00007f89432e3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1774.583090] RAX: ffffffffffffffda RBX: 00007f89432e3c90 RCX: 0000000000457759 [ 1774.590387] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000004 [ 1774.597665] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1774.604946] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f89432e46d4 03:51:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x9effffff00000000) [ 1774.612220] R13: 00000000004c0b40 R14: 00000000004d2388 R15: 0000000000000005 [ 1774.625793] block nbd0: Receive control failed (result -22) [ 1774.635094] block nbd0: shutting down sockets 03:51:17 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x3f000000}) 03:51:17 executing program 0 (fault-call:3 fault-nth:9): r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab03) 03:51:17 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x2c) [ 1774.688945] binder: 744:747 ioctl c018620b 0 returned -14 03:51:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1774.774885] binder: 744:751 transaction failed 29189/-22, size 24-0 line 2834 [ 1774.781179] FAULT_INJECTION: forcing a failure. [ 1774.781179] name failslab, interval 1, probability 0, space 0, times 0 [ 1774.816124] CPU: 0 PID: 762 Comm: syz-executor0 Not tainted 4.20.0 #167 [ 1774.822935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1774.832300] Call Trace: [ 1774.834914] dump_stack+0x1d3/0x2c6 [ 1774.838562] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1774.843778] should_fail.cold.4+0xa/0x17 [ 1774.845054] binder: 744:768 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1774.847855] ? find_held_lock+0x36/0x1c0 [ 1774.847876] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1774.847895] ? is_bpf_text_address+0xac/0x170 [ 1774.861218] binder: 744:768 BC_FREE_BUFFER u0000000000000000 no match [ 1774.863628] ? lock_downgrade+0x900/0x900 [ 1774.863643] ? check_preemption_disabled+0x48/0x280 [ 1774.863662] ? graph_lock+0x270/0x270 [ 1774.874716] ? kasan_check_read+0x11/0x20 [ 1774.874735] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1774.874753] ? rcu_softirq_qs+0x20/0x20 [ 1774.883906] ? rcu_softirq_qs+0x20/0x20 [ 1774.891565] binder: 744:768 got reply transaction with no transaction stack [ 1774.891815] ? unwind_dump+0x190/0x190 [ 1774.891841] ? __lock_is_held+0xb5/0x140 [ 1774.903061] binder: 744:768 transaction failed 29201/-71, size 0-0 line 2741 [ 1774.905056] ? unwind_get_return_address+0x61/0xa0 [ 1774.905075] ? ___might_sleep+0x1ed/0x300 [ 1774.905091] ? arch_local_save_flags+0x40/0x40 [ 1774.905121] __should_failslab+0x124/0x180 [ 1774.945196] should_failslab+0x9/0x14 [ 1774.949039] kmem_cache_alloc+0x2be/0x730 [ 1774.953218] ? new_inode+0x1c/0x40 [ 1774.956769] ? debugfs_get_inode+0x19/0x120 [ 1774.961097] ? __debugfs_create_file+0xb5/0x400 [ 1774.965777] ? debugfs_create_file+0x57/0x70 [ 1774.970193] ? nbd_start_device+0x495/0xcd0 [ 1774.976083] ? nbd_ioctl+0x6af/0xd40 [ 1774.979802] ? blkdev_ioctl+0xd8a/0x21b0 [ 1774.983880] ? block_ioctl+0xee/0x130 [ 1774.987696] selinux_inode_alloc_security+0x107/0x3a0 [ 1774.992904] ? inode_free_rcu+0x20/0x20 [ 1774.996897] ? __put_user_ns+0x60/0x60 [ 1775.000792] ? kasan_check_read+0x11/0x20 [ 1775.004946] security_inode_alloc+0x73/0xd0 [ 1775.009277] inode_init_always+0x68f/0xd80 [ 1775.013512] ? get_nr_inodes+0x120/0x120 [ 1775.017579] ? __lock_is_held+0xb5/0x140 [ 1775.021664] ? rcu_read_lock_sched_held+0x108/0x120 [ 1775.026690] ? kmem_cache_alloc+0x33a/0x730 [ 1775.031025] alloc_inode+0x80/0x190 [ 1775.034656] new_inode_pseudo+0x71/0x1a0 [ 1775.038725] ? prune_icache_sb+0x1c0/0x1c0 [ 1775.042967] ? down_read+0x120/0x120 [ 1775.046685] ? mntput+0x74/0xa0 [ 1775.049973] new_inode+0x1c/0x40 [ 1775.053354] debugfs_get_inode+0x19/0x120 [ 1775.057510] __debugfs_create_file+0xb5/0x400 [ 1775.062018] debugfs_create_file+0x57/0x70 [ 1775.066262] nbd_start_device+0x495/0xcd0 [ 1775.070427] ? sock_shutdown+0x250/0x250 [ 1775.074505] nbd_ioctl+0x6af/0xd40 [ 1775.078064] ? avc_has_extended_perms+0x8cb/0x15a0 [ 1775.082998] ? nbd_release+0x140/0x140 [ 1775.086889] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1775.091817] ? kasan_check_read+0x11/0x20 [ 1775.095981] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1775.101266] ? rcu_softirq_qs+0x20/0x20 [ 1775.105257] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1775.110799] ? avc_has_extended_perms+0xab2/0x15a0 [ 1775.115740] ? nbd_release+0x140/0x140 [ 1775.119635] blkdev_ioctl+0xd8a/0x21b0 [ 1775.123527] ? blkpg_ioctl+0xc10/0xc10 [ 1775.127419] ? avc_ss_reset+0x190/0x190 [ 1775.131391] ? rcu_read_unlock_special+0x1d0/0x1d0 [ 1775.136322] ? kasan_check_read+0x11/0x20 [ 1775.140489] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1775.145768] ? rcu_softirq_qs+0x20/0x20 [ 1775.149785] ? ___might_sleep+0x1ed/0x300 [ 1775.153937] ? arch_local_save_flags+0x40/0x40 [ 1775.158537] block_ioctl+0xee/0x130 [ 1775.162172] ? blkdev_fallocate+0x400/0x400 [ 1775.166502] do_vfs_ioctl+0x1de/0x1790 [ 1775.170401] ? ioctl_preallocate+0x300/0x300 [ 1775.174814] ? selinux_file_mprotect+0x620/0x620 [ 1775.179585] ? __sb_end_write+0xd9/0x110 [ 1775.183654] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1775.189368] ? fput+0x130/0x1a0 [ 1775.192653] ? do_syscall_64+0x9a/0x820 [ 1775.196642] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1775.202180] ? security_file_ioctl+0x94/0xc0 [ 1775.206596] ksys_ioctl+0xa9/0xd0 [ 1775.210063] __x64_sys_ioctl+0x73/0xb0 [ 1775.213958] do_syscall_64+0x1b9/0x820 [ 1775.217856] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1775.223223] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1775.228157] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1775.233014] ? trace_hardirqs_on_caller+0x310/0x310 [ 1775.238034] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1775.243049] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1775.248080] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1775.252946] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1775.258136] RIP: 0033:0x457759 [ 1775.261333] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1775.280232] RSP: 002b:00007f89432e3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1775.287946] RAX: ffffffffffffffda RBX: 00007f89432e3c90 RCX: 0000000000457759 [ 1775.295218] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000004 [ 1775.302489] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1775.309762] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f89432e46d4 03:51:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x3f00000000000000) 03:51:17 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x60}) 03:51:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1775.317032] R13: 00000000004c0b40 R14: 00000000004d2388 R15: 0000000000000005 [ 1775.354313] binder: undelivered TRANSACTION_ERROR: 29189 [ 1775.360016] binder: undelivered TRANSACTION_ERROR: 29201 03:51:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x6000, 0x0}) [ 1775.369570] block nbd0: Receive control failed (result -22) [ 1775.379476] block nbd0: shutting down sockets 03:51:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0xffffff7f) 03:51:17 executing program 0 (fault-call:3 fault-nth:10): r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab03) 03:51:17 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x2}) [ 1775.474084] binder: 779:785 ioctl c018620b 0 returned -14 03:51:17 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0xf000) 03:51:17 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}, 0x2c) [ 1775.553456] binder: 779:795 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1775.588656] binder: 779:795 BC_FREE_BUFFER u0000000000000000 no match [ 1775.614651] binder: 779:795 got reply transaction with bad transaction stack, transaction 5671 has target 779:0 [ 1775.636997] binder: 779:795 transaction failed 29201/-71, size 0-0 line 2756 03:51:18 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x20070000000000}) 03:51:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x200000000000000) 03:51:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:18 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab03) 03:51:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x1000000) [ 1775.950483] block nbd0: Receive control failed (result -22) [ 1775.958539] block nbd0: shutting down sockets 03:51:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x10, 0x0}) 03:51:18 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x2000000}) 03:51:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x10000000) 03:51:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:18 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}, 0x2c) 03:51:18 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x40049409) [ 1776.240963] binder: send failed reply for transaction 5671 to 779:795 [ 1776.280093] binder: undelivered TRANSACTION_COMPLETE [ 1776.283127] block nbd0: Device being setup by another task 03:51:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x9132000000000000) [ 1776.294923] binder: undelivered TRANSACTION_ERROR: 29201 [ 1776.323283] binder: undelivered TRANSACTION_ERROR: 29189 [ 1776.328239] binder: 843:849 ioctl c018620b 0 returned -14 03:51:18 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11, 0x60000000}) 03:51:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1776.364819] block nbd0: shutting down sockets [ 1776.405855] binder: 843:854 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1776.412510] binder: 843:854 BC_FREE_BUFFER u0000000000000000 no match [ 1776.434748] binder: 843:854 got reply transaction with bad transaction stack, transaction 5674 has target 843:0 03:51:18 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x401870c8) [ 1776.469197] binder: 843:854 transaction failed 29201/-71, size 0-0 line 2756 03:51:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0xf0ffff) 03:51:18 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080)={0x800000011}) prctl$PR_CAP_AMBIENT(0x2f, 0x7, 0x15) [ 1776.539020] block nbd0: Device being setup by another task [ 1776.597566] block nbd0: shutting down sockets 03:51:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x5, 0x0}) 03:51:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:19 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x2c) 03:51:19 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x91320000) 03:51:19 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x401070cd) 03:51:19 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) r2 = request_key(&(0x7f0000000040)='ceph\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)='/dev/video#\x00', 0xfffffffffffffffd) keyctl$read(0xb, r2, &(0x7f0000000100)=""/104, 0x68) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) [ 1777.129433] binder: send failed reply for transaction 5674 to 843:854 [ 1777.164366] block nbd0: Device being setup by another task [ 1777.170371] binder: undelivered TRANSACTION_COMPLETE 03:51:19 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0xf0) [ 1777.181399] binder: undelivered TRANSACTION_ERROR: 29201 [ 1777.194871] binder: undelivered TRANSACTION_ERROR: 29189 [ 1777.218105] binder: 895:897 ioctl c018620b 0 returned -14 03:51:19 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0xfffffff0) [ 1777.245607] block nbd0: shutting down sockets 03:51:19 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x11}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000080)={{0xaaa, 0x8c6}, 0x1, 0x1, 0x9, {0x1, 0x4}, 0xffffffffffff7184, 0x2}) 03:51:19 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:19 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x401870cc) [ 1777.326473] binder: 895:906 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1777.361274] binder: 895:906 BC_FREE_BUFFER u0000000000000000 no match 03:51:19 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f00000000c0)={r0, 0x0, 0x6, 0x7}) removexattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=ANY=[@ANYBLOB='s#L']) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) [ 1777.405893] binder: 895:906 got reply transaction with bad transaction stack, transaction 5677 has target 895:0 [ 1777.482365] block nbd0: Device being setup by another task [ 1777.495377] binder: 895:906 transaction failed 29201/-71, size 0-0 line 2756 [ 1777.554965] block nbd0: shutting down sockets 03:51:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x3, 0x0}) 03:51:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0xfffffffffffff000) 03:51:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:20 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}, 0x2c) 03:51:20 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x1276) 03:51:20 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000040)='/dev/video#\x00', 0x1000000fffffffe, 0x82480) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) prctl$PR_GET_THP_DISABLE(0x2a) [ 1778.001419] binder: send failed reply for transaction 5677 to 895:906 [ 1778.030303] binder: undelivered TRANSACTION_COMPLETE [ 1778.049246] block nbd0: Device being setup by another task 03:51:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0xfffff000) 03:51:20 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0xfffffffffffffffa) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000280)={0x11}) r3 = getpgid(0xffffffffffffffff) sched_setaffinity(r3, 0x8, &(0x7f00000000c0)=0x4fb) r4 = creat(&(0x7f0000000040)='./file0\x00', 0x24) connect$vsock_stream(r4, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) [ 1778.104225] binder: 944:947 ioctl c018620b 0 returned -14 [ 1778.110508] block nbd0: shutting down sockets 03:51:20 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x1264) 03:51:20 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1778.235918] binder: 944:957 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1778.254719] binder: 944:957 BC_FREE_BUFFER u0000000000000000 no match 03:51:20 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='rdma.current\x00', 0x0, 0x0) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000040)={0x8, 0x1000}, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:20 executing program 1: r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x2) ioctl$VIDIOC_ENUMSTD(r0, 0xc0485619, &(0x7f0000000080)={0x1, 0x40004, "077025c9a23689d643ac5cd76569192c6e09e6a9258a6e37", {0x7, 0x6}, 0x7}) r1 = syz_open_dev$video(&(0x7f0000000100)='/dev/video#\x00', 0x401, 0x80000) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000280)={0x11}) [ 1778.298412] binder: 944:957 got reply transaction with bad transaction stack, transaction 5680 has target 944:0 [ 1778.358498] block nbd0: Device being setup by another task [ 1778.380494] binder: 944:957 transaction failed 29201/-71, size 0-0 line 2756 [ 1778.395942] block nbd0: shutting down sockets 03:51:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0xa00000000000000, 0x0}) 03:51:21 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000]}, 0x2c) 03:51:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) ioctl$KVM_PPC_GET_PVINFO(r0, 0x4080aea1, &(0x7f0000000000)=""/97) 03:51:21 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab0a) 03:51:21 executing program 1: r0 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x111, 0x400) setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000080)={0x0, 0x1, 0x4, 0x0, 0x9, 0xffffffff7fffffff, 0x5837, 0x8, 0x33c, 0x8, 0x401}, 0xb) r1 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x80000) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000280)={0x11}) [ 1778.902814] binder: send failed reply for transaction 5680 to 944:957 [ 1778.952215] binder: undelivered TRANSACTION_COMPLETE [ 1778.967346] binder_release_work: 2 callbacks suppressed [ 1778.967353] binder: undelivered TRANSACTION_ERROR: 29201 [ 1778.989107] binder: 986:995 ioctl c018620b 0 returned -14 03:51:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$dmmidi(&(0x7f0000000580)='/dev/dmmidi#\x00', 0x5, 0x80) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f00000005c0), &(0x7f0000000600)=0x4) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xd11, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') ioctl$TIOCMSET(r2, 0x5418, &(0x7f0000000280)=0x3) ioctl$sock_bt_bnep_BNEPCONNADD(r2, 0x400442c8, &(0x7f00000002c0)=ANY=[@ANYRES32=r2, @ANYBLOB="000000000800ff0a93a88d6d2f9747e1d3eb30c3e52cea04fd925374f48cf043299306722da01fffbe67a1547535c229cf848c8a52c3761a5d47708db4b584f33747fd5bb55aca32bfbcd73e82c68f6c9adbde5d810ea6dc349b1d98e40c0a6674131a69a4d44d5004ebde7295ca207ea138565fb08cb12b19ef9dc2107f9bfbeaf8a19f60c8cd0af13ba0f412ef0b10c279bc6287004eb547882b43be44a7540d42fb9575236b8782790929a10e5d9c285b6f7f96c60e6b96da7190a96c30d28c7b2a0335e081b3e68f5343d872e4cad5e8921ee220a437e654b1c917acc7acb190e8"]) recvfrom$x25(r2, &(0x7f0000000480)=""/223, 0xdf, 0x40010000, &(0x7f00000003c0)={0x9, @remote={[], 0x3}}, 0x12) sendmsg$IPVS_CMD_GET_DAEMON(r2, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x48, r3, 0x0, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xffffffffffffffe0}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x100000000}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x850) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000040)) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1779.017770] block nbd0: Device being setup by another task [ 1779.024884] binder: undelivered TRANSACTION_ERROR: 29189 03:51:21 executing program 1: syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r0 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000280)={0x11}) r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x1ff, 0x80000) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) [ 1779.072354] block nbd0: shutting down sockets [ 1779.072404] binder: 986:1001 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1779.109968] binder: 986:1001 BC_FREE_BUFFER u0000000000000000 no match [ 1779.156879] binder: 986:1001 got reply transaction with bad transaction stack, transaction 5683 has target 986:0 03:51:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x8001, 0x42) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000200)={0x0, 0x80000000, 0x100000001, 0x8, 0x5, 0x3, 0x1, 0x3f, {0x0, @in={{0x2, 0x4e21, @broadcast}}, 0x20002000, 0x2, 0x8, 0x100, 0x16ec9870}}, &(0x7f00000002c0)=0xb0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000300)={r2, 0x60}, &(0x7f0000000340)=0x8) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b5031800000018000000000000000001c08aa45a46b4a111afb1d330680be9719d561dc7b3ed700d28308ae11f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000040)={0x0, 0x4d}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000000c0)={r4, 0x0, 0x4, 0x1}, &(0x7f0000000140)=0x10) 03:51:21 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000040)=0x0) r2 = getpgrp(0x0) set_thread_area(&(0x7f0000000080)={0xd4cd, 0x100000, 0x1000, 0x9, 0x2433, 0x36187ff8, 0x0, 0x1b7, 0x2, 0x7}) tgkill(r1, r2, 0x2a) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f0000000180)={0x7ffffffe}) 03:51:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1779.217720] binder: 986:1001 transaction failed 29201/-71, size 0-0 line 2756 03:51:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x4c00000000000000, 0x0}) 03:51:22 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xc0045878) 03:51:22 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x2c) 03:51:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x8000, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000040)=0xffffffff) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000000140)={0x0}) ioctl$DRM_IOCTL_LOCK(r1, 0x4008642a, &(0x7f00000001c0)={r2, 0x10}) add_key(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz', 0x3}, &(0x7f0000000280)="b3ab13e9b4e1376300797dfee647bc21544644e118d7cac6f890c447427d8d3db7e08be3e81bdeb5f6af83dc56a0002ab5c6b46c2bb80d3a2e493a08b35ebc665f496b8c2c571376b0d42202f110cf9c751e2ee9b0090867b532dabcd612249aa976e079f0544e644dc75afe5264187824ece1d762e03d4c41fe702d67e41c424fba9b5054fc3194e7510e9efc48b2d4a5b834cbcff32b801db99ab7ba8401dd3400bbf353fcd0c3b7c3ce2363f66c0047c4dd1d40f723d76e415ceb238510a28eba9db21a5978129db07c00eeb02408feb03e2ad36fd7c7bafaaffc4226b8ad224a5ceacdbae1076262d8cf9a611086eba276e3c00fcf19a2ff4ece9a1edb083fa1f6824094b4b33af1567133e6727d3afc8bbd3ad6980bc02f9848f5d8bd22b1b99607deec56b6ea2bbfbe14405fe1e7f7ce8c51dca3ebf0de27b984a59607e2233a21ed3b2f5b00a5d363772101c6e5020848033786205b6aa9c29d4b632244abfec43678ae286cfc156550bb9f45498d5368af17dece50e33c27134d56f900a6149c51499a92fa596fa557c8d1390dbce733fd2858908127184ee90d337f3f184de08bc71ba9a585033acee822e090e3be5085e00c165826a99860fdbdd8d3784a8abf6fa03d3b9242ccf44b6b256a92be95f7d1cf34561a2f237a6cf52bb018541866b6c980e2d6b94a057dbb58a04792677ff17c92e77bb60cc2de464d63ba2c267e6b3a5130e6cfc69c411721828634ce814808c322dd44dd3acc658bf5566564ba9000ea4e8ca0338578f6d29e1ad26959920be01cd5fa4ae5090d1f382680f807b8b58b8df6cd9405a5aeedb142afff7b8c761e7e53816b7bd2fab572f9ecbd2a3a9b8799d8688f09596cb868888c179c003ea7b9304457e2ddf85725d4713b838ecdd47ed3bf92c714770cbfb5123f545e84c8db35622204132f30837848138b119f0965a32a0a5fb9a9a89e6d01fee9942ed1db8042da4cf382cb56705daea5d3455adeb324fcfd7976e2c5b44fad6bfdbbe13cabc0aab1108dbae005e312912866b68565b82b6b2d409be4e4e4240c9236e6397d8d73ce065af0585c3ae66450b53455b59e19032ede8e1241d86c1da143a9938dd1f24cace4a6dc20384f28f95aa5749edd338d5ed5643b338138d39258bae5fe88e25a3e26181cfa05a0233b9a6e43f5a495abf58ff8c1ae0a4008d6d2578bdbc468b3e1aeee8fa7c5ef942f40b010d4c4b451ed4f35b2fdb72694c2455bb632205e67c77c1d71ff906b03f2b629d378ee599842bfe04ef461c3182779bdb3a58d44385d1b5a30fad6ff7a84b9846eaf98d94405da14338bc14b4b1132fa740e65c755c2dced549c32377698bc9bcdf0e59295ec38cb59a9d90dc684a2963d1ada384954737788d951a0f7058fb63bab50177282499a76c739e13beab9e7de9eb4a2389eac7fb332c46feb273bdc6c3cb75c5cf0e6ead317acc0c770660d5aff4eff17c007b2065ccc98dcbddf7e3bd55ac53eb8d24e389bb53020f72eb1c0a3c1589f838a867d904ce7ef9c123b919f488d601596c660af618491a0ce81e9f9026773f243f3b3eed589ac4228033e5aa260a9cb033174c37546389cf3628e54b2ff81b779448b176271b794ad94e75666a6d65e991a384468eafe0fd2d3ffcec2d462a561f807cfec687ccdb207b3813a92eae74bcc9ddffa528bf1a337d7ef1a14ab3fbb4c0e2049eb85e699ccd2dc9d6f21c17b4476e1b4ce38b54075cb1248c8708e435ea0cbe55d9b9458216afcaca24cc160322d9a19a5ff7bce6bec9dce542aa1b3cd13bedbc4f3dbf31e8b08a9135ce2464aedb430ae031af9175cae17044fdebc3c5b31c652930dca45c17ffb4c798ea2cd67550a3795989f1c29fb800bd6cc72b2541cae475987aeb41679cf2c85e01e6f6a61b5597a26834cb81e131794ba06ef229b95c6d547d5243788120596528055358b5af22aefecbb900f4def0c8e71e051ac129d40934267016b88405e571cb5780d503504104f93937039c0e5fd77b6143de48c25987d15c9a4636ec9f29e23a61110f53f4e253de277e9ee7398d5da7462cf8e82cba2b40c9ca36c02fb746d4ac547ddaecb4250fff33b05369ddfec43064cb7c1eede13edba6be10a306f9252028efd8415510cc7f740e400671c902d0499942ab8ff3c1a8576135a05b6e758d40926d625d5672cf1d0fed538d09be720eca747c0b5c6084241acf088aa16e6353e8dd636a3075f9cb744a0ec052aa6b8f6013d254edac77a13f28e2067e87a8dfdea31126e8c53ca1b08cb3260d2a12ed1a180b502f089707a6f087aa5da07cf5b5d363b553023858829c59d0486b2012436b00a6d2891ebd58ba7deddaa7b07dc33956e44020bc2c427c4e9dd9946c5f43fd2174ce032dcfe99d67cc3d76576c1762df41a670ecb0bd6600ce651117b9bbc386751639784d893b977ca499eeaa9082b752d3009bf9c25237b400084ad37fe725b602aa6659a1263d0b81730acf14ac793c2dde1b08ece876c2876623f6a0aca371d058d018a2acb4b34b97028562485cef0d72b349922521552c407a2bf8f0d6ff2a844ca60f1c0507c477c9bef245c873581d9500ab13b34e64be1cb92da212f570d040c3e0306011f33c4bf5ef57c0b903b7796cf3e9442ed7aa75552f0c52530fa95fcdd77ea117c4d87d2dcd5bc79cc5f9fa074ca4ec5b7010bcd22ef6a018016af1ed201b8686a6bdcbc39b9ce5026972411f7ab58199131c6294e35ba43225b7bdaef4a07e35847fbfc1e6f65566304ff45f39254dc6ce673fb3d96be021851f021d0a129e0611bdd6c6ec6ac2423e272e473e5212b571cf6b088ea9b6ddd2e9c91fffa7c4031b90dd5e23b0fc1eff39be0257f0fdb86cd54153917e345a98b82451e57c0258fcf887234a959ef74ff7d76f0fec3a126a91c40b7d8f02782fd73cfa09b1dc7839d894e7f6e5a50bff19c80cf968f9f3dc04ec853b0133b9b233b453115e2aac7394d70c917f0733c1e0544f03f6b22924c375e5388ae7c47aac0eea92a434b29464fb17c29169b8d5deb65fbb3afbbac636e737923957240d4a1e04d6552f8db9d36495af8250d08e0b3676372edbd921123d2bd76df1d2bee12370485ccbf020bbfc413804829cf762597e2ba7c67b5fa76cc9d9f246846ec7479b4fc0cfab673b6ce5873d213333cd7784b963f2d67131d01a31fd01a4db4cd48701bc4ffd5d223d3e41d58e070e8f160b9c3e459da777e0214b4525ba221cf9979fbfcd3b3ec44168c660bfdacb8568d1c7e64a677a04b232f6c11aa520c84550aa9758eebc493c548e24e1e588bbc0ff4c4165ec8074ac14df1c9ba7a66563692336747b76d6d3f131a43d5187dd3ca13b8810a212979b87b934e0d78c9208f6fbc8a9fdb03758e83d8569e5373de5911fc40951030e80e4089990843d1274b57bb042c0229ff5d97d5abcbf31a25ab9288993944bd69c9247c287c1b0decf26a69740cf157d081c83a816f58a385e27598c8b93aaa6111b5d8a578236572030fcdccf8b53ccc53a25a19f1c7e58ce84402c1c4fbc140d8bdc3755329e25ba97a03feaa9843d056bb716ff7b271c6c4f4c83455309cfc72089e607b3cecc2e1aac1a63da1d5739d717a0bb560a166c32bced868b926e781ad4a69244f9cd9272f455fc6c2540cb9e9db91348cc5f1f83a2bd5ccaae1751bb0e4502b4df41dbc0a70054817d6dc2cfc5cb3b9ae15477cb6a10fed140c83a756f65fed619bc2f121d3de10d9aa9cae62d483c30cf540108d335eb149f8432c677300d99cc7427ff42fc4c333997f677c9ada58f9df51f7e2e65b42ed50f2520daa1046ee2f5f57c174336172922d32e114ef649b2051dd31d68c075928b5240a76b7c91a19912f0cb9e4f1ff895bdd3bcb7332d60fca6db7be88795c24af457637cc5ac668c6d94e96fb9d61310b9bd1e3d07d33dd49be1c67c190bbbc168ecd9a8f9be6c4a9ca4ac0883761f0600ff250c830f26183a49c26295c3717a2113c96e251a2d41b1bc038c88edb6ff440f5805d9d60261525bd6f72c6dadf55afd9baf6dee95a0e6113fe2aaa9eceb4593909c4c1133e55d67feecadfbf96d9f1e14fb856da7daec178b274c2da58230f0e62f40ba5b828de6f867955b024cecb1b737fd6cf914a4aba03c14975dcbe8b0eb591586458d636440b8d8dcb7d5acc59465454bf5016e32b492e13af5b90056c517f29c3c1f97210427f558aec4aa8c52f21672ebbafc19abc76680aceb738fd61150b3df972a32c4d4ef422e7989b67d4d4b703fe5a2129bceb8ba25b81461b2203c074eb145962e7cf3f5acafb3017f95feb8a20cfb4289174b2e88c3ddfc94f0ae83e6ba71e621279c2e1c20215e897c9eb9564659272681fde98036a446b5687a9372fbd601d81fcc3501c47b2036ad3877fbbd08f28bb190b0aaa36112149b2a850af1e022a48545b469a40bdf8998400add6200097262b6bb433334a6bed0518f84141da8f501a2ee8c1d9d05a788643a87fdf5823cf4c3ca9bddeb8a7ada80c9cc08985768fcf6b2bebf86e6f5fe1de4d8114e0a74953a563a7aa57290d00026a06cccc853b37431f3302e7fccb3ee1c485b21b45ee5258ff269aac7d49f32e5c6ecc3df4f86dbf604dfa1eacfe3ab2d27f7867d2f110828da24f1535412dcd9755f63d0885fed8dc94ae8ef02c69f1efd342d5cd964942d287fddc44065efb0bdcfd008bb598cedb9db0485680192401d09bb4d74603784b3c9f3de15cc99ffa60d21d51fae27c034749e17c38b04e12fe090bf6191e5ef55cb71995d4e70765c97aedf7ea4cd5c7203804abb1e4986df97968c2b27fb54ba7aa320ec0ca7662307bbc27c0826282574570e14e3ea7ed135c021257dff69ddd02ce51b815e76abea49cc79695261bff6db8729d8b9166aa229d83a1396e39df4431773420f41da25894cf7128133b3c998ca6e263da8019c7447ffafd119c43431049f0d7e399ed6422a1bf43037dcdf2b620fc1fc2c0a7b98640b641e29b1ed909d43e569f0aa8b6bd725f7edbffe86ea95c8a96ec1ead3922863798ae336c9a1adf70562cb2e84552184cebd32e1c2fc30c666d8cb7bb9e97bc011da29d93d6aea96b8b561d7473c701263b2660e3d70711b513cd9e5582fbd93c8585d8848e65037ff8243926576bf3c6597829f18cce12f5bf7228347ea37e6c9d346105ff0253b69922041417dc7a3b7461774dbd93cad8ac60dbc8c2ed25469f1a66ed9bb1c669f776d6aa737a830f1b3012e58f0539244095a33a4dcd58e0a1a0d052108e012445dc4184ac4de5d7fd80097a9d3dcbfc34cdcb3ea3efbbfbdddd466e870479abfa5b1bc2f357949a28e6d375139d88d0338063784588f1edfbedc15c869963c808bb834a2c2f150f216dcd948c4869b51da4211f895e06c604e183aa4098b65c8d00f3ea79bf5dbe7ab8e1365396e61d511bb265038b416ba5eafac9c9ac0cff95cafb83f8939029c17df098b182ace41d5dd696db45b811a8c9c8b0f80d483e83aa2394928a81d815611986137f926c71e7f87cfc25013c092b0026ced1d470f0cb4f25350958163a78d1124d55826cda9bf29fc8ef237eb4c09d178b9eef9477a7c0ade513e808c3a262b0ce18e976b70a75dfb66a94a26d118ccaff25d9202ca55e1e2744b8a4b569c00956bc3fe6bdb2d5bbec6fff658d4828b4adabfd957397fe46facab03d5e60348bdf6852b853e86f78c406af7490c6c3d54464559db89e3e08150d1e871417ed2e", 0x1000, 0xfffffffffffffffc) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000001c68d8fd56295143cb700000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d2830147b00000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:22 executing program 1: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000180)={0x6, 0x8}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='oom_adj\x00') setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0x81, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x72db}, @in6={0xa, 0x4e24, 0x2, @local, 0x5}, @in6={0xa, 0x4e21, 0x9, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x6}, @in6={0xa, 0x4e21, 0x7, @loopback, 0x3}, @in6={0xa, 0x4e23, 0x7fffffff, @dev={0xfe, 0x80, [], 0x15}, 0x5}], 0x8c) r2 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000280)={0x11}) ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f0000000200)) 03:51:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1779.789200] binder: send failed reply for transaction 5683 to 986:1001 [ 1779.829857] binder: undelivered TRANSACTION_COMPLETE [ 1779.836362] binder: undelivered TRANSACTION_ERROR: 29201 [ 1779.846408] block nbd0: Device being setup by another task [ 1779.852248] binder: undelivered TRANSACTION_ERROR: 29189 [ 1779.895105] block nbd0: shutting down sockets 03:51:22 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000580)='/dev/input/mouse#\x00', 0x8, 0x41a503) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000005c0)={'teql0\x00', 0x1401}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:22 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0xffff, 0x60000) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x2000}) 03:51:22 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab06) [ 1779.915398] binder: 1056:1059 ioctl c018620b 0 returned -14 03:51:22 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x2c) [ 1779.996414] binder: 1056:1066 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1780.034612] binder: 1056:1066 BC_FREE_BUFFER u0000000000000000 no match 03:51:22 executing program 5: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhci\x00', 0x0, 0x0) write$selinux_load(r0, &(0x7f0000000280)={0xf97cff8c, 0x8, 'SE Linux', "1efce9bb8aedea378c89d94b2ae733f9dabbcad56ea853cd8cc6bed045122d0d6311791596ee3b90f880fa86229d247dad35b8ca1f28298e741243ec705e087226e1385055c866d9a51ef11a46057a06e260a890441dae9d5ac32c6090d82c9ad23d42653af672604ca6ab23af80b4ecd13700f28f77c3da53eab3d89cd9458461c859f3198a74d9da3abed9396d114df9a6052589b56f19ac8aed8108b879867155f27f74061ade4b06bc934e320b146f3ba781e3ecba98a9fb692ed6049df58dee472c67f919aedf83fa1af61cc2a916ef94c56805775a12e933e0bf9710f0c8bedd2a8dddc65357544ffeada0"}, 0xfe) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2c0000003500290800000000f50000000000f26daa78b59eb63a917901d18e000001c08aa45a46b4a011afb15352680be9719d561dc7b3ed700d28308ae51f49a700004a971042044c89d4dd117f18d80b0110ddf6dbce0cf82b7f814d1bccf3aa70bd2b6ddbdf6c998eeaab1fdbbe276dc59c8267a6d8ae85aa8fcd2a9765cfa6223a70a73f09c9946e2df04de63a181cb1d0eb6d820c65e37a0ee71abdebceab29bc168e164d74fb618fddbbe55f35641b2184360bfb50b6fc46d41b28"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) gettid() ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000140)=0x0) r3 = getpgrp(r2) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x6, 0xffffffffffffffff, 0x3, 0x6, 0x0, 0x1, 0x8010, 0x2, 0xe1b, 0x7ff, 0x5, 0x80000000, 0x8001, 0x8, 0x1, 0x7, 0x3000000000000, 0x2, 0x400, 0xfffffffffffff801, 0x4, 0x4, 0x80000001, 0x5, 0x2, 0xa4, 0x400, 0x3, 0x1, 0xff, 0x2, 0x8, 0x0, 0x0, 0x9, 0x3, 0x0, 0x4, 0x4, @perf_config_ext={0x6, 0x2}, 0xa, 0x6, 0x10001, 0xa, 0x6, 0x7, 0x2}, r3, 0x10, 0xffffffffffffff9c, 0xa) [ 1780.078423] block nbd0: Device being setup by another task [ 1780.080403] binder: 1056:1066 got reply transaction with bad transaction stack, transaction 5686 has target 1056:0 [ 1780.095476] binder: 1056:1066 transaction failed 29201/-71, size 0-0 line 2756 [ 1780.144824] block nbd0: shutting down sockets 03:51:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x74000000, 0x0}) 03:51:23 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) r2 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x0, 0x0) getsockopt$netlink(r2, 0x10e, 0xf, &(0x7f0000000080)=""/16, &(0x7f00000000c0)=0x10) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) 03:51:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:23 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x1278) 03:51:23 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) r0 = open$dir(&(0x7f00004daff8)='./file0\x00', 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)={{0x7f, 0x45, 0x4c, 0x46, 0x3, 0x2, 0xf219, 0xb5, 0x2, 0x3, 0x6, 0x5, 0x389, 0x40, 0x163, 0x9, 0x3, 0x38, 0x1, 0x20, 0x80000001, 0x5}, [{0x7, 0x0, 0x4, 0x7, 0x8, 0x1, 0x6, 0x8001}, {0x2, 0xe5d, 0x7, 0x1ff, 0x2, 0x7000000000000000, 0x6, 0x9}], "99b2e7f2bcdcc7d19c8a595c92531d322c8ad24ce7b363a2d8ba8d22d7af36733f9fb31685225655646db197e455c089807b4b00fe846aa92d8c9d5e34d063b9051647d3bfefeb0abc995bc0ec76fb0f5069143c1a391646c9ae690e34fed009eeb5e832fb33d9d1fceda8127b871a18a530663cfef4e3d187ea9b388b1f0c896e9f8a4316058ca117f076d9b927ec22a1521e8605991bb0b7805eb3c5b2516704"}, 0x151) ioctl$FS_IOC_SETVERSION(r0, 0x40086607, &(0x7f0000000500)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x408800, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, &(0x7f0000000040)) ioctl$VIDIOC_S_OUTPUT(r2, 0xc004562f, &(0x7f0000000080)=0x4) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c00000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000002000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:23 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x2c) [ 1780.716206] binder: send failed reply for transaction 5686 to 1056:1066 [ 1780.734738] binder: undelivered TRANSACTION_COMPLETE [ 1780.739978] binder: undelivered TRANSACTION_ERROR: 29201 [ 1780.757919] binder: undelivered TRANSACTION_ERROR: 29189 [ 1780.788716] block nbd0: Device being setup by another task [ 1780.817356] binder: 1099:1105 ioctl c018620b 0 returned -14 03:51:23 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) 03:51:23 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) getpeername$unix(r1, &(0x7f0000000040), &(0x7f00000000c0)=0x6e) 03:51:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1780.844802] block nbd0: shutting down sockets 03:51:23 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x80041284) [ 1780.894066] binder: 1099:1105 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1780.952069] binder: 1099:1105 BC_FREE_BUFFER u0000000000000000 no match [ 1780.981561] binder: 1099:1105 got reply transaction with bad transaction stack, transaction 5689 has target 1099:0 03:51:23 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x2c) 03:51:23 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0xfffd, 0x0) r1 = epoll_create1(0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x200, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) [ 1781.021841] binder: 1099:1105 transaction failed 29201/-71, size 0-0 line 2756 [ 1781.040638] block nbd0: Device being setup by another task 03:51:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x700, 0x0}) 03:51:23 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='eql\x00', 0x10) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, &(0x7f0000000140)) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0xffffffffffffff87, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x2) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x400000, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000040)={0x1d2, 0x59, 0x10000, 0x0, 0x1, 0x9, 0x3, 0xffffffffffffffff, 0x4, 0x8000, 0x8, 0xfffffffffffffffa, 0x0, 0x8, 0x6, 0x0, 0x9, 0x8, 0x81}) 03:51:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1781.128980] block nbd0: shutting down sockets [ 1781.137501] binder: send failed reply for transaction 5689 to 1099:1105 [ 1781.154981] binder: undelivered TRANSACTION_COMPLETE [ 1781.161109] binder: undelivered TRANSACTION_ERROR: 29201 03:51:23 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) r2 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x6, 0x400) recvmsg(r2, &(0x7f00000013c0)={&(0x7f0000000080)=@generic, 0x80, &(0x7f0000000380)=[{&(0x7f0000000100)=""/52, 0x34}, {&(0x7f0000000140)=""/181, 0xb5}, {&(0x7f0000000200)=""/103, 0x67}, {&(0x7f00000002c0)=""/151, 0x97}], 0x4, &(0x7f00000003c0)=""/4096, 0x1000}, 0x10000) [ 1781.198836] binder: undelivered TRANSACTION_ERROR: 29189 03:51:23 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000001c0)={0x0, @broadcast, @initdev}, &(0x7f0000000200)=0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000a40)={'eql\x00', 0x0}) recvmmsg(r0, &(0x7f00000036c0)=[{{&(0x7f0000000fc0)=@nfc_llcp, 0x80, &(0x7f0000002200)=[{&(0x7f0000001040)=""/148, 0x94}, {&(0x7f0000001100)=""/239, 0xef}, {&(0x7f0000001200)=""/4096, 0x1000}], 0x3}, 0x7fff}, {{&(0x7f0000002240)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000002300)=[{&(0x7f00000022c0)=""/17, 0x11}], 0x1, &(0x7f0000002340)=""/72, 0x48}, 0x100000000}, {{0x0, 0x0, &(0x7f00000035c0)=[{&(0x7f00000023c0)=""/247, 0xf7}, {&(0x7f00000024c0)}, {&(0x7f0000002500)=""/140, 0x8c}, {&(0x7f00000025c0)=""/4096, 0x1000}], 0x4, &(0x7f0000003600)=""/170, 0xaa}, 0x4}], 0x3, 0x2, &(0x7f0000003780)={0x77359400}) getsockname$packet(0xffffffffffffff9c, &(0x7f00000037c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000003800)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f0000003840)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000003880)=0x14) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000038c0)={0x0, @multicast2, @dev}, &(0x7f0000003900)=0xc) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000003a00)={0x0, @multicast2, @multicast1}, &(0x7f0000003a40)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000003c00)={{{@in6=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f0000003d00)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000003d40)={{{@in=@initdev, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@local}}, &(0x7f0000003e40)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000003f80)={'vcan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000004000)={'bond_slave_1\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000004400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000043c0)={&(0x7f0000004040)={0x354, r1, 0x8, 0x70bd2c, 0x25dfdbfb, {}, [{{0x8, 0x1, r2}, {0x4}}, {{0x8, 0x1, r3}, {0xf0, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r6}}}]}}, {{0x8, 0x1, r7}, {0x1e8, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x6c1}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r10}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r11}}}]}}, {{0x8, 0x1, r12}, {0x44, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8}}}]}}]}, 0x354}, 0x1, 0x0, 0x0, 0x804}, 0x4) 03:51:23 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x127d) 03:51:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1781.311715] binder: 1146:1151 ioctl c018620b 0 returned -14 [ 1781.393590] binder: 1146:1164 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1781.433677] binder: 1146:1164 BC_FREE_BUFFER u0000000000000000 no match 03:51:23 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) r2 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x1, 0x2) mkdirat$cgroup(r2, &(0x7f0000000080)='syz0\x00', 0x1ff) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) 03:51:23 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000]}, 0x2c) [ 1781.448899] block nbd0: Device being setup by another task [ 1781.455016] binder: 1146:1164 got reply transaction with bad transaction stack, transaction 5692 has target 1146:0 [ 1781.484436] binder: 1146:1164 transaction failed 29201/-71, size 0-0 line 2756 [ 1781.494723] block nbd0: shutting down sockets 03:51:23 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:23 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x1263) 03:51:24 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0xdd9) r2 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) write$selinux_load(r2, &(0x7f00000000c0)={0xf97cff8c, 0x8, 'SE Linux', "56cd850a9eda095f89935805586a71019fd958f47d1f5ac4a9d72d1978140a5859"}, 0x31) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) [ 1781.682674] block nbd0: Device being setup by another task [ 1781.735037] block nbd0: shutting down sockets 03:51:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x2, 0x0}) 03:51:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:24 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x125e) 03:51:24 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000]}, 0x2c) [ 1782.119338] binder: send failed reply for transaction 5692 to 1146:1164 [ 1782.126519] binder: undelivered TRANSACTION_COMPLETE [ 1782.154553] binder: undelivered TRANSACTION_ERROR: 29201 [ 1782.160056] binder: undelivered TRANSACTION_ERROR: 29189 [ 1782.170011] block nbd0: Device being setup by another task [ 1782.214186] binder: 1213:1214 ioctl c018620b 0 returned -14 [ 1782.221055] block nbd0: shutting down sockets [ 1782.274425] binder: 1213:1222 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1782.289949] binder: 1213:1222 BC_FREE_BUFFER u0000000000000000 no match 03:51:24 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000004598f9c2144dc24632cf7a802b5f3500290800000000f53f49b50300002018000000000000000001c08aa45a46b4a011afb1d30000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x400, 0x0) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000000c0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000001c0)={{{@in6=@initdev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000000140)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000a40)={'team0\x00', 0x0}) fstat(r0, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000340), 0x4) ioctl$KVM_GET_SUPPORTED_CPUID(r1, 0xc008ae05, &(0x7f00000002c0)=""/125) sendmsg$nl_xfrm(r1, &(0x7f0000000f00)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000b00)=@expire={0x398, 0x18, 0x100, 0x70bd2b, 0x25dfdbfb, {{{@in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, @in=@broadcast, 0x4e23, 0x0, 0x4e20, 0x0, 0xa, 0x80, 0x20, 0x3c, r2, r3}, {@in=@broadcast, 0x4d2, 0x33}, @in6=@dev={0xfe, 0x80, [], 0xa}, {0x6, 0x5, 0x4, 0x1, 0x100000001, 0x3, 0x7fff}, {0x4, 0x9, 0x81}, {0x0, 0xffffffffffffffff, 0x9}, 0x70bd2c, 0x3500, 0xa, 0x2, 0x3ff, 0x8}, 0x7f}, [@sa={0xe4, 0x6, {{@in=@broadcast, @in6=@loopback, 0x4e21, 0x6, 0x4e23, 0x0, 0xa, 0x80, 0xe5d19c971250d01d, 0x16, r4, r5}, {@in=@rand_addr=0xa2a, 0x4d3, 0xff}, @in=@local, {0x0, 0xfffffffffffffff8, 0xde4, 0x9, 0x534, 0x7ff, 0x7, 0x100000001}, {0x1, 0x9, 0x1, 0x4}, {0x1, 0x6, 0xe5}, 0x70bd28, 0x3506, 0xa, 0x3, 0x7, 0x62}}, @migrate={0x1bc, 0x11, [{@in=@broadcast, @in6=@mcast1, 0x0, 0x3, 0x0, 0x3501, 0x2, 0x2}, {@in=@multicast1, @in6=@dev={0xfe, 0x80, [], 0x18}, 0x2b, 0x6, 0x0, 0x3502, 0x2, 0xa}, {@in=@multicast1, @in=@empty, 0x3f, 0x6, 0x0, 0x3503, 0x2, 0xa}, {@in, @in=@remote, 0x7f, 0x2, 0x0, 0x3500, 0xa, 0xa}, {@in=@rand_addr=0x2, @in=@multicast1, 0xff, 0x2, 0x0, 0x3501, 0x2, 0xa}, {@in=@broadcast, @in6, 0xff, 0x4, 0x0, 0x34ff, 0xa, 0xa}, {@in=@broadcast, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x33, 0x7, 0x0, 0x34ff, 0x2, 0xa}, {@in=@loopback, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x6f, 0x0, 0x0, 0x34ff, 0xa}, {@in6=@loopback, @in6=@mcast1, 0x32, 0x3, 0x0, 0x3506, 0x2, 0xa}, {@in6=@loopback, @in6=@loopback, 0x7e, 0x6, 0x0, 0x0, 0xa, 0xa}]}]}, 0x398}}, 0x40400d4) 03:51:24 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) ioctl$VIDIOC_SUBDEV_S_CROP(r0, 0xc038563c, &(0x7f0000000040)={0x0, 0x0, {0x400, 0x4f35839d, 0x403d, 0x9}}) 03:51:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00p\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:24 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x80081272) [ 1782.316423] binder: 1213:1222 got reply transaction with bad transaction stack, transaction 5695 has target 1213:0 [ 1782.327937] binder: 1213:1222 transaction failed 29201/-71, size 0-0 line 2756 03:51:24 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}, 0x2c) 03:51:24 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r1, &(0x7f0000000040)={0x80000000}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x400200, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f00000000c0)={0x9, 0x8002, 0x5, 0x0, 0x0}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000140)={r3, 0x63d}, &(0x7f0000000180)=0x8) write$FUSE_OPEN(r2, &(0x7f0000000240)={0x20, 0x0, 0x3, {0x0, 0x2}}, 0x20) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f00000001c0), &(0x7f0000000200)=0x4) [ 1782.424197] block nbd0: Device being setup by another task 03:51:24 executing program 5: r0 = openat(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0x8000, 0x1) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000200)={0x6, 0x0, 0x2, 0xffffffff}) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000140)={0x34f1, r1, 0x10003, 0x1bf1}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f00000001c0)={0x2, r2}) signalfd(r0, &(0x7f0000000240)={0xff}, 0x8) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d2060035000000000008e7ac57b63cb74af37f1f7a267e57f3e0cf044dbd27426a31236d1b49267b017ee0833316d986e2c9a64f83d38d51f98102b9483a7c356335204bab440850b39b4915fc8d3c6b663575364b1164af24c9f6b61cf7e8852e3b63"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1782.474907] block nbd0: shutting down sockets 03:51:24 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x700000000000000, 0x0}) 03:51:25 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x401, 0x4180) ioctl$BLKROSET(r1, 0x125d, &(0x7f0000000040)=0x4) 03:51:25 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x541b) 03:51:25 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) fsetxattr$security_selinux(r0, &(0x7f0000000040)='security.selinux\x00', &(0x7f0000000080)='system_u:object_r:logrotate_exec_t:s0\x00', 0x26, 0x3) 03:51:25 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:25 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}, 0x2c) [ 1783.021477] binder: send failed reply for transaction 5695 to 1213:1222 [ 1783.068101] binder: undelivered TRANSACTION_COMPLETE 03:51:25 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) [ 1783.095600] audit: type=1400 audit(2000001085.460:223): avc: denied { associate } for pid=1262 comm="syz-executor1" name="video7" dev="devtmpfs" ino=16050 scontext=system_u:object_r:logrotate_exec_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem permissive=1 [ 1783.097581] block nbd0: Device being setup by another task 03:51:25 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:25 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) r2 = accept4$nfc_llcp(0xffffffffffffff9c, &(0x7f0000000040), &(0x7f00000000c0)=0x60, 0x800) getsockopt$sock_int(r2, 0x1, 0x1f, &(0x7f0000000100), &(0x7f0000000140)=0x4) [ 1783.164821] block nbd0: shutting down sockets [ 1783.166062] binder: 1263:1282 ioctl c018620b 0 returned -14 [ 1783.208703] binder: 1263:1286 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1783.245864] binder: 1263:1286 BC_FREE_BUFFER u0000000000000000 no match 03:51:25 executing program 5: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x80000000, 0x2000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'veth0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', r1}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0xffffffffffffffcb, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:25 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) getrandom(&(0x7f0000000040)=""/52, 0x34, 0x3) 03:51:25 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x80041285) [ 1783.278696] binder: 1263:1286 got reply transaction with bad transaction stack, transaction 5698 has target 1263:0 [ 1783.377822] binder: 1263:1286 transaction failed 29201/-71, size 0-0 line 2756 03:51:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x6000000000000000, 0x0}) 03:51:25 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000]}, 0x2c) 03:51:25 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:25 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080)={0x11}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) ioctl$IOC_PR_RESERVE(r2, 0x401070c9, &(0x7f0000000100)={0x8000, 0x3}) syz_open_dev$video(&(0x7f0000000040)='/dev/video#\x00', 0x5, 0x40) 03:51:25 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) delete_module(&(0x7f0000000000)='\x00', 0x200) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1783.432095] block nbd0: Device being setup by another task [ 1783.451897] binder: send failed reply for transaction 5698 to 1263:1286 [ 1783.459506] binder: undelivered TRANSACTION_COMPLETE [ 1783.470356] block nbd0: shutting down sockets 03:51:25 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:25 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x40087602) [ 1783.629799] binder: 1320:1326 ioctl c018620b 0 returned -14 03:51:26 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x40000, 0x4) ioctl$KDSETMODE(r1, 0x4b3a, 0x1) ioctl$VHOST_GET_VRING_ENDIAN(r1, 0x4008af14, &(0x7f0000000040)={0x2, 0x7}) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:26 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) openat$userio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/userio\x00', 0x40a040, 0x0) [ 1783.689816] block nbd0: Device being setup by another task [ 1783.698432] binder: 1320:1335 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1783.723714] binder: 1320:1335 BC_FREE_BUFFER u0000000000000000 no match 03:51:26 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1783.754691] binder: 1320:1335 got reply transaction with bad transaction stack, transaction 5701 has target 1320:0 [ 1783.766333] block nbd0: shutting down sockets [ 1783.786998] binder: 1320:1335 transaction failed 29201/-71, size 0-0 line 2756 03:51:26 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000026000000000000000001c08aa45a46b4a011c0b1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 03:51:26 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab07) [ 1784.003254] block nbd0: Device being setup by another task [ 1784.034962] block nbd0: shutting down sockets 03:51:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x7000000, 0x0}) 03:51:26 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) ioctl$VIDIOC_G_STD(r0, 0x80085617, &(0x7f0000000040)) 03:51:26 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x2c) 03:51:26 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = dup2(r0, r0) ioctl$SIOCNRDECOBS(r1, 0x89e2) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f0000000000)=""/30, &(0x7f0000000040)=0x1e) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:26 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01p\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:26 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x401870cb) [ 1784.376004] binder: send failed reply for transaction 5701 to 1320:1335 [ 1784.409175] binder: undelivered TRANSACTION_COMPLETE 03:51:26 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0xfffffffffffffdba, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYRESDEC], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1784.421889] binder_release_work: 4 callbacks suppressed [ 1784.421896] binder: undelivered TRANSACTION_ERROR: 29201 [ 1784.446303] binder: undelivered TRANSACTION_ERROR: 29189 [ 1784.470218] block nbd0: Device being setup by another task 03:51:26 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:26 executing program 1: syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r0 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000280)={0x11}) [ 1784.523563] binder: 1374:1379 ioctl c018620b 0 returned -14 [ 1784.545831] block nbd0: shutting down sockets 03:51:27 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x1265) [ 1784.578407] binder: 1374:1379 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1784.618548] binder: 1374:1379 BC_FREE_BUFFER u0000000000000000 no match [ 1784.652136] binder: 1374:1379 got reply transaction with bad transaction stack, transaction 5704 has target 1374:0 03:51:27 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0x88, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_MEDIA={0x50, 0x5, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf9aa}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}]}, @TIPC_NLA_NET={0x24, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xb9a4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x719}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4880}, 0x0) 03:51:27 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) r2 = syz_open_dev$media(&(0x7f0000000300)='/dev/media#\x00', 0x3, 0x503c40) ioctl$SIOCX25SFACILITIES(r2, 0x89e3, &(0x7f0000000340)={0x57, 0x1000, 0x7, 0x8, 0x8000}) ioctl$VIDIOC_QUERYSTD(r0, 0x8008563f, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x4000, 0x0) sendmsg$nl_crypto(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)=@alg={0x120, 0x10, 0x320, 0x70bd2a, 0x25dfdbff, {{'aegis128-generic\x00'}, [], [], 0x400, 0x2400}, [{0x8, 0x1, 0x74e}, {0x8, 0x1, 0x7f}, {0x8, 0x1, 0x50000000000000}, {0x8, 0x1, 0xb47}, {0x8, 0x1, 0xffff}, {0x8, 0x1, 0xffffffffffffffb4}, {0x8, 0x1, 0x8001}, {0x8, 0x1, 0xfffffffffffff0c1}]}, 0x120}, 0x1, 0x0, 0x0, 0x80}, 0x4000) [ 1784.695378] binder: 1374:1379 transaction failed 29201/-71, size 0-0 line 2756 [ 1784.734116] block nbd0: Device being setup by another task [ 1784.821232] block nbd0: shutting down sockets 03:51:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x4000000, 0x0}) 03:51:27 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}, 0x2c) 03:51:27 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:27 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) r2 = syz_open_procfs(r1, &(0x7f0000000040)='net\x00') sched_getscheduler(r1) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0}, &(0x7f00000000c0)=0xc) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(r3, r4, r5) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1784.856845] binder: send failed reply for transaction 5704 to 1374:1379 [ 1784.864105] binder: undelivered TRANSACTION_COMPLETE 03:51:27 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x200, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000002c0)={0x36c, r3, 0x700, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x54, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xeb7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xd7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7e}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x4}]}, @TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}]}, @TIPC_NLA_NODE={0x24, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x40}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x59}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}]}, @TIPC_NLA_LINK={0xe8, 0x4, [@TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7d3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9000000000000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}]}]}, @TIPC_NLA_MEDIA={0x104, 0x5, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffff801}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffb}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9b}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x76a16a18}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8e}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}]}, @TIPC_NLA_LINK={0x44, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_BEARER={0x70, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @loopback}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x2, @empty, 0x401}}}}]}, @TIPC_NLA_NET={0x28, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}]}]}, 0x36c}, 0x1, 0x0, 0x0, 0x4000000}, 0x810) [ 1784.902423] binder: undelivered TRANSACTION_ERROR: 29201 [ 1784.930484] binder: undelivered TRANSACTION_ERROR: 29189 03:51:27 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x5460) 03:51:27 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:27 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) [ 1784.981002] binder: 1416:1419 ioctl c018620b 0 returned -14 [ 1785.068422] binder: 1416:1419 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:51:27 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b503000000180000000000000000f1bf8aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1785.126436] binder: 1416:1419 BC_FREE_BUFFER u0000000000000000 no match [ 1785.133470] block nbd0: Device being setup by another task [ 1785.138351] binder: 1416:1419 got reply transaction with bad transaction stack, transaction 5707 has target 1416:0 03:51:27 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\xff\xff\xfe\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1785.205031] block nbd0: shutting down sockets [ 1785.210289] binder: 1416:1419 transaction failed 29201/-71, size 0-0 line 2756 03:51:27 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) 03:51:27 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x2c) 03:51:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0xa, 0x0}) 03:51:27 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x80087601) 03:51:27 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x811) [ 1785.288788] binder: send failed reply for transaction 5707 to 1416:1419 [ 1785.305506] binder: undelivered TRANSACTION_COMPLETE [ 1785.310662] binder: undelivered TRANSACTION_ERROR: 29201 [ 1785.395713] binder: undelivered TRANSACTION_ERROR: 29189 [ 1785.406956] binder: 1452:1457 ioctl c018620b 0 returned -14 03:51:27 executing program 5: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r0, 0x40086408, &(0x7f0000000200)={0xff, 0xffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280)='/dev/net/tun\x00', 0x80180, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x2400, 0x0) ioctl$TUNSETFILTEREBPF(r2, 0x800454e1, &(0x7f0000000140)=r3) ioctl$VT_SETMODE(r3, 0x5602, &(0x7f0000000240)={0x0, 0x83, 0x7, 0x1, 0x32}) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x301040, 0x0) ioctl$TIOCLINUX6(r4, 0x541c, &(0x7f00000001c0)={0x6, 0xfff}) ioctl$KVM_HYPERV_EVENTFD(r4, 0x4018aebd, &(0x7f0000000040)={0x0, r1}) 03:51:27 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) r2 = socket$key(0xf, 0x3, 0x2) ioctl$sock_inet_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000040)={'veth0_to_team\x00', {0x2, 0x4e20, @remote}}) 03:51:27 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1785.449384] block nbd0: Device being setup by another task [ 1785.485932] binder: 1452:1469 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1785.514993] block nbd0: shutting down sockets [ 1785.534809] binder: 1452:1469 BC_FREE_BUFFER u0000000000000000 no match [ 1785.574990] binder: 1452:1469 got reply transaction with bad transaction stack, transaction 5710 has target 1452:0 [ 1785.582032] Unknown ioctl 22018 [ 1785.594252] Unknown ioctl 22018 03:51:27 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab02) 03:51:28 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}, 0x2c) 03:51:28 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1785.618324] binder: 1452:1469 transaction failed 29201/-71, size 0-0 line 2756 03:51:28 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x40000) 03:51:28 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) r2 = dup2(r0, r0) ioctl$EVIOCRMFF(r2, 0x40044581, &(0x7f00000000c0)=0xb24) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1, 0x108) mknodat(r3, &(0x7f0000000080)='./file0\x00', 0x20, 0x800) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x80000011}) [ 1785.743645] block nbd0: Device being setup by another task 03:51:28 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1785.824873] block nbd0: shutting down sockets 03:51:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) finit_module(r0, &(0x7f0000000240)=')@lo\'bdev/\x00', 0x3) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r4 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0xfffffffffffff800, 0x902) ioctl$PPPIOCSFLAGS(r4, 0x40047459, &(0x7f0000000140)=0x420000) getsockopt$inet_sctp6_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f00000002c0), &(0x7f00000004c0)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r5 = dup3(r2, r3, 0x7ffff) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r5, 0x80045700, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="e41c2b262c3c4983"], 0x0, 0x0, 0x0}) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000180)={0x1, [0x0]}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000380)={r6, @in6={{0xa, 0x4e24, 0x9, @local, 0xa34b}}, 0x10000, 0x7f, 0xffffffff, 0x401, 0x80}, 0x98) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 03:51:28 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000001c0)={{{@in, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@empty}}, &(0x7f0000000080)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in6=@ipv4={[], [], @multicast2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4}, 0x0, @in6=@mcast1}}, &(0x7f00000000c0)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'gre0\x00', 0x0}) recvmmsg(r0, &(0x7f0000004b00)=[{{&(0x7f0000000500)=@tipc, 0x80, &(0x7f0000000700)=[{&(0x7f0000000580)=""/102, 0x66}, {&(0x7f0000000600)=""/210, 0xd2}], 0x2, &(0x7f0000000740)=""/58, 0x3a}, 0x6}, {{&(0x7f0000000780)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000019c0)=[{&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000001800)=""/147, 0x93}, {&(0x7f00000018c0)=""/214, 0xd6}], 0x3, &(0x7f0000001a00)=""/96, 0x60}, 0x5}, {{&(0x7f0000001a80)=@caif=@dbg, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001b00)=""/202, 0xca}], 0x1, &(0x7f0000001c40)=""/153, 0x99}, 0x401}, {{&(0x7f0000001d00)=@hci, 0x80, &(0x7f0000003040)=[{&(0x7f0000001d80)=""/169, 0xa9}, {&(0x7f0000001e40)=""/15, 0xf}, {&(0x7f0000001e80)=""/251, 0xfb}, {&(0x7f0000001f80)=""/121, 0x79}, {&(0x7f0000002000)=""/4096, 0x1000}, {&(0x7f0000003000)=""/35, 0x23}], 0x6, &(0x7f00000030c0)=""/144, 0x90}, 0xace7}, {{&(0x7f0000003180)=@pppoe, 0x80, &(0x7f00000033c0)=[{&(0x7f0000003200)=""/213, 0xd5}, {&(0x7f0000003300)=""/160, 0xa0}], 0x2, &(0x7f0000003400)}, 0x1}, {{&(0x7f0000003440)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000004940)=[{&(0x7f00000034c0)=""/3, 0x3}, {&(0x7f0000003500)=""/148, 0x94}, {&(0x7f00000035c0)=""/187, 0xbb}, {&(0x7f0000003680)=""/106, 0x6a}, {&(0x7f0000003700)=""/14, 0xe}, {&(0x7f0000003740)=""/24, 0x18}, {&(0x7f0000003780)=""/184, 0xb8}, {&(0x7f0000003840)=""/4096, 0x1000}, {&(0x7f0000004840)}, {&(0x7f0000004880)=""/142, 0x8e}], 0xa, &(0x7f0000004a00)=""/206, 0xce}}], 0x6, 0x0, 0x0) getsockname$packet(0xffffffffffffff9c, &(0x7f0000007c80)={0x11, 0x0, 0x0}, &(0x7f0000007cc0)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000007d00)={{{@in6=@dev, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000007e00)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000007f00)={'team0\x00', 0x0}) getsockname(r0, &(0x7f0000007f40)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000007fc0)=0x80) sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f0000008300)={&(0x7f0000000000), 0xc, &(0x7f00000082c0)={&(0x7f0000008000)={0x2a8, r1, 0x602, 0x70bd29, 0x25dfdbfc, {}, [{{0x8, 0x1, r2}, {0x184, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0xfff}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r4}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}]}}, {{0x8, 0x1, r5}, {0x44, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x1f}}, {0x8, 0x6, r6}}}]}}, {{0x8, 0x1, r7}, {0xb4, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x80000000}}}]}}]}, 0x2a8}, 0x1, 0x0, 0x0, 0x8040}, 0x1) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:28 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab00) 03:51:28 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r1, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r2 = socket$inet6(0xa, 0x5, 0x0) r3 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x1000, 0x100) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f00000002c0)={0x0, 0xb3, "97f4240caffab706717b99befbed4ab509115ef8c463c6944fa93b4cb3541bd39d5b141b714e3a1df855a2a621d05d97edf0437f1c20dd0bdbe7650be66e91016a6407834a46f37f135e96a5f254d05635c44757e65c8b7b3cdc7acb58d58084fbce9ed8599f05da3b892a9b40a654f4c86dc943f8ac86644678bf2a4e0fe9af53950a724bc32942532ee46133b61c8f02754fbde90bb8a33197dd05269116888d1ef053097d00f09fbd63272e981a26e0fc62"}, &(0x7f00000000c0)=0xbb) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000100)={r4, 0x4b2b55ab}, &(0x7f0000000200)=0x8) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e21}, 0x1c) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000000)=0x1ff, 0x4) listen(r2, 0xffffffff) read(r2, &(0x7f0000000140)=""/113, 0x444) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) close(r2) sendto$inet6(r5, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x40004e23, 0x0, @loopback}, 0x1c) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r0, &(0x7f0000000280)={0x11}) 03:51:28 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}, 0x2c) 03:51:28 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1786.197260] binder: send failed reply for transaction 5710 to 1452:1469 [ 1786.204186] binder: undelivered TRANSACTION_COMPLETE [ 1786.250098] binder: undelivered TRANSACTION_ERROR: 29201 [ 1786.269443] binder: undelivered TRANSACTION_ERROR: 29189 [ 1786.276713] block nbd0: Device being setup by another task 03:51:28 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) r2 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x9, 0x200) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x4001ff) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x30, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a427300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) prctl$PR_CAPBSET_READ(0x17, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 1786.300589] binder: 1521:1527 ioctl c018620b 0 returned -14 [ 1786.335135] block nbd0: shutting down sockets 03:51:28 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xc0189436) 03:51:28 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1786.463967] binder: 1547:1549 ioctl c018620b 0 returned -14 [ 1786.499707] block nbd0: Device being setup by another task [ 1786.530782] binder: 1547:1557 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1786.554776] block nbd0: shutting down sockets [ 1786.555797] binder: 1547:1557 BC_FREE_BUFFER u0000000000000000 no match 03:51:28 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x2c) 03:51:29 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:29 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x1261) [ 1786.586561] binder: 1547:1557 got reply transaction with bad transaction stack, transaction 5713 has target 1547:0 [ 1786.603005] binder: 1547:1557 transaction failed 29201/-71, size 0-0 line 2756 [ 1786.718404] block nbd0: Device being setup by another task [ 1786.754912] block nbd0: shutting down sockets 03:51:29 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:29 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x80081270) 03:51:29 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) r2 = gettid() sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) 03:51:29 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c0000ef3400290800000000f53f49b50379000018000000000000000001c08aa45a46b44f11afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000ab5d17d239292e977be6c3a648"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:29 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000]}, 0x2c) 03:51:29 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1787.078577] block nbd0: Device being setup by another task [ 1787.115305] block nbd0: shutting down sockets [ 1787.253959] binder_alloc: binder_alloc_mmap_handler: 1547 20001000-20004000 already mapped failed -16 [ 1787.276722] binder: 1547:1604 ioctl c018620b 0 returned -14 [ 1787.310402] binder: BINDER_SET_CONTEXT_MGR already set [ 1787.324755] binder: 1547:1603 ioctl 40046207 0 returned -16 [ 1787.331542] binder_alloc: 1547: binder_alloc_buf, no vma [ 1787.337641] binder: 1547:1557 transaction failed 29189/-3, size 24-0 line 2973 [ 1787.349085] binder: release 1547:1557 transaction 5713 out, still active [ 1787.353189] binder: 1547:1603 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1787.358450] binder: undelivered TRANSACTION_COMPLETE [ 1787.382196] binder: undelivered TRANSACTION_ERROR: 29201 [ 1787.388314] binder: send failed reply for transaction 5713, target dead [ 1787.395044] binder: 1547:1603 BC_FREE_BUFFER u0000000000000000 no match [ 1787.401958] binder: 1547:1603 got reply transaction with no transaction stack 03:51:29 executing program 4: openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x60, 0x0, &(0x7f0000000500)=[@clear_death, @enter_looper, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x76, 0x0, 0x0}) 03:51:29 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x1262) 03:51:29 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) close(r0) 03:51:29 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1787.409417] binder: 1547:1603 transaction failed 29201/-71, size 0-0 line 2741 [ 1787.423809] binder: undelivered TRANSACTION_ERROR: 29189 03:51:29 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000]}, 0x2c) 03:51:29 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x80003) r2 = accept4(0xffffffffffffffff, &(0x7f0000000200)=@ipx, &(0x7f0000000100)=0xffffffffffffff34, 0x0) getsockopt$bt_BT_RCVMTU(r2, 0x112, 0xd, &(0x7f00000000c0)=0x6, &(0x7f0000000180)=0x2) ioctl$VIDIOC_TRY_ENCODER_CMD(r0, 0xc028564e, &(0x7f0000000640)={0x2, 0x1, [0x2, 0xb64c, 0x101, 0xb2d, 0x0, 0x9e, 0xfffffffffffffffe, 0xffffffff]}) ioctl$SIOCX25SCAUSEDIAG(r2, 0x89ec, &(0x7f0000000080)={0x3f, 0x100000001}) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0x7, &(0x7f0000000140)={0x1000, 0x10000, 0x7f, 0x3}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x14}) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000280)={{{@in, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000001c0)=0x57) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000380)={{{@in, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}}}, &(0x7f0000000480)=0xe8) r5 = syz_open_dev$mice(&(0x7f0000000680)='/dev/input/mice\x00', 0x0, 0x200000) ioctl$KVM_GET_API_VERSION(r5, 0xae00, 0x0) r6 = openat$vsock(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vsock\x00', 0x100, 0x0) write$P9_RCLUNK(r6, &(0x7f0000000600)={0x7, 0x79, 0x1}, 0x7) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@mcast2, @in6=@local, 0x4e22, 0x800, 0x4e20, 0xf9f, 0xa, 0x80, 0x80, 0xb7, r3, r4}, {0x47, 0x1, 0x5, 0x9fd, 0xffffffff, 0x7, 0x9, 0x3}, {0xf55, 0x1ff5, 0x0, 0x401}, 0x8, 0x6e6bb5, 0x2, 0x0, 0x3, 0x3}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4d2, 0x3b}, 0x2, @in6=@ipv4={[], [], @local}, 0x3505, 0x4, 0x3, 0xb41, 0x9, 0x0, 0x2}}, 0xe8) 03:51:29 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1787.533837] binder: 1611:1622 ioctl c018620b 0 returned -14 [ 1787.546369] block nbd0: Device being setup by another task 03:51:29 executing program 5: r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x100000001, 0x0) ioctl$EVIOCGABS0(r0, 0x80184540, &(0x7f0000000040)=""/107) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc6b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1787.593553] block nbd0: shutting down sockets [ 1787.619332] binder: 1611:1617 transaction failed 29189/-22, size 24-0 line 2834 03:51:30 executing program 1: r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f0000000080)=0xe032, 0x4) r1 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000280)={0x11}) r3 = syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x2, 0x200601) ioctl$GIO_FONT(r3, 0x4b60, &(0x7f0000000180)=""/123) [ 1787.677107] binder: 1611:1622 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:51:30 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab04) 03:51:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') r2 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x2800, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='syscall\x00') ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f00000001c0)={r3, 0x0, 0x10000, 0xfffffffff0002000}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000480)={{{@in6=@mcast2, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f00000003c0)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000700)={'lapb0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000740)={{{@in6=@local, @in6=@ipv4={[], [], @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@mcast1}}, &(0x7f0000000840)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000980)={'vcan0\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00000009c0)={{{@in6=@mcast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@loopback}}, &(0x7f0000000ac0)=0xe8) accept4$packet(r0, &(0x7f0000000c00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000c40)=0x14, 0x80800) accept4$packet(0xffffffffffffffff, &(0x7f0000000c80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000cc0)=0x14, 0x80800) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000d00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000d40)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000d80)={'vcan0\x00', 0x0}) accept4$packet(0xffffffffffffffff, &(0x7f0000000dc0)={0x11, 0x0, 0x0}, &(0x7f0000000e00)=0x14, 0x80800) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000e40)={{{@in6=@ipv4={[], [], @multicast1}, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@initdev}}, &(0x7f0000000f40)=0xe8) accept$packet(0xffffffffffffff9c, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000fc0)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f0000001000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000001040)=0x14) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1b, &(0x7f0000001100)={@initdev, 0x0}, &(0x7f0000001140)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000001180)={{{@in6=@mcast2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@loopback}}, &(0x7f0000001280)=0xe8) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f00000012c0)={@dev, @loopback, 0x0}, &(0x7f0000001300)=0xc) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f0000000200)={0x88, @time={0x77359400}, 0xeff, {0x9, 0x374b1eb1}, 0x1, 0x0, 0x9}) getsockname$packet(0xffffffffffffff9c, &(0x7f00000014c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000001500)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001540)={{{@in6=@initdev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000001640)=0xe8) time(&(0x7f0000000080)) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000001680)={0x0, @dev, @local}, &(0x7f00000016c0)=0xc) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001e00)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x12800000}, 0xc, &(0x7f0000001dc0)={&(0x7f0000001700)={0x694, r1, 0x10, 0x70bd28, 0x25dfdbfb, {}, [{{0x8, 0x1, r4}, {0x1b4, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r5}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x100000000}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x3}}}]}}, {{0x8, 0x1, r9}, {0x1ec, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x253e}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r11}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x8001}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r12}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r13}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r14}}, {0x8}}}]}}, {{0x8, 0x1, r15}, {0xbc, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x4e6}}, {0x8}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r16}}}]}}, {{0x8, 0x1, r17}, {0x184, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r18}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r19}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffff800}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r20}}}, {0x44, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x14, 0x4, [{0x8, 0x200, 0x9, 0x6259556}, {0xf0b, 0x7, 0x1, 0x4}]}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}]}}, {{0x8, 0x1, r21}, {0x78, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r22}}}]}}]}, 0x694}, 0x1, 0x0, 0x0, 0x8005}, 0x1) 03:51:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1787.745202] binder: 1611:1622 got reply transaction with no transaction stack [ 1787.831068] binder: 1611:1622 transaction failed 29201/-71, size 0-0 line 2741 [ 1787.863422] binder: 1611:1622 ioctl c0306201 20000480 returned -14 [ 1787.887317] block nbd0: shutting down sockets [ 1787.902963] block nbd0: Device being setup by another task 03:51:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) r3 = getpgrp(0x0) sched_rr_get_interval(r3, &(0x7f00000000c0)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0f630c4000000000000000000000000003630840", @ANYRES64=0x0, @ANYBLOB="e36cbd38bb85e01f7c1263484000000000000000000000000048d1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ce320d2be41f48ce76003ceb8800"], 0x0, 0x0, 0x0}) 03:51:30 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x800, 0x0) connect$pptp(r1, &(0x7f0000000140)={0x18, 0x2, {0x0, @multicast2}}, 0x1e) syz_genetlink_get_family_id$fou(&(0x7f0000000180)='fou\x00') r2 = epoll_create1(0x0) epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000280)={0x11}) r3 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x3, 0x2) getsockopt$bt_BT_POWER(r3, 0x112, 0x9, &(0x7f0000000080)=0x80, &(0x7f00000000c0)=0x1) 03:51:30 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x2c) [ 1787.935119] audit: type=1400 audit(2000001090.290:224): avc: denied { accept } for pid=1646 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 03:51:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:30 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x80086601) 03:51:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4f011afb1d330680be9719d561dc7b3ed7004000000e51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1788.096318] binder: 1666:1670 ioctl c018620b 0 returned -14 03:51:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00p\x01\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1788.176394] binder: 1666:1684 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1788.189947] binder: 1666:1684 BC_FREE_BUFFER u0000000000000000 no match [ 1788.201188] block nbd0: Device being setup by another task 03:51:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be971ed700d31308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1788.227801] binder: 1666:1684 unknown command 951938275 [ 1788.235132] block nbd0: shutting down sockets [ 1788.246035] binder: 1666:1684 ioctl c0306201 20000480 returned -22 03:51:30 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x2c) 03:51:30 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xb, 0x7b, 0x7, 0x5, 0x24, 0xffffffffffffff9c, 0xd7}, 0x2c) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000080)=0x3, 0x4) 03:51:30 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x40101283) 03:51:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1788.513578] block nbd0: Device being setup by another task [ 1788.574832] block nbd0: shutting down sockets [ 1788.868892] binder_alloc: binder_alloc_mmap_handler: 1666 20001000-20004000 already mapped failed -16 [ 1788.878721] binder: 1666:1684 ioctl c018620b 0 returned -14 [ 1788.884867] binder: BINDER_SET_CONTEXT_MGR already set [ 1788.890213] binder: 1666:1684 ioctl 40046207 0 returned -16 [ 1788.890410] binder_alloc: 1666: binder_alloc_buf, no vma [ 1788.901494] binder: 1666:1718 transaction failed 29189/-3, size 24-0 line 2973 [ 1788.909195] binder: release 1666:1684 transaction 5720 out, still active 03:51:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 03:51:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) fstat(r0, &(0x7f0000000000)) 03:51:31 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) ioctl$VIDIOC_ENUMSTD(r0, 0xc0485619, &(0x7f0000000040)={0xa5f, 0x2, "7118b2fadb7eae7050c9f09d4ef8cf3bfb5beb9c06a9a148", {0x7fff}}) r2 = syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x2, 0x2) ioctl$sock_bt_hidp_HIDPCONNDEL(r2, 0x400448c9, &(0x7f0000000100)={{0x8d79, 0x1, 0x7, 0x7, 0x171, 0x10001}, 0x2}) syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x100, 0x1) 03:51:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:31 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x2c) 03:51:31 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x127e) [ 1788.909204] binder: 1666:1684 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1788.909223] binder: 1666:1684 BC_FREE_BUFFER u0000000000000000 no match [ 1788.916741] binder: undelivered TRANSACTION_COMPLETE [ 1788.923296] binder: 1666:1684 unknown command 951938275 [ 1788.929782] binder: send failed reply for transaction 5720, target dead [ 1788.936133] binder: 1666:1684 ioctl c0306201 20000480 returned -22 03:51:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1789.020247] binder: 1721:1728 ioctl c018620b 0 returned -14 [ 1789.035521] block nbd0: Device being setup by another task 03:51:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) 03:51:31 executing program 1: pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x80000) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000080)={{0x2, 0x4e20, @empty}, {0x306, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x28, {0x2, 0x4e22, @rand_addr=0x40}, 'teql0\x00'}) r1 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000280)={0x11}) [ 1789.095040] block nbd0: shutting down sockets [ 1789.101321] binder: 1721:1740 got transaction to context manager from process owning it [ 1789.134599] binder: 1721:1740 transaction failed 29201/-22, size 24-0 line 2825 03:51:31 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x301) 03:51:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x20) r2 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x1, 0x2) ioctl$SIOCRSSL2CALL(r2, 0x89e2, &(0x7f0000000140)=@null) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f0000000040)={{0x45, 0x8}, {0x401, 0x9}, 0x0, 0x4, 0x4}) getsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f00000001c0)={@initdev, @multicast2}, &(0x7f0000000200)=0xc) getrlimit(0xa, &(0x7f0000000280)) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000240)=0x1a) 03:51:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1789.350949] block nbd0: Device being setup by another task [ 1789.414904] block nbd0: shutting down sockets 03:51:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syncfs(r2) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 03:51:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2ccca6040000003500290800000000f53f4995ee450c27610ed884000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000de8af3fb76"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xdbf3, 0x204000) ioctl$PPPIOCSFLAGS(r1, 0x40047459, &(0x7f0000000140)=0x8e) getsockopt$netrom_NETROM_T2(r1, 0x103, 0x2, &(0x7f0000000080)=0x9, &(0x7f00000000c0)=0x4) 03:51:32 executing program 1: syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r0 = epoll_create1(0x0) socketpair(0x2, 0x80000, 0xad42, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$ax25_int(r1, 0x101, 0x6, &(0x7f0000000080), &(0x7f00000000c0)=0x4) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000180)={0x11}) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000100)=0x8000, 0x4) 03:51:32 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]}, 0x2c) 03:51:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:32 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x4b49) [ 1789.816118] binder_release_work: 4 callbacks suppressed [ 1789.816124] binder: undelivered TRANSACTION_ERROR: 29201 03:51:32 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x3, 0xfffffffffffffffa) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r1, &(0x7f0000000040)={0x2004}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) 03:51:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) [ 1789.889902] block nbd0: Device being setup by another task [ 1789.923858] binder: 1783:1786 ioctl c018620b 0 returned -14 03:51:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1789.954946] block nbd0: shutting down sockets [ 1789.999008] binder: 1783:1786 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:51:32 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x1260) 03:51:32 executing program 1: r0 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0xfffffffffffffffd, 0x20000) ioctl$KVM_GET_XSAVE(r0, 0x9000aea4, &(0x7f00000002c0)) r1 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000280)={0x11}) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r2, 0x28, 0x1, &(0x7f0000000040)=0x3, 0x8) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000080)) [ 1790.074780] binder: 1783:1786 BC_FREE_BUFFER u0000000000000000 no match [ 1790.105174] binder: 1783:1786 got reply transaction with bad transaction stack, transaction 5725 has target 1783:0 03:51:32 executing program 5: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000080)='fou\x00') sendmsg$FOU_CMD_ADD(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000829bd700004dbdf25010400000800040001000000080001004e23000004000500080004000100001dd6cbaca48ba8d0ae2b8ed89e387fe82fd976a4b4a3c5a229706843a8fd0930"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x80c1) ioctl$KVM_S390_UCAS_MAP(r0, 0x4018ae50, &(0x7f0000000200)={0xf69c, 0x0, 0xfff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000000c0)={0x6, 0x820b, 0x5, 0x8, 0x0}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000300)={r3, 0x1, 0x20, 0x6, 0x327}, &(0x7f0000000340)=0x18) setsockopt$netrom_NETROM_T1(r0, 0x103, 0x1, &(0x7f0000000380)=0x6, 0x4) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[]}, 0x1, 0x0, 0x0, 0x20040000}, 0x3) [ 1790.155426] binder: 1783:1786 transaction failed 29201/-71, size 0-0 line 2756 03:51:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x420c02, 0x0) syz_open_dev$dmmidi(&(0x7f0000000700)='/dev/dmmidi#\x00', 0xc, 0x80000) openat$ppp(0xffffffffffffff9c, &(0x7f0000000740)='/dev/ppp\x00', 0x20040, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dlm-monitor\x00', 0x8200, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/vcs\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x4001fd) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xfffffffffffffe54, 0x0, 0x0, 0x1, 0x0, &(0x7f00000006c0)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0xae44, 0x2c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x68, 0x0, &(0x7f0000000500)=[@clear_death, @free_buffer, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000080)='%proc\x00'}, 0x30) move_pages(r4, 0x1, &(0x7f0000000400)=[&(0x7f0000ffe000/0x2000)=nil], &(0x7f00000004c0)=[0x1, 0x8001, 0xb3c5, 0x9fe3], &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x200, 0x0) r6 = semget$private(0x0, 0x1, 0x400) semctl$IPC_STAT(r6, 0x0, 0x2, &(0x7f0000000380)=""/86) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100004}, 0xc, &(0x7f0000000180)={&(0x7f0000000580)={0xcc, r7, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x66472636}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x1}}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}]}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, [], 0x1d}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x40, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x6}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xfd}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x4004014}, 0x91) r8 = add_key$keyring(&(0x7f0000000800)='keyring\x00', &(0x7f0000000840)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$update(0x2, r8, &(0x7f0000000880)="982025271675781e810314d995dae4b656d2e89442f338d426264dd501104aedff9275bf59c1099d1a40e66fe90140ede54f5d135e9be01eb6c130d47ab616919da8d8dba491cb4273e04974fef0efcd4d345c8bdf6a54dd964c4fb64a14aff0febf1243e6dc0a3d61a6dcbd3f844f917e1a9d8666ef42a2520ebf335ce98a5f5bb11335e8285a9c98faa2b4aa97d219d11a3f4a13cf1186ac1ffeaf9d60dcc49cba3e5cf7a6433f4627a010102a", 0xae) 03:51:32 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x2c) [ 1790.217409] block nbd0: Device being setup by another task [ 1790.237918] binder: send failed reply for transaction 5725 to 1783:1786 [ 1790.245320] binder: undelivered TRANSACTION_COMPLETE [ 1790.256982] binder: undelivered TRANSACTION_ERROR: 29201 03:51:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1790.276302] block nbd0: shutting down sockets [ 1790.293467] binder: undelivered TRANSACTION_ERROR: 29189 [ 1790.349413] binder: 1816:1824 ioctl c018620b 0 returned -14 [ 1790.367239] binder: 1816:1824 ioctl c0306201 20000280 returned -14 [ 1790.385477] binder: 1816:1824 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:51:32 executing program 1: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x80) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x11}) 03:51:32 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x1268) 03:51:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1790.399282] binder: 1816:1824 BC_FREE_BUFFER u0000000000000000 no match [ 1790.423435] binder: 1816:1824 got reply transaction with no transaction stack 03:51:32 executing program 5: r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='\x00', 0xffffffffffffff9c}, 0x10) ioctl(r0, 0x65f72d3f, &(0x7f0000000140)="2640a742e8b054f2252fd265f1073f95d88ec74f84edd5fc5896e57d") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) [ 1790.464058] binder: 1816:1824 transaction failed 29201/-71, size 0-0 line 2741 [ 1790.532291] block nbd0: Device being setup by another task [ 1790.561148] vivid-002: kernel_thread() failed 03:51:32 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x88d, 0x10000) ioctl$TCSETAF(r0, 0x5408, &(0x7f00000001c0)={0x2, 0x3f, 0x6, 0x400000000, 0x16, 0x40000000ffffffff, 0x10000, 0x0, 0x0, 0x40}) r1 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/user\x00', 0x2, 0x0) fsetxattr$trusted_overlay_nlink(r1, &(0x7f0000000080)='trusted.overlay.nlink\x00', &(0x7f00000000c0)={'L+', 0x101}, 0x28, 0x1) r2 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x7, 0x0) r3 = syz_open_dev$midi(&(0x7f0000000200)='/dev/midi#\x00', 0xffffffffffffffc3, 0x2e040) ioctl$KDGKBDIACR(r3, 0x4b4a, &(0x7f0000000140)=""/43) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r2, &(0x7f0000000280)={0x11}) [ 1790.578185] binder_alloc: binder_alloc_mmap_handler: 1816 20001000-20004000 already mapped failed -16 [ 1790.581756] block nbd0: shutting down sockets [ 1790.599509] binder: 1816:1834 ioctl c018620b 0 returned -14 [ 1790.605608] binder: 1816:1824 ioctl c0306201 20000280 returned -14 [ 1790.643808] binder: BINDER_SET_CONTEXT_MGR already set 03:51:33 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x0, 0x400080) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x0, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000140)={0x1, 0x10, 0xfa00, {&(0x7f0000000040), r2}}, 0x18) [ 1790.665651] binder: 1816:1834 ioctl 40046207 0 returned -16 [ 1790.665769] binder: 1816:1824 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 03:51:33 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0x401070ca) [ 1790.781974] ================================================================== [ 1790.786383] binder: 1816:1824 BC_FREE_BUFFER u0000000000000000 no match [ 1790.789917] BUG: KASAN: null-ptr-deref in kthread_stop+0x10d/0x900 [ 1790.789945] Write of size 4 at addr 000000000000001c by task syz-executor1/1854 [ 1790.789950] [ 1790.789962] CPU: 0 PID: 1854 Comm: syz-executor1 Not tainted 4.20.0 #167 [ 1790.789976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1790.803045] Call Trace: [ 1790.813170] binder: 1816:1824 got reply transaction with no transaction stack [ 1790.818969] dump_stack+0x1d3/0x2c6 [ 1790.818991] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1790.819011] ? vprintk_func+0x85/0x181 [ 1790.819032] kasan_report.cold.9+0x6d/0x309 [ 1790.819049] ? kthread_stop+0x10d/0x900 [ 1790.830972] check_memory_region+0x13e/0x1b0 [ 1790.830988] kasan_check_write+0x14/0x20 [ 1790.831003] kthread_stop+0x10d/0x900 [ 1790.857206] binder: 1816:1824 transaction failed 29201/-71, size 0-0 line 2741 [ 1790.859202] ? kthread_unpark+0x160/0x160 [ 1790.859228] ? __lock_is_held+0xb5/0x140 [ 1790.859339] vivid_stop_generating_vid_cap+0x2bb/0x9ae [ 1790.859361] ? vivid_start_generating_vid_cap+0x4c0/0x4c0 [ 1790.899012] ? __mutex_lock+0x85e/0x1700 [ 1790.899120] ? _vb2_fop_release+0x3f/0x2b0 [ 1790.907457] ? graph_lock+0x270/0x270 [ 1790.911268] ? perf_trace_lock_acquire+0x15b/0x800 [ 1790.916212] ? mutex_trylock+0x2b0/0x2b0 [ 1790.920284] ? vivid_fop_release+0x66/0x440 [ 1790.924617] ? perf_trace_lock+0x7a0/0x7a0 [ 1790.927749] binder: undelivered TRANSACTION_ERROR: 29201 [ 1790.928882] vid_cap_stop_streaming+0x8d/0xe0 [ 1790.928898] ? vid_cap_buf_queue+0x310/0x310 [ 1790.934427] binder: undelivered TRANSACTION_ERROR: 29201 [ 1790.938821] __vb2_queue_cancel+0x14f/0xd50 [ 1790.938836] ? vivid_fop_release+0x96/0x440 [ 1790.938852] ? lock_downgrade+0x900/0x900 [ 1790.938870] ? vb2_buffer_done+0xbb0/0xbb0 [ 1790.953024] ? find_held_lock+0x36/0x1c0 [ 1790.953048] ? mark_held_locks+0xc7/0x130 [ 1790.961508] ? kasan_check_write+0x14/0x20 [ 1790.961527] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 1790.961542] ? kasan_check_read+0x11/0x20 [ 1790.961563] ? wait_for_completion+0x8a0/0x8a0 [ 1790.983921] block nbd0: Device being setup by another task [ 1790.987269] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 1790.987286] ? ep_modify+0xc10/0xc10 [ 1790.987311] vb2_core_streamoff+0x60/0x140 [ 1790.987330] __vb2_cleanup_fileio+0x73/0x160 [ 1790.987347] vb2_core_queue_release+0x1e/0x80 [ 1790.987366] _vb2_fop_release+0x1d2/0x2b0 [ 1791.023975] vb2_fop_release+0x77/0xc0 [ 1791.027879] vivid_fop_release+0x18e/0x440 03:51:33 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) [ 1791.032132] ? vivid_remove+0x460/0x460 [ 1791.036181] v4l2_release+0x224/0x3a0 [ 1791.040003] ? dev_debug_store+0x140/0x140 [ 1791.044251] __fput+0x385/0xa30 [ 1791.047551] ? get_max_files+0x20/0x20 [ 1791.051449] ? trace_hardirqs_on+0xbd/0x310 [ 1791.056170] ? kasan_check_read+0x11/0x20 [ 1791.060329] ? task_work_run+0x1af/0x2a0 [ 1791.064397] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 1791.069850] ? filp_close+0x1cd/0x250 [ 1791.069870] ____fput+0x15/0x20 [ 1791.069885] task_work_run+0x1e8/0x2a0 03:51:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x80080, 0x0) mmap$perf(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x1, 0x2010, r3, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)='+'}) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'morus640-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000100)="71e67a15cdf0319fa22748f9a91c66b3", 0x10) setsockopt$ALG_SET_AEAD_AUTHSIZE(r4, 0x117, 0x5, 0x0, 0x2) r5 = accept4$alg(r4, 0x0, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f0000003d40)=[{0x0, 0x0, &(0x7f0000003d80)=[{&(0x7f0000003c80)="104a", 0x2}], 0x1, &(0x7f0000003d00)}], 0x1, 0x0) recvmmsg(r5, &(0x7f00000002c0), 0x3074f63d6ad928b, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0063404000000000000000000000000000fffffff3000000ffffff7f006d5d980000000000000000b88ab78c1964918d9e2dc694000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:51:33 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@broute={'broute\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'teql0\x00', 'veth1\x00', 'yam0\x00', 'ipddp0\x00', @local, [], @empty, [], 0xb0, 0xb0, 0xe0, [@quota={'quota\x00', 0x18}]}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x1e8) 03:51:33 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2de) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_yield() bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x740000, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}, 0x2c) 03:51:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0, 0x100) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000000480)={{0x7, 0x0, 0x401, 0x6, '\x00', 0x8}, 0x1, [0x4, 0x19, 0x8c, 0x5, 0x0, 0x9, 0x2, 0x62, 0x127, 0xffff, 0x2, 0xffffffffffffff01, 0x2, 0x2, 0xff, 0xf0b5, 0xb82, 0x2, 0x9c80, 0x3, 0x0, 0x3, 0x4, 0x5, 0x0, 0x9, 0x6, 0x3, 0x0, 0x9, 0x89, 0x1000, 0x81, 0xfffffffffffffffd, 0x1, 0x6, 0xb99, 0x7, 0x8b7, 0x8, 0x1, 0xbf4c, 0xee, 0x9, 0x0, 0x3, 0x101, 0x1, 0x9, 0x8, 0x8, 0xfffffffffffffc67, 0x7fff, 0x9, 0x5, 0x8001, 0x8, 0x9, 0x9, 0x3ff, 0x1, 0x10000, 0x426, 0x4, 0x3, 0x4, 0xfc68, 0x20, 0x2, 0x6, 0x0, 0x8, 0x0, 0xfeb3, 0x4, 0x2, 0xbfca, 0x0, 0x7fff, 0x6, 0x3, 0xffffffffb9670306, 0x9, 0x2, 0x401, 0x10000, 0x4, 0x7, 0x350, 0x1, 0x400, 0x200000000000000, 0x7fffffff, 0x1, 0x9, 0x2, 0x1, 0xdc52, 0xffffffffffff5d92, 0x32b7, 0x8, 0x7, 0x4, 0x7ff, 0x8, 0x1d6, 0x4, 0x7, 0x5, 0x3, 0x1f, 0x0, 0x7, 0x10000, 0x4c2, 0x2, 0x3, 0x3f, 0xf494, 0x6, 0x5, 0x7, 0x2, 0x80, 0x7fffffff, 0x81, 0xf07, 0x3], {0x0, 0x1c9c380}}) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c0000003500290800000000f53f49b50300000018000000000000000001c08aa45a46b4a011afb1d330680be9719d561dc7b3ed700d28308ae51f49a7d24c22350000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x5, 0x600002) [ 1791.069904] ? task_work_cancel+0x240/0x240 [ 1791.085251] ? copy_fd_bitmaps+0x210/0x210 [ 1791.089499] ? do_syscall_64+0x9a/0x820 [ 1791.093489] exit_to_usermode_loop+0x318/0x380 [ 1791.098086] ? syscall_trace_enter+0x1260/0x1260 [ 1791.102857] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1791.108409] do_syscall_64+0x6be/0x820 [ 1791.112336] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1791.117741] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1791.122685] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1791.127537] ? trace_hardirqs_on_caller+0x310/0x310 [ 1791.127555] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1791.127573] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1791.127594] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1791.127633] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1791.127647] RIP: 0033:0x411211 [ 1791.137684] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 19 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 1791.137693] RSP: 002b:00007fff51762360 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 1791.137707] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000411211 [ 1791.137717] RDX: 0000000000000000 RSI: 0000000000740738 RDI: 0000000000000004 [ 1791.137726] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1791.137734] R10: 00007fff51762290 R11: 0000000000000293 R12: 0000000000000000 [ 1791.137743] R13: 0000000000000001 R14: 0000000000000d61 R15: 0000000000000001 [ 1791.137771] ================================================================== [ 1791.195167] binder: 1882:1884 transaction failed 29201/-22, size -8307018464782974976--7726437951704308711 line 2973 [ 1791.197640] Disabling lock debugging due to kernel taint [ 1791.197933] audit: type=1400 audit(2000001093.140:225): avc: denied { map } for pid=1882 comm="syz-executor4" path="/dev/ppp" dev="devtmpfs" ino=15789 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ppp_device_t:s0 tclass=chr_file permissive=1 [ 1791.205420] Kernel panic - not syncing: panic_on_warn set ... [ 1791.274219] CPU: 1 PID: 1854 Comm: syz-executor1 Tainted: G B 4.20.0 #167 [ 1791.282444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1791.291792] Call Trace: [ 1791.294385] dump_stack+0x1d3/0x2c6 [ 1791.298019] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1791.303216] panic+0x2ad/0x55c [ 1791.306411] ? add_taint.cold.5+0x16/0x16 [ 1791.310561] ? preempt_schedule+0x4d/0x60 [ 1791.314710] ? ___preempt_schedule+0x16/0x18 [ 1791.319121] ? trace_hardirqs_on+0xb4/0x310 [ 1791.323449] kasan_end_report+0x47/0x4f [ 1791.327425] kasan_report.cold.9+0x76/0x309 [ 1791.331748] ? kthread_stop+0x10d/0x900 [ 1791.335729] check_memory_region+0x13e/0x1b0 [ 1791.340135] kasan_check_write+0x14/0x20 [ 1791.344199] kthread_stop+0x10d/0x900 [ 1791.347998] ? kthread_unpark+0x160/0x160 [ 1791.352153] ? __lock_is_held+0xb5/0x140 [ 1791.356234] vivid_stop_generating_vid_cap+0x2bb/0x9ae [ 1791.361513] ? vivid_start_generating_vid_cap+0x4c0/0x4c0 [ 1791.367050] ? __mutex_lock+0x85e/0x1700 [ 1791.371115] ? _vb2_fop_release+0x3f/0x2b0 [ 1791.375355] ? graph_lock+0x270/0x270 [ 1791.379161] ? perf_trace_lock_acquire+0x15b/0x800 [ 1791.384090] ? mutex_trylock+0x2b0/0x2b0 [ 1791.388148] ? vivid_fop_release+0x66/0x440 [ 1791.392475] ? perf_trace_lock+0x7a0/0x7a0 [ 1791.396802] vid_cap_stop_streaming+0x8d/0xe0 [ 1791.401381] ? vid_cap_buf_queue+0x310/0x310 [ 1791.405792] __vb2_queue_cancel+0x14f/0xd50 [ 1791.410116] ? vivid_fop_release+0x96/0x440 [ 1791.414442] ? lock_downgrade+0x900/0x900 [ 1791.418597] ? vb2_buffer_done+0xbb0/0xbb0 [ 1791.422840] ? find_held_lock+0x36/0x1c0 [ 1791.426910] ? mark_held_locks+0xc7/0x130 [ 1791.431066] ? kasan_check_write+0x14/0x20 [ 1791.435304] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 1791.440234] ? kasan_check_read+0x11/0x20 [ 1791.444385] ? wait_for_completion+0x8a0/0x8a0 [ 1791.448971] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 1791.454424] ? ep_modify+0xc10/0xc10 [ 1791.458144] vb2_core_streamoff+0x60/0x140 [ 1791.462406] __vb2_cleanup_fileio+0x73/0x160 [ 1791.466818] vb2_core_queue_release+0x1e/0x80 [ 1791.471933] _vb2_fop_release+0x1d2/0x2b0 [ 1791.476081] vb2_fop_release+0x77/0xc0 [ 1791.479969] vivid_fop_release+0x18e/0x440 [ 1791.484214] ? vivid_remove+0x460/0x460 [ 1791.488184] v4l2_release+0x224/0x3a0 [ 1791.491983] ? dev_debug_store+0x140/0x140 [ 1791.496220] __fput+0x385/0xa30 [ 1791.499513] ? get_max_files+0x20/0x20 [ 1791.503401] ? trace_hardirqs_on+0xbd/0x310 [ 1791.507718] ? kasan_check_read+0x11/0x20 [ 1791.511868] ? task_work_run+0x1af/0x2a0 [ 1791.515933] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 1791.521397] ? filp_close+0x1cd/0x250 [ 1791.525197] ____fput+0x15/0x20 [ 1791.528477] task_work_run+0x1e8/0x2a0 [ 1791.532369] ? task_work_cancel+0x240/0x240 [ 1791.536693] ? copy_fd_bitmaps+0x210/0x210 [ 1791.540941] ? do_syscall_64+0x9a/0x820 [ 1791.544916] exit_to_usermode_loop+0x318/0x380 [ 1791.549502] ? syscall_trace_enter+0x1260/0x1260 [ 1791.554261] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1791.559802] do_syscall_64+0x6be/0x820 [ 1791.563690] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1791.569055] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1791.573983] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1791.578825] ? trace_hardirqs_on_caller+0x310/0x310 [ 1791.583852] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1791.589045] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1791.594061] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1791.598907] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1791.604095] RIP: 0033:0x411211 [ 1791.607291] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 19 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 1791.626191] RSP: 002b:00007fff51762360 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 1791.633897] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000411211 [ 1791.641161] RDX: 0000000000000000 RSI: 0000000000740738 RDI: 0000000000000004 [ 1791.648425] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1791.655696] R10: 00007fff51762290 R11: 0000000000000293 R12: 0000000000000000 [ 1791.663143] R13: 0000000000000001 R14: 0000000000000d61 R15: 0000000000000001 [ 1791.671872] Kernel Offset: disabled [ 1791.675503] Rebooting in 86400 seconds..