f}) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x440, 0x0) ioctl$BLKGETSIZE(r1, 0x1260, &(0x7f0000000040)) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) 03:17:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x2000000, 0x0}) 03:17:14 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:14 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:14 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:14 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:14 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3216.208855] binder: 25232:25239 got reply transaction with bad transaction stack, transaction 5725 has target 25232:25239 03:17:14 executing program 4: socketpair$unix(0x1, 0x10000000000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$RTC_PIE_ON(r1, 0x7005) getxattr(0x0, 0x0, 0x0, 0x0) [ 3216.268538] binder: 25232:25239 transaction failed 29201/-71, size 0-0 line 2816 03:17:14 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) [ 3216.309715] binder: BINDER_SET_CONTEXT_MGR already set [ 3216.326679] binder: 25232:25256 transaction failed 29189/-22, size 0-0 line 2896 03:17:14 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:14 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3216.365371] binder: 25232:25239 ioctl 40046207 0 returned -16 03:17:14 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x1000000, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) 03:17:14 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) [ 3216.416962] binder_release_work: 50 callbacks suppressed [ 3216.416968] binder: undelivered TRANSACTION_ERROR: 29189 03:17:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x3000000, 0x0}) [ 3216.486865] binder: undelivered TRANSACTION_ERROR: 29201 [ 3216.498560] binder: undelivered TRANSACTION_ERROR: 29189 03:17:14 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) 03:17:15 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:15 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:15 executing program 4: socketpair$unix(0x1, 0x80005, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) [ 3216.557770] binder: 25283:25285 got reply transaction with bad transaction stack, transaction 5729 has target 25283:25285 [ 3216.583010] binder: 25283:25285 transaction failed 29201/-71, size 0-0 line 2816 03:17:15 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) [ 3216.650512] binder_alloc: 25283: binder_alloc_buf, no vma [ 3216.666602] binder: 25283:25297 transaction failed 29189/-3, size 0-0 line 3035 [ 3216.681330] binder: 25283:25285 got reply transaction with no transaction stack 03:17:15 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000180)={0xf0, r2, 0x10, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x7}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10001}, @IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x1}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xad}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'lc\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x67}]}]}, 0xf0}, 0x1, 0x0, 0x0, 0x4001}, 0x804) getxattr(0x0, 0x0, 0x0, 0x0) ioctl$VHOST_SET_VRING_NUM(r1, 0x4008af10, &(0x7f0000000000)={0x2, 0x2}) r3 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_ADD(r1, 0x4c80, r3) 03:17:15 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3216.706171] binder: 25283:25285 transaction failed 29201/-71, size 0-0 line 2801 [ 3216.739065] binder: undelivered TRANSACTION_ERROR: 29201 [ 3216.749653] binder: undelivered TRANSACTION_ERROR: 29189 03:17:15 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf4\x00'}, 0x45c) 03:17:15 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x4000000, 0x0}) 03:17:15 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) [ 3216.823397] binder: undelivered TRANSACTION_ERROR: 29201 [ 3216.828982] binder: undelivered TRANSACTION_ERROR: 29189 03:17:15 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) r2 = semget$private(0x0, 0x3, 0x354) semctl$GETPID(r2, 0x1, 0xb, &(0x7f0000000000)=""/217) [ 3216.896062] binder: 25321:25324 got reply transaction with bad transaction stack, transaction 5735 has target 25321:25324 03:17:15 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:15 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) 03:17:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000000c0)={0x18, 0x22, 0x1, 0x0, 0x0, {0x4}, [@nested={0x4, 0xf}]}, 0x18}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x9, 0x20, 0xe293, 0x1}, &(0x7f0000000040)=0x18) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000100)={r3, 0x8}, &(0x7f0000000180)=0x8) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) [ 3216.964788] binder: 25321:25324 transaction failed 29201/-71, size 0-0 line 2816 03:17:15 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}, 0x45c) [ 3217.012831] binder_alloc: 25321: binder_alloc_buf, no vma [ 3217.046675] binder: 25321:25341 transaction failed 29189/-3, size 0-0 line 3035 03:17:15 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:15 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) [ 3217.090455] binder: undelivered TRANSACTION_ERROR: 29189 03:17:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x5000000, 0x0}) 03:17:15 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3217.177996] binder: undelivered TRANSACTION_ERROR: 29201 [ 3217.184433] binder: undelivered TRANSACTION_ERROR: 29189 03:17:15 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0xf6b559f96aed4df4) 03:17:15 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) 03:17:15 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) [ 3217.321846] binder: 25368:25374 got reply transaction with bad transaction stack, transaction 5740 has target 25368:25374 03:17:15 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x406, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) ioctl$KVM_GET_MSRS(r2, 0xc008ae88, &(0x7f0000000000)={0x4, 0x0, [{}, {}, {}, {}]}) 03:17:15 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) 03:17:15 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3217.371368] binder: 25368:25374 transaction failed 29201/-71, size 0-0 line 2816 [ 3217.409326] binder_alloc: 25368: binder_alloc_buf, no vma 03:17:15 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\\\x00'}, 0x45c) 03:17:15 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0xffffffffffffffff, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) mq_getsetattr(r2, &(0x7f0000000000)={0x67, 0x8, 0x3, 0x5066d7fe, 0x60, 0x100000001, 0x7ff, 0x3}, &(0x7f0000000040)) [ 3217.453445] binder: 25368:25374 got reply transaction with no transaction stack 03:17:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x6000000, 0x0}) 03:17:15 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) 03:17:16 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:16 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x80002, 0x0) sendmsg$tipc(r1, &(0x7f0000000100)={&(0x7f00000000c0)=@name={0x1e, 0x2, 0x0, {{0x42}, 0x2}}, 0x10, &(0x7f0000000640)=[{&(0x7f0000000180)="b09a3cbf68ed2f8488a30607729adebaeb2f09b1b032eb18b5e8bc801ce773aafc97c0cd3e1524a623d0ad018bc3b3abad005140c9fddcc47ef4d2a55348dbb458193e6785501ebc2abc", 0x4a}, {&(0x7f0000000200)="3d73afa784eae6d6636d3109b398df02c7a63039256999f6410e7ea69eaaccfadeeb2c1bef59b7be90e1824a493ac343e9445674a687e4d88ce2696c800ea3261afbb86cf2a93d4b42c6aac715ce53ed9957a376841aee5d7464084ccced", 0x5e}, {&(0x7f0000000280)="a1c773b25c38458a6e119d1179d69a3eb8391bed77b9481dd29e3e56a0859040b80a2d2f833faa3d0607401048242cdcf4fc1fd6286d8d4d87d1c235f29a82d6ca5fe0bcdca87ba2d08c0c06458ed4d971ff2551e318adf3274c1d1580d0c79d983a1bdee6908156b5d24e131c6ab7c8cac31a87f9964bac7b6217b26d589325e016f59b9ff248662c558e5e5451a6380f22801da93adb37a055040d619466203886fabc1bc64913f6fe09f8526f411e7879a5efa81669058ea03b977b7ac1039b", 0xc1}, {&(0x7f0000000380)="a87841481660648da14fa6177946a0f9863c0bae9eaf72de0fcbfaf386b910c2c327760e00871e5f3f55ef12953d7f9c88fb526bd84e75835870d3f3d42e4d1336730431c34e7e58570add7bc7effe0ece7e8c04e416cfbe4af4dbd8ae65be12a5abf657c469c11c495d51871fe019ceecb1e070bc73b8807f74b5dfc8a009d10b", 0x81}, {&(0x7f0000000440)="440153abfd55046d54bdea13925f19369a794057bf95357dc83046e63060f0f363a33454ecc0aa9d34fb01d23c0ef37dfa9e31313c2438c5604ddc933d6fa2ebf75d94e6", 0x44}, {&(0x7f00000004c0)="073828bf6283f6b531017890e81e7f9673624aaa27afcd51cb87e212a2889caee36ae920367b84b478987fa20fffc5091fd964a8aea05948541d4388f818976135ad9817854ee78e66ef3a31118e2c1359c22746f2394f3ae7721ca345846214d6a8ded24f29487895ca2b44628b9d9362c23dc269835f5ebf9ce2010d625a387a230d", 0x83}, {&(0x7f0000000580)="2db412b069ed292551e8c9a7e2de57c58d0e6d872f5f0a818ddd202e230b46f67d38d8c131ead0bf6f784d408bd3c20b38f3a61a838887d46d0d0c823e2524bf687c724d91ce41c4b116a634c770464cd8e98747378bb92e59d4edb7e31dbea0797dc291a1fad5da7d0062a8622a8411e74cfa853bae7a5569012cc27f240501cbbc29bcba938781572b4d6619e49c0bff9886bd0e7ed676f3580772879c8d3f5cc17917a4f793734f3a461e", 0xac}], 0x7, 0x0, 0x0, 0x20000040}, 0x20008000) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000040)=0x3) setsockopt$RDS_RECVERR(r2, 0x114, 0x5, &(0x7f0000000000), 0x4) getxattr(0x0, 0x0, 0x0, 0x25) 03:17:16 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:17:16 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x80\x00'}, 0x45c) [ 3217.664614] binder: 25411:25416 got reply transaction with bad transaction stack, transaction 5746 has target 25411:25416 03:17:16 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf4\x00'}, 0x45c) [ 3217.720175] binder_send_failed_reply: 10 callbacks suppressed [ 3217.720185] binder: send failed reply for transaction 5746 to 25411:25416 [ 3217.740815] binder_alloc: 25411: binder_alloc_buf, no vma 03:17:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x7000000, 0x0}) 03:17:16 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:16 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:17:16 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf4\xff\xff\xff\x00'}, 0x45c) 03:17:16 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$bt_rfcomm_RFCOMM_LM(r1, 0x12, 0x3, &(0x7f0000000040)=0x20, 0x4) getxattr(0x0, 0x0, 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000200)={&(0x7f0000000080), 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x68, r2, 0x112, 0x70bd2c, 0x25dfdbfb, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x3, @link='syz1\x00'}}}, ["", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000800) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}) 03:17:16 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) [ 3217.907627] binder: 25443:25446 got reply transaction with bad transaction stack, transaction 5751 has target 25443:25446 03:17:16 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3217.954752] binder: send failed reply for transaction 5751 to 25443:25446 03:17:16 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xa000000, 0x0}) 03:17:16 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf5\xff\xff\xff\x00'}, 0x45c) [ 3218.043738] binder_release_work: 10 callbacks suppressed [ 3218.043744] binder: undelivered TRANSACTION_COMPLETE 03:17:16 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x208000, 0x0) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) getxattr(0x0, 0x0, 0x0, 0x0) [ 3218.120121] binder: 25464:25469 got reply transaction with bad transaction stack, transaction 5756 has target 25464:25469 03:17:16 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) [ 3218.165300] binder_thread_release: 10 callbacks suppressed [ 3218.165310] binder: release 25464:25469 transaction 5756 in, still active [ 3218.179433] binder: send failed reply for transaction 5756 to 25464:25469 03:17:16 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x20000000, 0x0}) 03:17:16 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = getpgid(0xffffffffffffffff) perf_event_open(&(0x7f0000000080)={0x5, 0x70, 0x8d8, 0x4cd9, 0x1, 0x5, 0x0, 0x9, 0x0, 0x6, 0x0, 0x0, 0x5, 0x4, 0x80000001, 0x10001, 0x1dad, 0x6, 0x6, 0x4, 0x10001, 0xffffc00000000000, 0x1, 0x6, 0xfffffffffffffe01, 0x5, 0x7, 0xfffffffffffffff7, 0x8, 0x80000000, 0x0, 0x6, 0x348, 0x100, 0x9, 0xad6, 0x7, 0x8, 0x0, 0x7fffffff, 0x4, @perf_bp={&(0x7f0000000000), 0x8}, 0x14880, 0x1, 0x1, 0x8, 0x5, 0x6cb, 0x4}, r2, 0x3, r1, 0x87d1d655ed82f8d5) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000040)={0x1, 0x100, 0x47b5, 0x6, 0x15, 0x2, 0x100, 0x7674, 0x1000, 0x2, 0x8, 0x8}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) 03:17:16 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) [ 3218.244389] binder: undelivered TRANSACTION_COMPLETE 03:17:16 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\xff\x00'}, 0x45c) [ 3218.324438] binder: 25487:25490 got reply transaction with bad transaction stack, transaction 5761 has target 25487:25490 03:17:16 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x200000000001, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) 03:17:16 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) 03:17:16 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:16 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x01\x00'}, 0x45c) [ 3218.413081] binder: release 25487:25490 transaction 5761 in, still active [ 3218.420048] binder: send failed reply for transaction 5761 to 25487:25490 03:17:16 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x3f000000, 0x0}) [ 3218.521930] binder: undelivered TRANSACTION_COMPLETE 03:17:17 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0xc0200, 0x0) getxattr(0x0, 0x0, 0x0, 0x0) 03:17:17 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:17:17 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:17 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) [ 3218.646265] binder: 25525:25529 got reply transaction with bad transaction stack, transaction 5765 has target 25525:25529 03:17:17 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="011b5009b3aa507ff7f8b2b4e28e01dbceec73fd85a0134c3337db80f45edae9aece895b265bb8ca8cf7b627df223ed12ba5ae9fc9e775307912e29e2a89ba22afa16fcd47662a3ba9f525f3c4187d5536b0cbdc99a4827254962b873c", 0x5d, 0xffffffffffffffff) keyctl$instantiate(0xc, r2, &(0x7f0000000100)=@encrypted_update={'update ', 'default', 0x20, 'trusted:', '$*nodev-em1'}, 0x23, 0xfffffffffffffffa) 03:17:17 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) [ 3218.686540] binder: release 25525:25529 transaction 5765 in, still active [ 3218.715462] binder: send failed reply for transaction 5765 to 25525:25529 03:17:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x48000000, 0x0}) 03:17:17 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf4\xff\xff\xff\x00'}, 0x45c) [ 3218.770588] binder: undelivered TRANSACTION_COMPLETE 03:17:17 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:17 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0xfffffffffffffc90) 03:17:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x4c000000, 0x0}) 03:17:17 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 3218.855384] binder: release 25556:25557 transaction 5770 in, still active [ 3218.868331] binder: send failed reply for transaction 5770 to 25556:25557 [ 3218.920439] binder: release 25556:25561 transaction 5773 out, still active [ 3218.941263] binder: undelivered TRANSACTION_COMPLETE [ 3218.948401] binder: BINDER_SET_CONTEXT_MGR already set 03:17:17 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:17 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$VIDIOC_S_JPEGCOMP(r1, 0x408c563e, &(0x7f0000000000)={0x3f, 0xa, 0x29, "522db34a946060669ecac3ed9dfa19e3a417ae1f35835a55fe6773c4580285d95c426a223dcde5e67880adac0cbe76d19803ce3da51d46ae22e8f72e", 0x33, "c2f090881b7e39d4bfd6a1dba0a41545ab9935acef4a110bcb019b5b8d223bb4f350d81057d7cf8e1084374290c7ad42d1f32bf7f2c696b1b4577615", 0x8}) getxattr(0x0, 0x0, 0x0, 0x0) [ 3218.970129] binder: undelivered TRANSACTION_COMPLETE [ 3218.975688] binder: 25568:25570 ioctl 40046207 0 returned -16 [ 3218.983096] binder: send failed reply for transaction 5773, target dead 03:17:17 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:17 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf5\xff\xff\xff\x00'}, 0x45c) [ 3219.037129] binder: 25568:25582 got reply transaction with no transaction stack 03:17:17 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:17 executing program 4: socketpair$unix(0x1, 0x800040000006, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x9, 0x100000001, 0x6, 0x2, 0xfff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) [ 3219.099844] binder: 25568:25570 got reply transaction with no transaction stack 03:17:17 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x60000000, 0x0}) 03:17:17 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\xff\x00'}, 0x45c) 03:17:17 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:17 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:17 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rename(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') getxattr(0x0, 0x0, 0x0, 0x0) [ 3219.288353] binder: release 25610:25611 transaction 5780 in, still active [ 3219.333268] binder: send failed reply for transaction 5780 to 25610:25611 03:17:17 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x68000000, 0x0}) [ 3219.385723] binder: undelivered TRANSACTION_COMPLETE 03:17:17 executing program 4: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x18, 0x80000) write$UHID_SET_REPORT_REPLY(r0, &(0x7f0000001180)=ANY=[@ANYBLOB="006f38b569b4450758a2a542c3c16d85829ba3a292981cfe47fed05861460df8593a8d510ff8c4d19fee5547bc170edf1ca9a07aec19bdddca971ada3ee7f08d619168a4daf500000000000000"], 0x4d) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) getpeername$netlink(r3, &(0x7f0000000080), &(0x7f00000000c0)=0xc) recvfrom(r2, &(0x7f0000000180)=""/4096, 0x1000, 0x40000002, &(0x7f0000000000)=@generic={0x8, "9ffe12ed5b80cee32257d6d5a97c70f11f8a95d137459236b6b985309891b048b6d8c4f1c82a6a4b59e6598613aa213659000dff78ad1edcdc3ed503f5b4f718035f81e3904bb49efece0f5a19606036f74788a14ee13faa02b5178ae469e33f3d5788d12243828f4dcd1c0dcf82692c677efb892d851b7eaf36ecfd0f8e"}, 0x80) 03:17:17 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:17 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:18 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:18 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3219.502999] binder: release 25633:25641 transaction 5785 in, still active [ 3219.515413] binder_alloc_new_buf_locked: 6 callbacks suppressed [ 3219.515420] binder_alloc: 25633: binder_alloc_buf, no vma [ 3219.528369] binder: send failed reply for transaction 5785 to 25633:25641 03:17:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x6c000000, 0x0}) 03:17:18 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:18 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3219.623634] binder: undelivered TRANSACTION_COMPLETE [ 3219.709288] binder: BINDER_SET_CONTEXT_MGR already set [ 3219.721959] kauditd_printk_skb: 332 callbacks suppressed [ 3219.721973] audit: type=1804 audit(1551237438.153:51806): pid=25666 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4744/file0" dev="sda1" ino=17842 res=1 [ 3219.726809] binder: release 25660:25662 transaction 5790 in, still active 03:17:18 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:18 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) [ 3219.727463] audit: type=1804 audit(1551237438.153:51807): pid=25666 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4744/file0" dev="sda1" ino=17842 res=1 [ 3219.752769] binder: 25660:25667 ioctl 40046207 0 returned -16 [ 3219.782174] binder: send failed reply for transaction 5790 to 25660:25662 03:17:18 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:18 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) [ 3219.885635] audit: type=1804 audit(1551237438.153:51808): pid=25664 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5098/file0" dev="sda1" ino=17843 res=1 [ 3219.930167] binder: undelivered TRANSACTION_COMPLETE [ 3219.970007] audit: type=1804 audit(1551237438.153:51809): pid=25664 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5098/file0" dev="sda1" ino=17843 res=1 [ 3220.046450] audit: type=1804 audit(1551237438.233:51810): pid=25666 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4744/file0" dev="sda1" ino=17842 res=1 [ 3220.077364] audit: type=1804 audit(1551237438.233:51811): pid=25669 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4744/file0" dev="sda1" ino=17842 res=1 [ 3220.126454] audit: type=1804 audit(1551237438.233:51812): pid=25664 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5098/file0" dev="sda1" ino=17843 res=1 [ 3220.151630] audit: type=1804 audit(1551237438.233:51813): pid=25670 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5098/file0" dev="sda1" ino=17843 res=1 [ 3220.174672] audit: type=1800 audit(1551237438.283:51814): pid=25674 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=17841 res=0 [ 3220.194457] audit: type=1804 audit(1551237438.293:51815): pid=25674 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7381/file0" dev="sda1" ino=17841 res=1 03:17:18 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x3) 03:17:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x74000000, 0x0}) 03:17:18 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:18 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:18 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:18 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\b\x00'}, 0x45c) [ 3220.425786] binder: BINDER_SET_CONTEXT_MGR already set [ 3220.440981] binder_alloc: 25700: binder_alloc_buf, no vma [ 3220.447758] binder: release 25700:25703 transaction 5794 in, still active [ 3220.466055] binder: 25700:25705 ioctl 40046207 0 returned -16 03:17:18 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3220.472330] binder: send failed reply for transaction 5794 to 25700:25703 03:17:18 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:18 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:18 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x7a000000, 0x0}) [ 3220.534348] binder: undelivered TRANSACTION_COMPLETE 03:17:19 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x211) ioctl$KVM_ASSIGN_PCI_DEVICE(r1, 0x8040ae69, &(0x7f0000000040)={0x2, 0x6, 0x2, 0x7, 0xfffffffffffffffc}) ioctl$VIDIOC_DBG_G_REGISTER(r1, 0xc0385650, &(0x7f0000000000)={{0x1, @addr=0x6}, 0x8, 0x3, 0x8}) 03:17:19 executing program 4: socketpair(0x1, 0x1, 0x3, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000080)=0xffff, 0x4) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)="2e0000002e008183ad5de0713c444d000b0000001000034001000000053582c137153e370000000000000000d1bd", 0x2e}], 0x1}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r3 = fcntl$dupfd(r0, 0x409, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) [ 3220.666760] binder: release 25720:25725 transaction 5798 in, still active [ 3220.674665] binder_alloc: 25720: binder_alloc_buf, no vma [ 3220.691952] binder: 25720:25725 got reply transaction with no transaction stack 03:17:19 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:19 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:19 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:17:19 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x100000000000000, 0x0}) 03:17:19 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:19 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x5) getxattr(0x0, 0x0, 0x0, 0xfffffffffffffdd7) write$nbd(r1, &(0x7f0000000000)={0x67446698, 0x0, 0x2, 0x4, 0x1}, 0x10) [ 3220.888486] binder_transaction: 6 callbacks suppressed [ 3220.888499] binder: 25749:25754 got reply transaction with bad transaction stack, transaction 5804 has target 25749:25754 [ 3220.917933] binder_transaction: 28 callbacks suppressed [ 3220.917949] binder: 25749:25754 transaction failed 29201/-71, size 0-0 line 2816 03:17:19 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:19 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:19 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) [ 3220.999018] binder_alloc: 25749: binder_alloc_buf, no vma [ 3221.004687] binder: 25749:25764 transaction failed 29189/-3, size 0-0 line 3035 [ 3221.016818] binder: 25749:25754 got reply transaction with no transaction stack [ 3221.034129] binder: 25749:25754 transaction failed 29201/-71, size 0-0 line 2801 03:17:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x200000000000000, 0x0}) 03:17:19 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:19 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:19 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) r2 = syz_open_dev$swradio(&(0x7f00000002c0)='/dev/swradio#\x00', 0x1, 0x2) write$eventfd(r2, &(0x7f0000000280)=0x8, 0x8) r3 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x2400, 0x5) r4 = fcntl$dupfd(r1, 0x406, r0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000180)=0x0) ioctl$BLKTRACESETUP(r3, 0xc0481273, &(0x7f00000001c0)={[], 0x0, 0xffffffff, 0x0, 0x7, 0x3, r5}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x9b) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000080)={0x6, &(0x7f0000000040)=[{}, {}, {}, {0x0}, {}, {}]}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r4, 0x4010641c, &(0x7f0000000100)={r6, &(0x7f00000000c0)=""/38}) 03:17:19 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:19 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3221.295881] binder: 25782:25792 got reply transaction with bad transaction stack, transaction 5810 has target 25782:25792 03:17:19 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) [ 3221.343011] binder: 25782:25792 transaction failed 29201/-71, size 0-0 line 2816 03:17:19 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) [ 3221.410933] binder_alloc: 25782: binder_alloc_buf, no vma [ 3221.432499] binder: 25782:25801 transaction failed 29189/-3, size 0-0 line 3035 03:17:19 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) 03:17:19 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3221.463132] binder_release_work: 45 callbacks suppressed [ 3221.463138] binder: undelivered TRANSACTION_ERROR: 29189 03:17:19 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x300000000000000, 0x0}) 03:17:20 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:20 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) write$P9_RWALK(r0, &(0x7f0000000080)={0x64, 0x6f, 0x2, {0x7, [{0xa0, 0x0, 0x5}, {0x41, 0x4, 0xfe8}, {0x50, 0x3, 0x1}, {0x20, 0x3, 0x1}, {0x41, 0x1, 0x2}, {0x1, 0x2, 0x6}, {0x84, 0x2, 0x6}]}}, 0x64) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$SIOCRSSCAUSE(r3, 0x89e1, &(0x7f0000000000)=0x800) sendmsg$tipc(r3, &(0x7f0000001400)={&(0x7f0000000340)=@id={0x1e, 0x3, 0x1, {0x4e20}}, 0x10, &(0x7f0000001380)=[{&(0x7f0000000380)="c247d5c5ad7714c1d994902d1b6eb749c73c37453ad914016b08fa0bc7686f60ee96d9724c3a0c6199d4cbc8eb12171a8fec4e29df659a938d724c20abe06079ed190dcf2bc9f56df109c9c4d4249baff30465c7ba345b3b058f3dd47157fb8d9b71b14400946c10561e1767eeedf734dac624d4d45fb6ecd47cba9674ac9b0a50a9c912360548cb0d25d0629b22cd1a716a1c6b09684084f48f15088ce9dc57c2a94d283c82d20037d9724944698d410c108e4e88b9ae08a35bb67965d03931f46e12381222a12b27c7e0b38a129f0ae90d868f55808fe10001684d0cdb4829350b6ae4eb87c97253ef2c98011323fa3dc1b6c29d2ee7bd33db3fda7d54ae16cb791a883f53108a95e437548093aca639884a5211312cf7b08b3e299ec02ec1626a49e0c44782598094bfe3353318d9cef5f9713dba9c2e853421182c18f1ed2fccd84e6552340cc945423084cdfba85cfb713833c9f3b9f88889e10fa94c5662ecae69280813540e77e98f23da50dbcd4149c0ac8b3244a369f85666463af5a02ae6e4ef7bdd0eb20b9b0b304f0dc83d5ccbe4237297e715060227adc9d03f4b3765807a8324cae17f8194f617e5dc6a782f62586f56292030b3190b7449e2c5692684aa0f72eebff75dd96d6392c23638f5a48950955cf0f312f90e10a5d04b948d22e81823b3f6ee77a58af9b2133f7b9d546bac24ff6865683557437e0031f10ef92d0c0c9a454a56039d25fe275346e813100080d4ce9454737e18b6ab0fefaa275be59842246e9f42387aba0d051ce1f3088e326067c19fa8303f81a336b7c42092e98c180f32c5494b61a45f11e6d1dd78d0fb989db022c2fa900cbeef32c11eaf478acc4e88b5a450c7f213929a32e9423d0a7f5d0882b0f8933b3e71a7b496fab8edcb186e31e3697d60cae2ee54c649890f6b80fe2b46eb91c8fae24b2bf6ad19df89f1dfcbd64c4879c344b0fe1fb4d5be29591e54f2ecf2a4814e1cbd30f7c580ad473898a10602a924a9ea3dfae461fb466a798dd185096de36b004a2caad21ca381c055ae1cdc2b173b67ff968a289d17430bf7038f675174bd8ca3dad73dac5bd9daaeac9fe5848a10bf4097b3db15b0f6fcc3bbd3d757f396657efa35b12ca79bae47df851d22a0b8957fffa7eac698448dbcac1e81a4f0197001cc7ad20086509359a1bc5439be65ed7a624f79a7bff34f0d429df97770d82b6f1030895a917cd505a355a73646463a84d250dc3e3a588db154657e88547edc7bf630c5978a131cebb8e4116c0a336a18f25197e772003a865dfc5a6a9096ba3db9197d96d9b0c22eaf14e63925f553835ec0a0d3d7117ac1da80989edcb0f3192628c82acda142ae78cd3ccd72c398dc6abb290923163f8efee741f7494e8fce2c76c16fae510684bd2192d1aa3f37e46e9e42b932aa84e80278ec1b764ea1e8791aaff27e97c49fed1b7444bbededeffc4a2e66cd8c8cf4b921e9c74af43744eba625cad4a753d5311e66998e2b8c0a084bcb0e1c9aaea856ef2bee6e3446b86718ca9ebc87bb3247a5d095e46cb7c46c799fd168ebb8c9b0e53a546bb074e6a86e5c14ed0a4a52ab689c21cab6c03f8010b05d2825d14883bb0c524636f161e0b7e91e63a9f8cfeacf208c8e7160cf83846326fe4bb3c51cf765b5a3c1f88baadcddaff6a5c683d2bea1ba7c776897b68914153489d385294020a42957b67133a64a6d2160c71f11a172ac3176e2dc5c64324887d624f3a70b087a3e19782fd723a8f422914823f87c480bd938a35617b6852cefac7d4d704fea8cb3f66b2e91887dcbaa11755a344af1b05f274cc09c4fd8d94c9decb68bdfc0f592d8ab1de6c1cadbae05242dfbbbca0e70353131284ca26b344e35255a3a8c49048e76b8b4db676f8fddef5dc4331a422ad633dc4390b5e2e1c87ebfc1aef74552710f919baa26fbaa439a6569956ac5652af00c9a84830d0be9ce062682c08fb73035ba74313d58f9d76db0cea1deac0bdbb5f008ca7d8262f065a4ee6b7310a6fe722c4a5685ea7692a554817031231a903b5adb24839da346b30920cc361192a7e678c83fe3a592098e77dad07767eb63dc88c10fe585c6ae121c84902ac72b0ef2d90d22fbbd5ca4c1ddd7b87712aea9316a806e0a1bf55c18a52052e7d8a293755c70954d5eddb2db2d6156890f82067acaee325b55dd25d250dbcde9cd61524073e8657aa67b8e4c6483c7ad32b92bb415d910caeef2ee9423153db3145d00035ea8eabb50bd3bd3f346ed0c37893b72e556f794991913c5f2d5b14e9190cbbeadf6f283337aa5676cda36f2b3333f600bdcca11f38737385387525db4b99c6fdbb2bf4e58b55fbeff258c1b4eba433a3d06404059f3a77fc4a0f98f4ce051941d09d3693a091d23ad4abf00577c5dc3dfa6e927edd62f5c5639bcc49cd38f77e3c9373970a7ee985e71bdee00c752e66689789d0ccb63521232e622bd9ddcc5bc3fab2d492fbe7efceba41cb8398bdd765e7048fa090f69ded43d6d1ad4a635dc465e1e01c0bbe0eb64c10c634f0b2b2be585ab82e8b137046d82fbb2673878ad7139a07db5a544e3f14e791b44442f9dd71bad027c9f82f3708c42eb4b315a8c388105ed803a128ca05d498c4c00571b152e16abfd3a884342317abf2df569046dd4c23fab8f6efa3cc662aeb8dc8b5afdcfcccfd1665cf34c9a2b858bde5c47cda6a5bff8ac64330f5260cde9ebce9727552b83a6ea851939b1d620dc30fcef186dafcf37e30444f7ba3bb922142ed7adbeb64a0388dce45c410552c88cef5f89cce5d2317094c5eca38229c7c39b11684c45445976f4bee1324ca631fd0d5b98c6d196e4391320b310922e9952cdce87bd2d903a94636c675fb5c2b7acb828cce35bbf8cae64eb4e066088ab10011001c9fcc14773c401b89ad29f0b3583f36bc92b3d8c772812d4e5e9e61643c03abc56be662bc7c2c8741b15a529361d3cbfd2d80aa63e7c5aabe89ef0957d9bdafa439cfa4a99e032df8835ec20c15cc7b0628df45ed967e999cb40fcc6a7bf5836c92aa0657ddf49c72694c301f95074c07775475e1dcbe0bbf9cde4b040f33657979597ae8cd07a71c266bdcded4a7682e2a6e8be79decc0646e85f5b4e1552e6ad07c9e3fcd5daf6464bcb84e0c125c930f130ef6bf5b71a4ef438922998cb299abf6c0a69c41c1849583cc5369f4ed0b6a4faa41775194bfd8007ea6c3a139bd820c43e63fdb319435d73802d6fd6a1f0f837ae5d42ad2c67b632207a8b5e12f4d131eee9049da712a2341822f4ca483a39a4b0e0d236bea69b9af2f29c0c6c08d6f6a1de8a5bf8f7a287c2dc0000e5e99fed25a9c4ae6d90d44f3106ac7bad07cce1190f1c519719037397ca5ae13918455db52a8544f3ecec84f74ced424c5be476a596ddd56b957ea7353f543191d646df46a961d0974141d9073096278f6e79f1e7e0113c6cfde518150bcc2cb75d8515d2c01970d7ba4fb2be24085fa4988ea32246bc20fd81051654c5538327a9edb25852f712a159f504a8103bbff49600c3974c5e415146d47f16ef706572cf5ab8196e9dd46e7916422793cec6a4fb394ae52931afcb211d5d38e65c53814ba857a843a8f56e55fd7f87af051d94583afbbf8b429eee31ba7ebe0fda142af7c702a283aef0412a3c6af7b3345c178d7f931aa49eb4680b4ccc97ff4e34d33d9fba30b5fe3e6b8b263cd98faa87be127ada8288162b0d22538bfbe92f785e08c7598f7dfb6a57f7a2ae8398db5baa35da8cd1792c3ddfc68bf7ba7a3f590b779970edcea8b2ba557b95ebf6791087503d71a70872d5ecade76a0f256d56fa67782030643abd240bee7b96b1e6c66f5457cfafb2f3f8f90da670731aecb8c2318dec7c8a3056ec3d7eccbd141d8a4c514a522f379cbf39361cf6fdf884fb366add5ee0622c1a3b1e2b85bf0925c8fd07670944eae90e97d437e42f710a50a94ae4f8c4c3f538f5b48079ac4d39420188148c547d1d9f3bba21816048d4cf4e86882a66b5425dede3694ca857da04afea64d16c669fc639996601a096020412bb8823ab8fbee9b1e9123739d213e90df302dd1e2d681882c8fea76949664c77b7492837c5364293c35473068748416d2f3ab543941ba37dfa2bbad177632396e4d98a6ca4afeae47b617dea5787ac62e26e3a4f7829a1aa5ddc3e71ebf75ffa273d621b6bb6e066c1fd1871bca01a5ec64992304cb5d1d6287e8546f1921fdeb5b20cf934f7e6e4e5929dbc615c3814a6a733825a609beb6ae5b40b1245af61933190fc910834017a0f24279420146ab05cc43ef19e9818213741908b36dc26821d39ca5d5ac0c8e686f50938d0afe937ee073e80e4f2b9fbcad53fffd160ecef3a6ddf4b90bef830beca929b07c8654e491f76c5f794a3c1627f3b19bd4dd30aa27d400a3b0d4050dc8d956f5da6004c066e4cdc3f8a0bce464a1d95269435b54aaa20c623d76e7f4885566f66faa4b2b309b3796324744e421382e19c73383432dc39f1845ccdb964236e05d37ab11577f42f0b5818f63147f87d388b5aea019c9eef4db6952cd099b6cd1b72b6717401c0eb3197c302b94df802a035ff232520d80f2bb70dc978d7011e214d3d55b94183862671d6ad70dd4c18fcba68b0ad1795012a0d1af166ffd0aa8523cdff9e04d9996f66f5e2e8e51e4994ea1a7be2d08c2979aec3a3069dcef27752a6317d51ccebbd5654cd6f56fa0ff5f093e176236b926ed6d03038c788ea5d891eb237416aa57c0ac9f41527bcc316973e3342ac2982a2e033b3cf47228960e1bb553a13e7672918d2e177350bffa0c006f1e544ca324114343e8b47f39856d8281c4a429e283d665e928f01a8ce2a3eb5802ddd1abef5d65008de9aea6b5de54b5d9c059e43d9b8bef633bb05ba700ae5363a392284edf50901086881cb9022994decdfbacc5866385d2b7803ff3468ea6dbb9c398521742b87572c547f4ae2a22e5ddb636d2bce3408f532a8788145e3222f43ae27361156510eedc7a39fa81d4a1ee7670e2acbb777cda471bba2e41df53d011f454f4fccb6df0157dbe9af49e1c57400d8de4b85eb218ce3bf8596315be38a4b00e2a43a395f0c125b6c2e053a89a9a5c5f20ac23b15ecd39a2f0ceab1e4c73efbadb00c4403394e50e32b01ee8f07eb1b213bf855ea10d8aec03d083d7374dd45c2e9e1b9686c3e44d04fa93ddfec824b1634ce2f086186f269b7c41757b721eab8fc5e8f515a9344d6f3a303c94d54dfb5897a126a5dd60329abb855ff1a45a97ee6f80fd2c0517518170b313ca885ffc37800d848538516f224574f9896ff81ef30d4b8a6b0ce72662e0c9d20c550b3e846e979ca6baf351bbd1ad6613a1455f2889bee6d18a0ae4bfcf6f9992372b9804e078799076bff2ffa921ee6bdd7b4c4bff8881083728c2e585692f7fdec51dd13518604d803f810e8d36e019e842b90ec14fec223ab050cc2ebea9d66107272b951ab16ac240f16d5deb2511eaad0d30cfb293be69758bdfd0b89b5be61ad62a393f4292282e33bfda6e4bf1b3065cae4dffff2b9034f00666e858f3f609a9b17b75110627c3435633020614b7ef121e76406f7904be37c876afc59c25c9df481f173b60d1daadb1526e6b0f3cff7bfe93c49598de737e5e400f369e7826ec250c87044dec0f1351e08f07507dac713f7b68c1f3cebdbee1a41a29136be3de74ec264b94e7ff9b01baf397a3a84458a394ec714b4d60d1b671ab7db007ded0eb07ecfa973d311", 0x1000}], 0x1, &(0x7f00000013c0)="32bca760ae89500ff01ad3fb21c9487ffda1892f1bfd1d23001483a6f419c5112f30820dc6089aa9b358574ddab317304a", 0x31, 0x40}, 0xc0) getxattr(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000001440), &(0x7f0000001480)=0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x44, 0x0, &(0x7f0000000200)=[@transaction={0x40406300, {0x0, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000180)=[@fd={0x66642a85, 0x0, r1, 0x0, 0x1}, @fd={0x66642a85, 0x0, r0, 0x0, 0x2}, @fda={0x66646185, 0x7, 0x0, 0x17}], &(0x7f0000000100)=[0x28, 0x28, 0x70]}}], 0x45, 0x0, &(0x7f0000000280)="92e987c19d35f5117809be426adc37b44c426b6eddb388167bc3c2a8aa793d7a6ef888c12cc344fe6f3b2a9823fe68b521dc09d467152dbe13040fdbfadf44ba76a927caeb"}) 03:17:20 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\\\x00'}, 0x45c) [ 3221.589046] binder: undelivered TRANSACTION_ERROR: 29201 [ 3221.615669] binder: undelivered TRANSACTION_ERROR: 29189 03:17:20 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:20 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3221.746680] binder: 25834:25836 got reply transaction with bad transaction stack, transaction 5815 has target 25834:25836 03:17:20 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup(r1, &(0x7f0000000000)='syz0\x00', 0x1ff) 03:17:20 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) [ 3221.807627] binder: 25834:25836 transaction failed 29201/-71, size 0-0 line 2816 03:17:20 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) [ 3221.856892] binder_alloc: 25834: binder_alloc_buf, no vma [ 3221.879450] binder: 25834:25854 transaction failed 29189/-3, size 0-0 line 3035 03:17:20 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:20 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) [ 3221.923912] binder: undelivered TRANSACTION_ERROR: 29189 03:17:20 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) 03:17:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x400000000000000, 0x0}) 03:17:20 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r0) r3 = fcntl$getown(r0, 0x9) r4 = geteuid() r5 = getegid() ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000001f40)=0x0) getresuid(&(0x7f0000001f80), &(0x7f0000001fc0), &(0x7f0000002000)=0x0) getgroups(0x7, &(0x7f0000002040)=[0x0, 0xee00, 0x0, 0x0, 0xee01, 0xee01, 0xee01]) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000002080)=0x0) fstat(r1, &(0x7f00000020c0)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000002140)='./file0\x00', &(0x7f0000002180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(r1, 0x10, &(0x7f0000002200)={0x0, 0x0}) r13 = getuid() r14 = getegid() ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000002240)=0x0) r16 = geteuid() getgroups(0x9, &(0x7f0000002280)=[0xee01, 0xee01, 0x0, 0xffffffffffffffff, 0xee00, 0xee00, 0xee00, 0xee01, 0xee00]) r18 = getpgid(0x0) r19 = geteuid() getresgid(&(0x7f00000022c0)=0x0, &(0x7f0000002300), &(0x7f0000002340)) sendmmsg$unix(r0, &(0x7f0000002540)=[{&(0x7f0000000000)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000000400)=[{&(0x7f0000000080)="9384de6c59bff40fb04fd0008bd67988e631c2520fdb40433ed650175d23bee8633a9db9c9071170fbe4227af2ca2b7bf067384ec397be0a4e01c5f5ad055e00d5dd04b5ee9c0ef132b83e275a323ba775ee217367462c4558a30a30dc83229040de5ce8ddf852f1fce127bf", 0x6c}, {&(0x7f0000000100)="5593b3319859b320773a46dd13be4d9256ec531f7886cf1a3acf044cb925eab8ffb9d3bd1ad121a9fbd407c0508f", 0x2e}, {&(0x7f0000000180)="29c4626ed9b8bc6ad8af6299637631c5207918e015fd22785fefb6c3d4cf86ead501b6e6d77fe46b54af816414638e730bf58a786a5fbbfd3896b26222d119e62941e97e3e9f050f958a51a46704dd80be4a5207ba716df1959313954d4039d091936de9467727e0c44eb55e4bf9780f5566f3e00addeb84fcc44d932336db854bd11b5fb9204db3fc908167c48232d5be41ecefd874d7e47df70d5d608923e878fcf0ee0d254520aee2f5ef172fe99afd7cc2c3d11f01d9d511b730e15d813c0ee473b1b3c7e1c75c0ff51a9358b757f370febe335bea74d960e71e4f398aabddfdaf8a5ab65115f82bb9", 0xeb}, {&(0x7f0000000280)="f76e6b1339cf6c56c6da230c4ea6460c229ee4b9c72602548f6b4c9d77052f50ed1d0a31b5d876b480cf628e3b82d54e521fdf611baa17d43b09c722536f1153c83605843b31215bc56ea5a2769519eb70a9da26ac6678e84dc9aeb6655cd5f5e3d3175b721c3be600b498e59a41bf3affff4906c950a844a189efb2b713a9d1e72ee956a59c1ac884ede95ff769b7a34753c26c973e45158de649f1ce7efebf64267630ed49aa4767d07c07f01a451446e908de3f87a8054a736f02c1db0a03c360c36b447bc411d541500855eb70169b7d1fdbe81b83c52eb128", 0xdb}, {&(0x7f0000000380)="065ae6676dd036838df40a209eac27523d51411b91912ac8c545cce658fbdadae87bb47b13154b732218c19f16be20679a7fdbcd4c70c9276c7b47f8926134a8d882", 0x42}], 0x5, &(0x7f0000000480)=[@cred={0x20, 0x1, 0x2, r3, r4, r5}, @rights={0x18, 0x1, 0x1, [r0, r2]}, @rights={0x18, 0x1, 0x1, [r1]}], 0x50, 0x80}, {&(0x7f0000000500)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000000640)=[{&(0x7f0000000580)="9473f15b9b7fd2eb297c97417e8721e321d16e07f558bde10c987aca4cd5f750d863fb7ffdb7f0ff1f7862e7df4ecabc0078a6758be32fbbbd2fa03d7c1cfe34d99c6ac40ccc451652484ce5029d0113c67cfc54f05018a58d685fae2be9af56fc5acdac571e239505345be5faf816f6df0782970e1c43d354f331558af2ebf29a900567a0e4e825f0e312bbf3f96f4a2b76763936", 0x95}], 0x1, 0x0, 0x0, 0x8c0}, {&(0x7f0000000680)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000000b00)=[{&(0x7f0000000700)="2949dd65593b640c632d770404599867396f810cae38968319d8490e339b466d541d0a4991150659bec37b00b7e0f64ef6f5f8047161ad40a8d49efb254eeebb3c7fdd99a79d61b3af81e2829b552cae4e45a0093856edb41316c9c3f46918c615b8a1c198a1a8a271cfe343bd43d2168d30be4874364545dbeb3e4d52400156c7b3679e7d544c090fde81940cffb489d48323cc1587deab66c1416a", 0x9c}, {&(0x7f00000007c0)="e16cd97b12ffdef73deef178f4b25eeaeacbc17ce25929e633ebbde9db7cea11e963efe2f50f6b911e22df0cfdac8e3e999fe691be9641e00371bdab98cd6f5377d8dbf9876e1e432b3be85d7b5101098756931c44f438f5de09566126d2da370aab240fa03a5a001b592fde9c052807870f984c9f41633e276c2799bc7fc86a6ea98978d7f81e4e320039b43229b760751f7dc41c8c986fecc12b93b18344d5016e94a21f56afb3ee5b3a66c8c4ea93baa1957bb8739018162ec2962ef5be6ded4e6503c070d2d6c8815f8692eb61e560bfa819d56a70", 0xd7}, {&(0x7f00000008c0)="fed511722a716bff9c878c9cfc872673d85258e02408a7d2783cb5c6a658f0efe2ef7b096a3700fe242858dfd32c8961f0e63f2cd2996d75df", 0x39}, {&(0x7f0000000900)="7fb0e2676b89ba723a80ce0c9c3083d7b1e7c73f8437b32752e262c1c6eb61f2c75c913e9b41f3ddfa59fb9a188c074979719bc1a05ee814ea6d88507445bd933a645a7e8435437dee021c4dd28f703444519b6b72b61052bb8a8e0706f2bbf8597d95208d8bc496fe3ffe67161ae3ae5da6127c6058ee4771b35c08398fe077dc077323e44c70252327aba196f3fd53067b4f1dfab4c3a1261f7c081eb4b60a2b1edaefb8b9e6ca0186bc047ffa", 0xae}, {&(0x7f00000009c0)="9d7c44a6c79b878d25a75dd071b2f90756f0a1cb6dba2e32ce397ec9f1abeb71cae21fb4ff8cf268786861f7a0f9ee493d30fb11d377a7cedf4526b011e45228590871d1658bd0351885459e2d61afcc873f9f2ab4dba94598af2517a16479562122b14aaf46fd45510dfecbe4a5ba1df7c3b37dd18af328a8a916286568b63ed16b70c02f4ef291842d7ebde4a28f2824d85c030b2f46eccbda62cc87449b8a78524bf778e7a167d8cddec9b5e89a1b783c58544d32fb63a4ed7ee9fb01278a78a0752c8b3753d497dee4f9d5b1258e6018d027f9265d9b", 0xd8}, {&(0x7f0000000ac0)}], 0x6, 0x0, 0x0, 0x10}, {&(0x7f0000000b80)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000e00)=[{&(0x7f0000000c00)="49e485a57f20879dd831caa017bfee110b47780acd55be0fd2899655511e3c38330009a3dd624663f1fccf31d5a769d1473a572956fe", 0x36}, {&(0x7f0000000c40)="a8eeb642e67e445a5d8b0db36682d1c76ae6fd0316f7a8a138996b61da97623b8981daa16885746b3f88cb08ff5a493e2266ea495f9e348595099e25bda03c8ea658583fec0cd49db35a21875c21716fb150a9865881a141436a9b06d6b2aefcd07b2252de2b0e0e2ec04e603b38b82a918251a716c475bcb186c842423801e05941ba2ea336c44c6ddfbed4b1eb22", 0x8f}, {&(0x7f0000000d00)="6a0f4d8c9a82e2b8c190087584ddc666b4694bedc9831bb63bb6206832accf32f671011e2a962922b92e0f0e10cb2339007cbf5439631586c791c4dd8b744bf750ce2e0f2d87e450f75b8f7242276738d192d3b7488ea068069592ecbc4fd0f0ad7034cc99df457c6afccba9b8164e0408c0b51e46d8bb5d3c75c623ba993a4984a9403a85c0aa7b86c27608a9f1437205b1ba2123c77b27522448a599e8f88e01d5765c5e11e8832f92a387e86fe680365cfb58a58b7637d50cdfebd20ac824224aebd87d9f7fd20f20134e8aead71247498046cbdf723f7c6e7e7e818d41f62b33363154", 0xe5}], 0x3, 0x0, 0x0, 0x81}, {&(0x7f0000000e40)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000001f00)=[{&(0x7f0000000ec0)="1c8ce56f1f2a6d1bae31732f34b04fb407a991459636921afc9e2d87dc8f19d1022c9aef8b766b0513f9b6d94eefdb1490464f6e8625c45e56fadba6850688c15bdfb1b5607d40796644644229c105b7c92aa5c43da5458e8bd6e715e522cc94fa42c02f159591cde5c1542db5ea82215a5afaf716a363222944a1a28506c9beb4d94e1b17df9c133752651779075f927683694550fba74a13e1dabbe48ac5a0cb2c6a4085f5a7e25877227e4ddf1f11ae8f5e1b8c6091d80678e53e1756dec6cca0e0e29f8dd3a4517a7af97e6609c82f33db2a8d8576a3e515f4d1d4155d4028e70379dda05606e0b90a0f1c9893b9ab9d93f1e2a7910f354a90389a20811d3d4b26079a756e1d5a7a24f3e8bf456866b93f3f90a6868f8d1ee2c3d9bb08d05649edfce09c0d45c8f86ea8a92f6d45df115b5a3eebb2a3be3d8b392bf6069f8a4df8d537c867fd5f36541d60b4a9be85a84d9074352e2b9b887a49ac390f92524b0d5d85cdadba13689d4ec94e6eba5d7d5d776accb5f9009190862427eba14bf1841cb044b37132f568dba302c61ef717efd5e3a8a3799eac9d5d6748366ebffe67ba3dac8b198d3b48138d775d7de85acdd2461b88939fa747132cbd14ecaa8dd5da86882c3a911dc6e947d70bfc0ca55b3d1f1553f75feab4c47d28a7434defdd57b150fc7e4cd65967d786d07f63f0632bcb01e9fc9fc8b29910f10ff017bd851620754b18f8a530116ff61cdac3c8c15ddda75559f06542481532aa1de60639124fb1bad41a77f5f40a223b4e9b36bc2c784f1a8bc6563a65d3dd669e994828fbecf2d7be118fec625aaafecb3088484886b4e6537bfac7d375bd46c54b6b186cbae151dd5c0eb7aefafbed173ce491a39318e8a95840f07adee32070e6f86ce9eed6d2c8f2b66bdf76ff3b7ce79a600a4175a3096c0e9cede12cc422fda8cd5052232209be03eec71e6d00ff9964c2a55f823a16f074502e35590b58bfa98ae367d7e86d54f3d4fdfdaedf6f47a485ec7ee9aa567f33bf4cf01195c0d65bc1731dbb288b49c4022ecbdcba1ec6b7352e52589a106027923df29c279bacce30e82173e44174c247ff793003bd8075d91177b14e5191dde347674dbde97aa3ab61eab04ba6d36a5ec1ae1efbda50c131c698c554a0ea0f48ca09686364369faf99cdcf55fa45d16557fd6797113b2d390ba27d010c09a2c88782dcc83c165690e3bef4d241ce9fedaf93bb25ad7f8baaa8134071defb3ed1906a02cb436029e07140a05db0a2c7e89aa94c29ff814152aad5a07990057eef96d57c9fc6c9e07097d3a9730340c02bfca18beb4acb4a384185814fbd91394d9a002dff524ba7c247720c3d4e7e8ec31a7ca31469d51c20f4b01dd0e8ffe57af924e94f2a60ccc13631315bdd4be70e634fb72f8dd8c530a41cc035c737e7216976014b7a1c2e7173dadd72274ba83a1fb4501910f679a17603a90784e8bcd674bd8d1cae4b56505f9aa3ecdf6e57c62b1f734aca8ed6e1ca773ea7ab91882fdce9566249ca2e18e2169444a07643771f51dae8c7549acb7b9bb6cbf5c3f76a76490d57aecfc1435980ee95f9b13ab3377e9eb68c04d8b36d8a144dc2a610e703e23dd80bb3b89dfa5ace158b55f133dcb3a55167791c5658c05a2c2307dd2cbb780febc348a93c3e9dac5f8b20f2e04a41d447cf4f1229f64cbafceefd0794a1bae85136b5e3b7f323d65eabcb49e74795ed453c36dc4a56605ab6968e6f08a2fe9d14fa6142060ecb82e5c39f6bc5f0f8606537c5c0d602acd43bc7ece7d5f08f13da2c35a61583c73ecaf4ca25ae40d77601e5dfded3d0f615f3629c9cd76f79c0a8d9b9805d094eec175c77bdb9d3229cfc6453d142cf4845f96c122ea4b73cb53320254f49fe85a0caf16f93b6fab9a4742800ff5c6b3ab0a4a4c7088169bc797694968582ecee80f73fb70bf7e4a64ccbd824a8d3bb0bce3f27d695821a853b88302faf3a9e1dd6ba212d05d19622dd1729cde47e36c0ae6eff9b9ebc3d451709880729b62327165571f46d342a230f2127f081b5dfbc9eb9692ee979632609115e25dff5e7ea1ffbca8eebb7275cdf95d1c2608bcb3395b45aea9dda52496131a565164d8bf7bd0b585e7609b2ee279c953cb4eddbaf4413eb418f019b6d98272e173658aaab1fd77b8717e4777c7b5da5776ee89b0416fc5c2d17c0ae6ed7c94c8ca12646dd336372f15fb653138d2a7ef6da750d261ed51642f2b6ddbd72c75d3014077301a32345532191f36f6b420ce556f466bfbb6701d891fd2dfc041e905772723748acd7f04d022836b9d5896c0e37fc8695f604e0fb8d7fb571c3fa162e75076e5ef8aeae7f9dc1a18dcf051606117ab1dcc5824caa5ce1bbec8426e258e5c695ca044ee44212be0d172ddf5e22d3a452d9f30b19695fe37e377bbef0e834db35cd52976aa3e221f802dd951537d94c80fc38e1a2db76ef9a6435eb48895f5ae69948200a4b1d7a8ef79bc9abc2bc6f0ee523e012368a3281c1d9ebe53f79f38a870fd034de21d94370b5677641402ca564a80ed5831bb89e5fcdb112882f610c7163c2c8a6155f569cb313ff28d7f886a093caf2e1f901b4f127888cc1fce9408f0ce1748107e3af3e22a98d1d0716b3473c6b0f2d29122106499878b3fbd9bca58aaf322787d2d4a3fdeafd6f2a43684d3c0f738c2471a1f661ae43ed6b404a73ad527c9eb561a2526e274de8704450b35864c0dc2355fd56c1f02b665010ff51a7b6f2e060569a5f61ad27e2b55100456fa916edc37b7a868dc175e3a5c093d2d032c325614389ca0253e299bcefe7040d796e0025fca6338a0dc5c571776a57b65a0ea7ac0c11787c5eb82c08951a940747bba8075ac0a60124d1d479df96253b95d57f6ab45590e301db66f459b0284078fe1d5884004c81148d55372817c460729cc13b42157ef49e737214fa95a126bdad668067a9b8ce5979167662ef44acec2869eaabf0dc8dbdc541aed79885a3f8230383a350476551c1c376b1c2d31eb8f22612a08e9c64ee10e69b96ded3a1e6dc4ae83540ac6d49779f9670209cb0ae00d34278852e21e0a51d6278676848c3946e54931e1419cb5862efe345f4d69eb8e26e16c46998ced6815ab7cfbbb8a98f83de8e539f7df1049a55ec99ac1d5ff71816f9355010f9cfaddf2c5689d7b12e50a416b54cc5198158a12a4edfb2bbf80bc1c68a7638a014d63f23542fd903046b8868f9969f5eb69ef39d601fe3eb8ace661571ed855f46a478cbb8893054ff3563e8ecd14ed4ea10422a2702c0ab1be03e5086dde2974b66a2b82450a5024e12b0d6a74a6a3c28d3cdfa93dec23009cbe00f5e4481791b358585481324bf22b39b6c6dcac773fc3e34395fa856d7d644ddc61305afdb9202f01b166ae1f43c0edfb1ff5c4e76764048a8084295698cf1a93ed2f3bf6d724e971c11b467a28ffad5f769adb7aea1a106a308734abc459c5104d140bea6e96079a32b825fe5cce1f4901d0d011181d15b165c596aebd11655b23250897b612fddbd39d5bb91eb1b8ab7f097fe53e73bee2a9f03db534fe3b2476924741301f29cf2dea74473981c61bf1d4c66630665e73f74fbe6cbe465c223c75a43c7416beff3e3cfc8fad94d49e09cffaffb43ec650c9e89bcf4796078ecb3ee24316ea600292f357c2fac40dde58310eba75dbddd0c0fdbaab4a9fb1fc14e24a922693069e78e9a267dd91126a0b56068534d94151cab84a9fa3f8d68f1fc51cba3daf198e462a02054f42ec9de1395193c31ca2b07e076dd7eb57851f530f3fac2e98b3ade492e0043cf0d5952f7a04c3983e9b18761bea1900c7aa5c5d4f76a7cef4f789f29ab6b6dc0c83fa24b3692806a5f123b76493b520cde81832d81fc12f81d6839eafd404735b94c965f9f9a001af79ffe5aea84bc652e9410e61277a3704ab35592e8c670c2a476d05c83efcd75f1d6e2e7b445fc5506322528b51a3ce5611cb6fb2da4754fc2f315c2454c4761965889a0012fbf12ef477e30acf87fa82318bb95753bea441e772e397908a6890fd14e08e1f0743b6e07685bbcb1ff7e9de0323ce9dfae2032631957ee835fc15cceca067286b04b4026988e3ac0aff8c660cda6dcd9a92fa27654c24b25b5b41c1cc0e7224c3b35327e50bbf52d65a2d482505886782c90654ef83f9a302396b685cebc0b5f090eb01cb8967919686f096ffa9a857dc343a8e6138f9c6a67ba2388d8477f8242b29d8f53a7fa1225835a7b28a6583e7760ec9081df7bf8735240c5707c7f67cd39def81e891f0c0d4fb114b1b2c28d14b63a25febd9dc0184577edbbc9dda50c0c14a848111b2ad92eef950165479a11dd499750332ac79c0e407878106618758ba57525654cc0ad773e54925f5b921adb9da738162f00e0ba964db8be71c98acef666e052ae8c0a982602aff54d5488909c2d24b5c120b86465dd542d22b5c313e2552a739bb5c4cbb150b299cf6c60fe9520c3973d36039b5dd2fe5762d0530aa88f2a43e77d935bb4454bf56351f87c13170161a79d8a2280e0912c023a2127b0279d1de8bd9a54009e1469e289381a3451d118ffcc67fd84261a7e4480bc51ab99e3645b4044595308ea7868d376707c7ca2e9c03744efae625b9e84d6f3efb2e1c075da3ee2fe8d1e0e9e7cc337da9230efbfd65890f7013875705352998e5c00faf52819af68be171666344b65d54cb6f47ea49b9439402a0b4ba099a7f05fccc4d2303cbfb9767a627650ad4d2fd83bd4c5004cdaa4173cae7ce318f7486fad8d4a8dd3702a6dece0a084e28c2f45c7c263427c02fb6f08e9643b49aa8fc3c255dacffe051a811cd882d298048507f71770c0e3165a243af0b3c88f7e504514516f90bdde27b3186774924d147181d6c8a34b8d07a32d034e2de5d88d66837c73be12a61c2802b21d7b0cb05a538ac97e8ba0487ef722caa486f092d57841ccdf0cd8aec52d5e52ccf658edaf5ec7005c2f8a10f4617613ef0dc4a409a9eecc37981625d91871ffbae116b067583eaa215ba6fdd498845bdb19fd85d1e8f74ac768d83fc79966fbd3faed179641756f8f966090d4d3f1965f96e877fe0364a05def91c91eeeb468d1648917fa9480e1ac40cba38fff7ee6f6e2de1de72b27f6c5f3d10d9c8cb8c8ef7109f7ce326e6e6b2b0aa619e81729b5be4591eea0d88dd9dd8d1babf191706e30ff4d27f42714f580a16b0c4692fa2c3e9a4724aafa2c5d63306d5a55aeb69a4c46e36a1cf77d2a816f707775756cd6d93e1d1c0bd86228772f56262da5dcf99c826e682994a83135decb0b820557e04030cfc43da8b53c1a4064143047d56374f250906a9904641d42dc4a22ff5ca92fc7abf757edf14344ac1e6ca9a7c209525fbd201dc1f02edf35a14859f9032cbc1c38d7177fdbc709184051d43698c4bda336a00639c963c635403c4cc0817a177ba96842db58d4ebd7a5ea28dbdc0fc76a5ee77a7f07891e27d5b8cd501007563a7c07ac764156867eada21c1e8c8572a515f8795c17b69c4c62049dc52d3843c3a2862a3269639444ba0fd7002e8fea09ab663b57cd0c7d792255eb1c9dbb0ecaa63d87c1ebe625bc602583c0f5707debe876fce5cff25db00b1271925d327d643e2bdaca85c8b855e09ae561550c5bbbca4c62d39ac66bf4315295368e4034e52cfe2cebea820133e4e58c9eddd9b2d83555cb34c025fdfd57bf386b37892c0371a0d67feb74f4db2103fe3b67d13c7ddb1d792eb6958fd2b3c199", 0x1000}, {&(0x7f0000001ec0)}], 0x2, &(0x7f00000026c0)=ANY=[@ANYBLOB="28000000000000000100000001000000", @ANYRES32=r2, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="20000000000000000100000002000000", @ANYRES32=r6, @ANYRES32=r7, @ANYRES32=r8, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r1, @ANYRES32=r2, @ANYRES32=r1, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r9, @ANYRES32=r10, @ANYRES32=r11, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r12, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r0, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r15, @ANYRES32=r16, @ANYRES32=r17, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r18, @ANYRES32=r19, @ANYRES32=r20, @ANYBLOB="1259009b0000"], 0x100, 0x40}, {&(0x7f0000002480)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000002500), 0x0, 0x0, 0x0, 0x20048000}], 0x6, 0x8000) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) [ 3221.979709] binder: undelivered TRANSACTION_ERROR: 29201 [ 3221.990639] binder: undelivered TRANSACTION_ERROR: 29189 03:17:20 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:17:20 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3222.077226] binder: 25878:25879 got reply transaction with bad transaction stack, transaction 5820 has target 25878:25879 [ 3222.088891] binder: 25878:25879 transaction failed 29201/-71, size 0-0 line 2816 [ 3222.099069] binder_alloc: 25878: binder_alloc_buf, no vma [ 3222.106925] binder: 25878:25880 transaction failed 29189/-3, size 0-0 line 3035 [ 3222.116970] binder: 25878:25879 got reply transaction with no transaction stack [ 3222.127357] binder: 25878:25879 transaction failed 29201/-71, size 0-0 line 2801 [ 3222.160891] binder: undelivered TRANSACTION_ERROR: 29201 [ 3222.171459] binder: undelivered TRANSACTION_ERROR: 29189 03:17:20 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:20 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)) 03:17:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x500000000000000, 0x0}) [ 3222.234011] binder: undelivered TRANSACTION_ERROR: 29201 [ 3222.239562] binder: undelivered TRANSACTION_ERROR: 29189 03:17:20 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf5\xff\xff\xff\x00'}, 0x45c) 03:17:20 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00'}, 0x45c) 03:17:20 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3222.321498] binder: 25902:25904 got reply transaction with bad transaction stack, transaction 5826 has target 25902:25904 03:17:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x600000000000000, 0x0}) 03:17:20 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:20 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000000)) getxattr(0x0, 0x0, 0x0, 0x0) 03:17:20 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\xff\x0f\x00'}, 0x45c) [ 3222.452977] binder: send failed reply for transaction 5829, target dead 03:17:20 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:21 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) [ 3222.586700] binder: 25928:25935 got reply transaction with bad transaction stack, transaction 5831 has target 25928:25935 03:17:21 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:21 executing program 4: lsetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)=@known='system.sockprotoname\x00', &(0x7f0000000180)='/dev/media#\x00', 0xc, 0x2) r0 = getpgrp(0x0) r1 = syz_open_dev$media(&(0x7f00000000c0)='/dev/media#\x00', 0x101, 0x28000) perf_event_open(&(0x7f0000000040)={0x7, 0x70, 0xfffffffffffffbff, 0x400000008000, 0x9, 0x1, 0x0, 0x5, 0x20000, 0x1, 0x4, 0x100000001, 0x7f, 0x1, 0xf79f, 0x0, 0xac4, 0xff, 0x2, 0x7f, 0x9c61, 0x5, 0x101, 0x9d, 0x7fff, 0x4, 0x7fffffff, 0x8, 0x3, 0x2, 0x5, 0x5ec, 0x3ff, 0xfff, 0x401, 0x3, 0x3f, 0x6, 0x0, 0x3d, 0x6, @perf_config_ext={0x1, 0xbe0000000}, 0x0, 0x4, 0x8000, 0x5, 0xffffffffffffff7f, 0x3ffec6e, 0x6}, r0, 0x10, r1, 0x8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) pipe(&(0x7f0000000240)={0xffffffffffffffff}) removexattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)=@known='system.advise\x00') r4 = fcntl$dupfd(r2, 0x0, r2) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000380)={'veth1_to_hsr\x00', &(0x7f0000000340)=@ethtool_rxfh={0x46, 0x3ef, 0xffffffff, 0x6, 0x80, "efe900", 0x9, [0xdb, 0x7, 0x6, 0x10000]}}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x2, 0xb9b, 0xf0f, 0x7, 0x0, 0xf3, 0x8000, 0x1, 0x7fffffff, 0x19, 0x9, 0x6, 0x8, 0x1000, 0x800, 0x1, 0x80000000, 0x7, 0x4, 0x3, 0x2, 0xfffffffffffffeff, 0xecb, 0x3, 0x2, 0x7ff, 0x0, 0x1, 0x46, 0x2, 0x1ff, 0x2da068ec, 0x7fffffff, 0x10000, 0x1, 0x7f, 0x0, 0xff, 0x1, @perf_bp={&(0x7f0000000280), 0x1}, 0xc08, 0x1, 0x7f, 0x8, 0x80000000, 0x8f, 0x6}, r0, 0x6, r4, 0x2) getxattr(0x0, 0x0, 0x0, 0x0) [ 3222.644430] binder: BINDER_SET_CONTEXT_MGR already set [ 3222.649756] binder: 25928:25947 ioctl 40046207 0 returned -16 03:17:21 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf4\x00'}, 0x45c) 03:17:21 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x80\x00'}, 0x45c) 03:17:21 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:21 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x700000000000000, 0x0}) 03:17:21 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$FUSE_STATFS(r1, &(0x7f0000000000)={0x60, 0xffffffffffffffda, 0x4, {{0x10000, 0x100, 0x8, 0x4, 0x9d0, 0x1, 0x1ff, 0x64}}}, 0x60) getxattr(0x0, 0x0, 0x0, 0x0) 03:17:21 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) 03:17:21 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3222.917009] binder: 25969:25973 got reply transaction with bad transaction stack, transaction 5834 has target 25969:25973 03:17:21 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) [ 3222.994043] binder_send_failed_reply: 7 callbacks suppressed [ 3222.994053] binder: send failed reply for transaction 5834 to 25969:25973 [ 3223.000044] binder_alloc: 25969: binder_alloc_buf, no vma 03:17:21 executing program 4: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x200000, 0x0) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000100)=0x40) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000840)={{{@in=@dev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@local}}, &(0x7f0000000940)=0xe8) syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x3, 0x9, &(0x7f0000000540)=[{&(0x7f0000000080), 0x0, 0x1f}, {&(0x7f0000000180)="23ed9c4e114ec00475b4cc6e85f5f1853f9663230c95d08032e1fa46aa66f9fb719ea007e4b9b599e397de247e74cb3dc10026027dce7ac2fa89123ac3a6f69a4997515ea55cf69970517da645005e68a1b16c2f3d2071e09c6c97ec7a2e0e37e19335c4ebcb9cdd9944ef82272f805a9242da687a2733bb7e4c71ceb81581e377cccb73c1632b65786b9822550cb4bd9b5f7d8a1e1875bbe4ddcdbadc3b8eeeb80ff83875facedc14f8a68f4d62", 0xae, 0x81}, {&(0x7f0000000240)="49d4989e2a8038fd752772cb4d816e7f0282f60b2c871d5e498ffe9715f2cf03b9a65dffcf281ee46aaabd1913fbae8ec50def4b39ab610eb3402f5199f72c1830948f41e5dc466830b8fa51b92628ec15c18d4d6b9d5023fd33e36f9d311e42f9e2101e72ac4de68ab20343589e252956eddedc897fe60938bb82ddac1484f645feb62b068d944ea910c591770a594b750ac42e8902fa2b88769605cf530c5fb9476b2af6f99a5b97cedbc9c5e6", 0xae, 0x6}, {&(0x7f00000000c0)="b5221d061f8644954d727317fd65ee9ac92cd5e50be312f1cdee397ecc966b06910a276302ab74b1b33d", 0x2a, 0x2}, {&(0x7f0000000300)="892784e83249137409696d0909ff1ed70b5abaa92caa3471f3e4d51898d66f28f426798da38234d59ab8894a251cea5bcf0deb21d04dbc73ce028b7271e00c67f9da275150d314d037b63bf581c0", 0x4e, 0x9}, {&(0x7f0000000380)="9fdea9b49f649018468caf318e4ba6b8512bd750f2955f0be6d3ccee472edd44040fa0b9215b3b0ee6e8c20c9000184c8502c71a52bac48497f60f331d3294d88d103809121d5923c9a23a3a0bb9b3c4eb3bd584e7f8d59c818fa564a6022ede84b16cd659bea8e0a5cab6a4a94e7612e5161d1311d46d13dab0eceb209a2e31fed55bb72884a735f70a91ae1d8ea4bf8e284e020c57aedb896d0e956996e631e690c047b13307ded12fac88a471fb53091a0da9d61cc3885ef9eeacf1c93654628734e5e906d9a0f57a4ce6423c4edff095", 0xd2, 0x85f7}, {&(0x7f0000000480)="b9bc670bfd5c085636d5bcf4d500ddb285b8ed430e209f337af70a9335191cb67686cedbf12d45f39b19c33c9ca07ae29aa0d90b15d87791b45c36a794eebfd9a94b8f28d809859ac62dfd36660cca", 0x4f, 0x400}, {&(0x7f0000000100), 0x0, 0xffffffff}, {&(0x7f0000000500)="ffb06178d2cad4f917c353bf14f49ec8f0adec89bfc6ce1f0ca45d750348ed", 0x1f, 0xd6}], 0x80000, &(0x7f0000000780)=ANY=[@ANYBLOB='gquotargeio,fowner=\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESDEC=r2, @ANYBLOB="2c636f6e746578743d73797361646d5f752c736d61636b66736465663d656d31ea0cbdbbf83668d329d82d6367726f75702c7375626a5f757365723d2c736d61636b66736861743d70726f637d2a2c6f"]) fcntl$dupfd(r1, 0x0, r1) pipe2(&(0x7f0000000640), 0x80000) r3 = msgget(0x0, 0x401) r4 = getgid() lstat(&(0x7f0000000680)='./file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getpgid(0x0) r7 = getpgid(0xffffffffffffffff) msgctl$IPC_SET(r3, 0x1, &(0x7f0000000980)={{0x4, r2, r4, r2, r5, 0x0, 0x6}, 0x3f, 0x1000, 0x80, 0x6, 0x80000001, 0x81, r6, r7}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4009) getxattr(0x0, 0x0, 0x0, 0xffffffffffffff69) 03:17:21 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:21 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) 03:17:21 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0xa00000000000000, 0x0}) [ 3223.143878] binder_release_work: 8 callbacks suppressed [ 3223.143883] binder: undelivered TRANSACTION_COMPLETE 03:17:21 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:21 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}, 0x45c) [ 3223.247242] binder: 26007:26016 got reply transaction with bad transaction stack, transaction 5839 has target 26007:26016 03:17:21 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) ioctl$SIOCX25GSUBSCRIP(r1, 0x89e0, &(0x7f0000000000)={'hwsim0\x00', 0x582e, 0x100}) 03:17:21 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3223.374116] binder: BINDER_SET_CONTEXT_MGR already set 03:17:21 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) [ 3223.403826] binder_thread_release: 8 callbacks suppressed [ 3223.403835] binder: release 26007:26016 transaction 5839 in, still active [ 3223.420622] binder: 26007:26016 ioctl 40046207 0 returned -16 [ 3223.436099] binder: send failed reply for transaction 5839 to 26007:26016 03:17:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x2000000000000000, 0x0}) 03:17:21 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\xff\xff\xf0\x00'}, 0x45c) 03:17:21 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) lremovexattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="73656375726974792e706f73695b5f6163625f61636365737300706f0e84993b093a48aca023e8d5c791a3e78fb10ad6f20b571634e49e8d9c9a932ef9eb37836ab7"]) r2 = accept4$alg(r1, 0x0, 0x0, 0x800) ioctl$LOOP_SET_CAPACITY(r2, 0x4c07) getxattr(0x0, 0x0, 0x0, 0x0) [ 3223.496341] binder: undelivered TRANSACTION_COMPLETE 03:17:21 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:22 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) 03:17:22 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) [ 3223.619983] binder: 26047:26055 got reply transaction with bad transaction stack, transaction 5843 has target 26047:26055 03:17:22 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) sendmsg$nl_crypto(r1, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8844000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="200100001300000027bd7000fbdbdf25647262675f6e6f70725f736861310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000240000000000000000000000000000080001000100010008429e0001000100000008000100040000000800010000000000080001000400000008000100030000000800010086000000080001000e06"], 0x120}}, 0x4000000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) accept4$tipc(r1, &(0x7f0000000000)=@name, &(0x7f0000000040)=0x10, 0x80800) getxattr(0x0, 0x0, 0x0, 0x0) socket$unix(0x1, 0x1, 0x0) 03:17:22 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:22 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3223.679653] binder: release 26047:26055 transaction 5843 in, still active [ 3223.693305] binder_alloc: 26047: binder_alloc_buf, no vma [ 3223.707466] binder: send failed reply for transaction 5843 to 26047:26055 03:17:22 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00'}, 0x45c) 03:17:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x3f00000000000000, 0x0}) [ 3223.842218] binder: undelivered TRANSACTION_COMPLETE 03:17:22 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x406, r0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000000c0)=0x0) sched_getattr(r3, &(0x7f0000000040), 0x30, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) 03:17:22 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:22 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00'}, 0x45c) [ 3223.883715] binder: 26082:26085 got reply transaction with bad transaction stack, transaction 5848 has target 26082:26085 [ 3223.901843] binder: release 26082:26085 transaction 5848 in, still active [ 3223.916023] binder_alloc: 26082: binder_alloc_buf, no vma [ 3223.922880] binder: send failed reply for transaction 5848 to 26082:26085 03:17:22 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x01\x00'}, 0x45c) 03:17:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x4800000000000000, 0x0}) 03:17:22 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) [ 3224.054297] binder: undelivered TRANSACTION_COMPLETE 03:17:22 executing program 4: socketpair$unix(0x1, 0x20000000005, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x7fffffff, 0x1) getxattr(0x0, 0x0, 0x0, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x6f, &(0x7f0000000000)=0x7f, 0x4) 03:17:22 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:22 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:22 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3224.175131] binder: BINDER_SET_CONTEXT_MGR already set [ 3224.203726] binder: release 26105:26109 transaction 5853 in, still active 03:17:22 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffff9c, 0x0, 0x4, &(0x7f0000000000)='.&$\x00', 0xffffffffffffffff}, 0x30) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x8) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x5) getxattr(0x0, 0x0, 0x0, 0x0) [ 3224.220660] binder: 26105:26109 ioctl 40046207 0 returned -16 [ 3224.230019] binder: send failed reply for transaction 5853 to 26105:26109 03:17:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x4c00000000000000, 0x0}) 03:17:22 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 3224.327089] binder: undelivered TRANSACTION_COMPLETE 03:17:22 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf4\x00'}, 0x45c) 03:17:22 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:22 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/capi/capi20\x00', 0x52002, 0x0) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000200), &(0x7f0000000240)=0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r1, 0x0, r1) r4 = fcntl$dupfd(r2, 0x406, r3) writev(r1, &(0x7f00000002c0), 0x0) ioctl$VHOST_SET_LOG_BASE(r4, 0x4008af04, &(0x7f0000000180)=&(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x4001fb) getxattr(0x0, 0x0, 0x0, 0x0) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f0000000000)=0x5) openat$cgroup_type(r0, &(0x7f0000000280)='cgroup.type\x00', 0x2, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r4, 0xc0205648, &(0x7f00000000c0)={0xf9d0000, 0xe096, 0x100, [], &(0x7f0000000080)={0x0, 0x1, [], @p_u16=&(0x7f0000000040)=0x7}}) 03:17:22 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3224.477689] binder: release 26133:26139 transaction 5857 in, still active [ 3224.495546] binder: send failed reply for transaction 5857 to 26133:26139 03:17:22 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:23 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:23 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) 03:17:23 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$SIOCX25SCALLUSERDATA(r1, 0x89e5, &(0x7f0000000000)={0x44, "75ae885dc12ac7ec80294803fcb4e27909304df4ae54ed19e4bef7b23cab4fc805de6487a4865ea02cc6241d47c1867124358268675fb37f86c4841f3630282caa3ac2b33b6944ea5c71c8f8b5547a8a0aeee2a26103560b1890ececae9edce68a7f0e9f2845ece92024d491b040653f12963c55eee472df78d8fda03a7cc863"}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 03:17:23 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x6000000000000000, 0x0}) [ 3224.660014] binder: undelivered TRANSACTION_COMPLETE 03:17:23 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3224.730609] kauditd_printk_skb: 285 callbacks suppressed [ 3224.730621] audit: type=1800 audit(1551237443.163:52101): pid=26170 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=17844 res=0 03:17:23 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x20000, 0x0) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000040)=0x101, 0x4) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) 03:17:23 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3224.803055] audit: type=1800 audit(1551237443.163:52102): pid=26176 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=17883 res=0 [ 3224.838117] binder: release 26177:26187 transaction 5861 in, still active [ 3224.847453] binder_alloc: 26177: binder_alloc_buf, no vma 03:17:23 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) [ 3224.857300] binder: send failed reply for transaction 5861 to 26177:26187 03:17:23 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:23 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3224.888882] audit: type=1804 audit(1551237443.193:52103): pid=26176 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4764/file0" dev="sda1" ino=17883 res=1 03:17:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x6800000000000000, 0x0}) 03:17:23 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:23 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x40000, 0x0) ioctl$KVM_SET_DEBUGREGS(r1, 0x4080aea2, &(0x7f0000000180)={[0x1000, 0x6, 0x102000, 0x7000], 0x3, 0x20, 0x7}) r2 = fcntl$dupfd(r0, 0x0, r0) getpeername$llc(r2, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000080)=0x10) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000200)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000000100)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000300)={'team0\x00', r3}) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000000)={0x7, 0x3}) getxattr(0x0, 0x0, 0x0, 0x0) [ 3225.016156] binder: undelivered TRANSACTION_COMPLETE [ 3225.030000] audit: type=1804 audit(1551237443.193:52104): pid=26170 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7399/file0" dev="sda1" ino=17844 res=1 [ 3225.067200] audit: type=1804 audit(1551237443.193:52105): pid=26178 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5119/file0" dev="sda1" ino=17841 res=1 03:17:23 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:23 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:23 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) [ 3225.106151] audit: type=1804 audit(1551237443.193:52106): pid=26179 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5119/file0" dev="sda1" ino=17841 res=1 [ 3225.147972] binder: release 26207:26213 transaction 5866 in, still active [ 3225.156032] binder_alloc: 26207: binder_alloc_buf, no vma [ 3225.178045] binder: send failed reply for transaction 5866 to 26207:26213 03:17:23 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) pipe2$9p(&(0x7f0000000000), 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) [ 3225.259163] audit: type=1804 audit(1551237443.193:52107): pid=26170 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7399/file0" dev="sda1" ino=17844 res=1 03:17:23 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x6c00000000000000, 0x0}) [ 3225.311839] binder: undelivered TRANSACTION_COMPLETE 03:17:23 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) setsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000000040)={r2, r3/1000+30000}, 0x10) 03:17:23 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:23 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) [ 3225.384135] audit: type=1804 audit(1551237443.203:52108): pid=26176 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4764/file0" dev="sda1" ino=17883 res=1 [ 3225.407708] binder: BINDER_SET_CONTEXT_MGR already set [ 3225.424814] binder: 26235:26241 ioctl 40046207 0 returned -16 03:17:23 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3225.435744] binder: release 26235:26241 transaction 5871 in, still active [ 3225.465790] binder: send failed reply for transaction 5871 to 26235:26241 03:17:23 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3225.519306] audit: type=1804 audit(1551237443.213:52109): pid=26182 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7399/file0" dev="sda1" ino=17844 res=1 03:17:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x7400000000000000, 0x0}) [ 3225.561859] binder: undelivered TRANSACTION_COMPLETE 03:17:24 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0xc8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000080), 0xffffffffffffff04, 0x420ffe0, 0x0, 0x37) ioctl$sock_netdev_private(0xffffffffffffffff, 0x89f7, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004340), 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) [ 3225.604783] audit: type=1804 audit(1551237443.213:52110): pid=26170 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7399/file0" dev="sda1" ino=17844 res=1 03:17:24 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00'}, 0x45c) 03:17:24 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:17:24 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3225.692072] binder: release 26264:26270 transaction 5875 in, still active [ 3225.699268] binder_alloc: 26264: binder_alloc_buf, no vma [ 3225.712112] binder: send failed reply for transaction 5875 to 26264:26270 03:17:24 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:17:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x7a00000000000000, 0x0}) [ 3225.816007] binder: undelivered TRANSACTION_COMPLETE 03:17:24 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(r2, r0, 0x80000) getxattr(0x0, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r2, 0x8927, &(0x7f0000000180)) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x6a9) sendto$llc(r2, &(0x7f0000000000)="791f15c217825c546106f3f0e69c20cc5e71221e56de0e52f8a27ece07e7d521c1c2f556497a316e4bbce586e12ca5c8014d61fb7aaee7a640ff6990b57d93cd2a927ec01addc57350dbcf70a757d9f6d46affc974ccd57d27127962bd35aaa346911c7b5912d4f9b40493ff7406bfaea25dcb5835ee6ce78e47f70f7a7fa7637182429efe59759ea4a4dec29b8639efdb7c45acfb34f0217fb686d4145e35adb7b83bb35fb6e212838b654be7c921c63f590c3e3a45e18708", 0xfffffffffffffdea, 0x8080, &(0x7f00000000c0)={0x1a, 0xffff, 0x8, 0x8, 0x7, 0x10001, @random="e1ce05a1905d"}, 0x10) 03:17:24 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:24 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:24 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) [ 3225.931445] binder_transaction: 6 callbacks suppressed [ 3225.931458] binder: 26288:26293 got reply transaction with bad transaction stack, transaction 5880 has target 26288:26293 03:17:24 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) [ 3226.026653] binder_transaction: 22 callbacks suppressed [ 3226.026669] binder: 26288:26293 transaction failed 29201/-71, size 0-0 line 2816 [ 3226.050380] binder: release 26288:26293 transaction 5880 in, still active [ 3226.058713] binder_alloc: 26288: binder_alloc_buf, no vma 03:17:24 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000000)={0x2, r1}) getxattr(0x0, 0x0, 0x0, 0x0) 03:17:24 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3226.102108] binder: 26288:26310 transaction failed 29189/-3, size 0-0 line 3035 03:17:24 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:24 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:24 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) fcntl$getownex(r0, 0x10, &(0x7f0000000100)={0x0, 0x0}) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x285ca91d, 0x5, 0x8fef, 0x6, 0x0, 0x7, 0x1000, 0x8, 0xffffffffe86d4481, 0xbb9, 0x1f, 0x7, 0x6, 0x3, 0x0, 0x200, 0x40000000000000, 0x800000000000000, 0x7, 0x4d0, 0x1ad9, 0x20, 0x7, 0x8, 0x100, 0x100, 0x1, 0x8001, 0x1000, 0x3, 0x81, 0x80, 0xfffffffffffffffe, 0x10001, 0x0, 0x0, 0x0, 0x1, 0x7, @perf_config_ext={0x7, 0x765}, 0x10000, 0x3, 0x129, 0x4, 0x0, 0xfffffffffffffff9, 0x200}, r2, 0xa, 0xffffffffffffffff, 0x9) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) fsetxattr$security_selinux(r0, &(0x7f0000000180)='security.selinux\x00', &(0x7f0000000200)='system_u:system_r:kernel_t:s0\x00', 0x1e, 0x409e3481473d9060) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:24 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x10000024e) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000040)={0x2}, 0x4) 03:17:24 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:24 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) [ 3226.361549] binder: 26335:26342 got reply transaction with bad transaction stack, transaction 5885 has target 26335:26342 [ 3226.397896] binder: 26335:26342 transaction failed 29201/-71, size 0-0 line 2816 03:17:24 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:24 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:24 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='keyring+ppp0\xe5/}bdev}\xbawlan1}\x00', 0xffffffffffffffff}, 0x30) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000080)=r2) r3 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000100)) 03:17:24 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3226.468282] binder_alloc: 26335: binder_alloc_buf, no vma [ 3226.480022] binder: 26335:26356 transaction failed 29189/-3, size 0-0 line 3035 03:17:25 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) [ 3226.558226] binder_release_work: 37 callbacks suppressed [ 3226.558232] binder: undelivered TRANSACTION_ERROR: 29189 03:17:25 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:25 executing program 1: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vfio/vfio\x00', 0x80, 0x0) ioctl$BLKBSZGET(r0, 0x80081270, &(0x7f0000000340)) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) r3 = add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f0000000440)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffff8) keyctl$describe(0x6, r3, &(0x7f0000000500)=""/10, 0xa) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r4 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x40000, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r4, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40020000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x24, r5, 0x100, 0x70bd2c, 0x25dfdbff, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x8}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0063401d000000000000000000000000fe94bd9f0000000000000000000000000000000000000000000000800000c7000000000000000000000000008d840ae6e3e568b1f62e8d1a64ac0c4353ada6c89763b114a84ae5f3ceed9615780395993d61c182e01fee65f161e8910cd3c4cfb8d05e686f205e0b9ba7caa2"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r1, r2) modify_ldt$read_default(0x2, &(0x7f0000000300), 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0163404000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 3226.641440] binder: undelivered TRANSACTION_ERROR: 29201 [ 3226.646977] binder: undelivered TRANSACTION_ERROR: 29189 03:17:25 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae09, &(0x7f0000000000)=""/143) getxattr(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e21, @loopback}}, 0x7, 0x5, 0x2, 0x1000}, &(0x7f00000000c0)=0x98) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000100)={r2, 0x9}, &(0x7f0000000240)=0x8) 03:17:25 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:25 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3226.712042] binder: 26380:26381 unknown command 490758912 [ 3226.730416] binder: 26380:26381 ioctl c0306201 200001c0 returned -22 03:17:25 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) [ 3226.776136] binder: 26380:26381 got reply transaction with no transaction stack [ 3226.809924] binder: 26380:26381 transaction failed 29201/-71, size 0-0 line 2801 03:17:25 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3226.871248] binder: BINDER_SET_CONTEXT_MGR already set [ 3226.877464] binder: 26380:26399 unknown command 490758912 [ 3226.907289] binder: 26380:26387 ioctl 40046207 0 returned -16 03:17:25 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) 03:17:25 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:25 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000000)={r1, 0x0, 0x8, 0x0, 0xfffffffffffffffd}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) [ 3226.927523] binder: 26380:26399 ioctl c0306201 200001c0 returned -22 [ 3226.951810] binder: 26380:26381 got reply transaction with no transaction stack 03:17:25 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) [ 3227.032064] binder: 26380:26381 transaction failed 29201/-71, size 0-0 line 2801 03:17:25 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\\\x00'}, 0x45c) [ 3227.087994] binder: undelivered TRANSACTION_ERROR: 29201 03:17:25 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x1, 0x0) recvfrom$x25(r2, &(0x7f0000000100)=""/8, 0x8, 0x10000, &(0x7f0000000180)={0x9, @null=' \x00'}, 0x12) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r3 = dup2(r0, r1) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000000000)=0x9, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$KVM_SET_XCRS(r2, 0x4188aea7, &(0x7f0000000200)={0x1, 0x2fec, [{0x6, 0x0, 0x200}]}) 03:17:25 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vsock\x00', 0x40180, 0x0) ioctl$RTC_UIE_OFF(r2, 0x7004) r3 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f00000003c0)={r1, r2}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e21, @multicast1}}, 0x5, 0x2, 0x4, 0x3, 0x8}, &(0x7f00000000c0)=0x98) ioctl$FS_IOC_ENABLE_VERITY(r2, 0x6685) unlinkat(r2, &(0x7f0000000400)='./file0\x00', 0x0) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r2, 0x81785501, &(0x7f0000000300)=""/140) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r2, 0xc0045520, &(0x7f00000002c0)=0x6) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000100)={0x8, 0x2, 0x8, 0x10001, r4}, &(0x7f0000000240)=0x10) r5 = semget$private(0x0, 0x3, 0x10) semctl$SEM_STAT(r5, 0x4, 0x12, &(0x7f0000000000)=""/100) prctl$PR_SET_ENDIAN(0x14, 0x3) semctl$IPC_RMID(r5, 0x0, 0x0) write$P9_RMKDIR(r3, &(0x7f0000000080)={0x14, 0x49, 0x2, {0x4, 0x3}}, 0x14) getxattr(0x0, 0x0, 0x0, 0x0) 03:17:25 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3227.139543] binder: undelivered TRANSACTION_ERROR: 29201 03:17:25 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 3227.256133] Unknown ioctl 28676 [ 3227.263306] binder: 26436:26440 got reply transaction with bad transaction stack, transaction 5893 has target 26436:26440 [ 3227.275555] Unknown ioctl 26245 [ 3227.294465] Unknown ioctl -2122820351 03:17:25 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:25 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00'}, 0x45c) [ 3227.306391] Unknown ioctl -1073457888 [ 3227.315580] binder: 26436:26440 transaction failed 29201/-71, size 0-0 line 2816 [ 3227.356648] binder: BINDER_SET_CONTEXT_MGR already set [ 3227.367656] binder: 26436:26445 ioctl 40046207 0 returned -16 [ 3227.374482] Unknown ioctl 28676 [ 3227.387482] binder: 26436:26450 transaction failed 29189/-22, size 0-0 line 2896 03:17:25 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:17:25 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3227.404660] Unknown ioctl 26245 [ 3227.420490] Unknown ioctl -2122820351 [ 3227.427756] Unknown ioctl -1073457888 [ 3227.437502] binder: 26436:26460 got reply transaction with no transaction stack 03:17:25 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:25 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) fcntl$dupfd(r0, 0x0, r0) getxattr(0x0, 0x0, 0x0, 0x0) [ 3227.495909] binder: 26436:26460 transaction failed 29201/-71, size 0-0 line 2801 03:17:25 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) [ 3227.539064] binder: undelivered TRANSACTION_ERROR: 29189 [ 3227.570442] binder: undelivered TRANSACTION_ERROR: 29201 03:17:26 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000000)={0x2f, @local, 0x4e23, 0x0, 'wlc\x00', 0x8, 0x10000, 0x80}, 0x2c) dup2(r1, r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:26 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:26 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0xa38) getxattr(0x0, 0x0, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x2c300, 0x0) [ 3227.624736] binder: undelivered TRANSACTION_ERROR: 29201 [ 3227.638628] binder: undelivered TRANSACTION_ERROR: 29189 03:17:26 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:26 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) [ 3227.731872] IPVS: set_ctl: invalid protocol: 47 172.20.20.170:20003 [ 3227.755937] binder_alloc: 26484: binder_alloc_buf, no vma 03:17:26 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) lsetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@random={'os2.', '\xa6\x00'}, &(0x7f0000000080)='\x00', 0x1, 0x2) [ 3227.806706] binder: 26484:26491 transaction failed 29189/-3, size 0-0 line 3035 03:17:26 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:26 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3227.857741] binder_alloc: binder_alloc_mmap_handler: 26484 20001000-20004000 already mapped failed -16 [ 3227.884862] binder: BINDER_SET_CONTEXT_MGR already set [ 3227.898706] binder: 26484:26491 ioctl 40046207 0 returned -16 03:17:26 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:26 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00'}, 0x45c) [ 3227.928175] binder_alloc: 26484: binder_alloc_buf, no vma [ 3227.955113] IPVS: set_ctl: invalid protocol: 47 172.20.20.170:20003 03:17:26 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000000), 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) [ 3228.026075] binder: undelivered TRANSACTION_ERROR: 29189 03:17:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x8, 0x400200) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000180)={0xa, 0x4, 0xfa00, {r3}}, 0xc) write$UHID_INPUT2(r2, &(0x7f0000000200)={0xc, 0xe7, "848e56a069bdf250dd808f7e6054f72ee2392fa79f7f65a92359e282d17a229abd9c7ba738525d91ab0a1a9ce01146aac705e75bc5e13ce514b55601facab2a76659df03b4621826fb021728c471a90436dccaed65d6b691166ce043da46b2e0c927bd4a5b35cb1874c95552be73d916f3fc2a3e5a32773c62080fe82195342f347448e2b02aaf20305ec386b7636d94644a7a09fe783a0a12a1bc0ecd490d0feb0d5dc1cf0c6a9b8c5a19aa14f2612f34db5e7b4cf5e7e5b2de4cefc557218dc0806564be637802231e5ef2879f208b4ce769c3400d596475189b1d1148ef3c52d8ced1cb8175"}, 0xed) syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0x0, 0x802) r4 = shmget(0x0, 0x4000, 0x54000009, &(0x7f0000003000/0x4000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000500)=""/151) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) connect$pppoe(r2, &(0x7f0000000400)={0x18, 0x0, {0x4, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 'sit0\x00'}}, 0x1e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:26 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:26 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:26 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:26 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:26 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x1a7880, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getxattr(0x0, 0x0, 0x0, 0x0) [ 3228.206535] binder_alloc: 26531: binder_alloc_buf, no vma [ 3228.227233] binder: 26531:26532 got reply transaction with no transaction stack 03:17:26 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9a\f\x00'}, 0x45c) 03:17:26 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x200, 0xc040) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000180)={0x0, 0x9}, 0x8) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = msgget$private(0x0, 0x10) msgctl$MSG_STAT(r3, 0xb, &(0x7f0000000200)=""/145) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="006340400000000003000000000000000000000000000000000000000000000400000000c154fd55487cc99b002a9d66d89364270000000000000000000000c40fd7dd4558302b782778964eaa00000b9a88d367d012c2dfb76397c854ab300810a090c02c1806e8f92e14ba450908f53ab3b888860a974636d5a82212802f0132a8"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00e4ab00"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0}) 03:17:26 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:26 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:26 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)) fstat(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r1, r2, r3) r4 = fcntl$dupfd(r0, 0x0, r0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000000c0)=0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x7, 0x5, 0x0, 0x1, 0x0, 0x9, 0x10, 0x1, 0x0, 0x0, 0x3, 0x58814443, 0x1000, 0xad21, 0x1, 0x800000000, 0x1, 0x80, 0x3, 0x8, 0x2, 0x1000, 0x9, 0xffffffff, 0x9, 0x4e3e, 0x2, 0xbf6, 0x9, 0xffff, 0xffff, 0x400, 0x3, 0x3f, 0x9, 0x5, 0x0, 0x3, 0x4, @perf_config_ext={0x7, 0x4}, 0x4100, 0xffffffff, 0xb30, 0x7, 0x4, 0x7, 0xc0}, r5, 0xd, 0xffffffffffffffff, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sysinfo(&(0x7f00000002c0)=""/210) getxattr(0x0, 0x0, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000200)) ioctl$VT_OPENQRY(r4, 0x5600, &(0x7f00000003c0)) openat$random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x2, 0x0) 03:17:26 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:27 executing program 4: 03:17:27 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:27 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) 03:17:27 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) [ 3228.626144] binder: 26585:26587 got reply transaction with bad transaction stack, transaction 5908 has target 26585:26587 03:17:27 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:27 executing program 4: [ 3228.691235] binder_thread_release: 2 callbacks suppressed [ 3228.691246] binder: release 26585:26587 transaction 5908 in, still active [ 3228.706441] binder_alloc: 26585: binder_alloc_buf, no vma [ 3228.745828] binder_send_failed_reply: 4 callbacks suppressed [ 3228.745838] binder: send failed reply for transaction 5908 to 26585:26587 03:17:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x7, &(0x7f0000fff000/0x1000)=nil, 0x5) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/ip6_tables_targets\x00') ioctl$SNDRV_TIMER_IOCTL_STATUS(r2, 0x80605414, &(0x7f0000000440)=""/44) r3 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x800) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000003c0)=0x14) connect$packet(r3, &(0x7f0000000400)={0x11, 0x0, r4, 0x1, 0x81, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000180)={@ipv4={[], [], @remote}, 0x60, r4}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="016340400000000000000000000009000000000000000000000000000000000000000000000000000031c0d1000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) modify_ldt$write2(0x11, &(0x7f0000000280)={0xff, 0x20000000, 0x6000, 0x9, 0x80, 0x0, 0xa84, 0x7, 0x7}, 0x10) [ 3228.801267] binder_release_work: 4 callbacks suppressed [ 3228.801273] binder: undelivered TRANSACTION_COMPLETE 03:17:27 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:27 executing program 4: 03:17:27 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:27 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:27 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3228.924876] binder: 26608:26613 got transaction to context manager from process owning it 03:17:27 executing program 4: 03:17:27 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3229.000201] binder: BINDER_SET_CONTEXT_MGR already set [ 3229.069087] binder: 26608:26623 got reply transaction with no transaction stack [ 3229.100614] binder: 26608:26613 ioctl 40046207 0 returned -16 03:17:27 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) [ 3229.119617] binder: BINDER_SET_CONTEXT_MGR already set [ 3229.125355] binder: 26608:26623 ioctl 40046207 0 returned -16 03:17:27 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3229.165803] binder_alloc: 26608: binder_alloc_buf, no vma [ 3229.197905] binder: BINDER_SET_CONTEXT_MGR already set [ 3229.208479] binder: 26608:26635 got reply transaction with no transaction stack 03:17:27 executing program 4: 03:17:27 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3229.226700] binder: 26608:26613 ioctl 40046207 0 returned -16 03:17:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0xffffff61, 0x0, &(0x7f0000000000), 0x32, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:27 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:27 executing program 4: 03:17:27 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) 03:17:27 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:27 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:27 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x400000000000000, 0x0}) [ 3229.505430] binder: 26665:26669 unknown command 0 03:17:28 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) [ 3229.534181] binder: 26665:26669 ioctl c0306201 200001c0 returned -22 03:17:28 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3229.607041] binder: BINDER_SET_CONTEXT_MGR already set [ 3229.618221] binder: 26665:26682 got reply transaction with no transaction stack [ 3229.627635] binder: 26665:26682 unknown command 0 [ 3229.639260] binder: 26675:26680 ioctl 40046207 0 returned -16 [ 3229.645614] binder: 26665:26682 ioctl c0306201 200001c0 returned -22 03:17:28 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3229.679790] binder: 26665:26669 got reply transaction with no transaction stack 03:17:28 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:17:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$TCSETAW(r2, 0x5407, &(0x7f0000000000)={0x100000000, 0x100000001, 0x7ff, 0x1, 0xf, 0x6, 0x1, 0x806, 0x80, 0x1c00}) 03:17:28 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:28 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:28 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) [ 3229.829108] kauditd_printk_skb: 294 callbacks suppressed [ 3229.829120] audit: type=1800 audit(1551237448.253:52405): pid=26701 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=17917 res=0 [ 3229.858472] binder: 26702:26705 got reply transaction with bad transaction stack, transaction 5923 has target 26702:26705 03:17:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x2000, 0x0}) 03:17:28 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) [ 3229.912514] audit: type=1804 audit(1551237448.253:52406): pid=26701 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7419/file0" dev="sda1" ino=17917 res=1 [ 3229.952333] binder: 26702:26715 ioctl 5407 20000000 returned -22 03:17:28 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) [ 3230.017568] binder: BINDER_SET_CONTEXT_MGR already set [ 3230.032240] binder: release 26702:26705 transaction 5923 in, still active [ 3230.039262] binder: 26702:26705 ioctl 40046207 0 returned -16 [ 3230.061433] binder: send failed reply for transaction 5923 to 26702:26705 [ 3230.076242] audit: type=1804 audit(1551237448.273:52407): pid=26701 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7419/file0" dev="sda1" ino=17917 res=1 [ 3230.109029] binder: 26702:26724 ioctl 5407 20000000 returned -22 [ 3230.132796] audit: type=1800 audit(1551237448.273:52408): pid=26704 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=17920 res=0 [ 3230.160114] binder: 26722:26729 got reply transaction with bad transaction stack, transaction 5927 has target 26722:26729 03:17:28 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) [ 3230.169294] audit: type=1804 audit(1551237448.273:52409): pid=26704 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5140/file0" dev="sda1" ino=17920 res=1 [ 3230.188415] binder: release 26722:26729 transaction 5927 out, still active 03:17:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000180)=0x0) syz_open_procfs(r2, &(0x7f00000005c0)='net/hci\x00') ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fdc50d7abec2874a8f6dc83a8b63e2d21b545794d0d934af6ad6ec31e6"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000040)="b93c564b86c1490d5f9ef9ec63ff2d3822e10008004ecf6d", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg$alg(r4, &(0x7f0000004480)=[{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000140)="9e672fcabf0638f6708973634993a885d57efc71139fe547cee6cd07a2fba66b2f", 0x21}], 0x1}], 0x1, 0x0) r5 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="01346f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e3ffffffffffffff0000000000006a3ea36cc09f2b94aaba779882b7d9f7ed1e22e1d0626c2a51d977dc15a90a8adb8dcff00186c847d06608b68504bccb05e5639769242a6ed8cbbb326f534e33f46e4559cd335c9b55d70d7d10926430e0f2bc852760391ecebfd9c19dbf8e22990199bfd2c548ab322685a04fad3da457654497e3b8b95da641bde112f300000000"], 0x0, 0x0, 0x0}) preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000200)=""/242, 0xf2}, {&(0x7f0000000500)=""/129, 0x81}, {&(0x7f0000000640)=""/159, 0x9f}], 0x3, 0x0) ioctl$GIO_FONTX(r5, 0x4b6b, &(0x7f0000000380)=""/243) ioctl$TUNGETVNETHDRSZ(r5, 0x800454d7, &(0x7f00000000c0)) 03:17:28 executing program 4 (fault-call:4 fault-nth:0): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:28 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9a\f\x00'}, 0x45c) [ 3230.256178] audit: type=1804 audit(1551237448.293:52410): pid=26704 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5140/file0" dev="sda1" ino=17920 res=1 [ 3230.270635] binder: undelivered TRANSACTION_COMPLETE 03:17:28 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:28 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3230.349161] binder: release 26722:26729 transaction 5927 in, still active [ 3230.367622] binder: 26736:26745 unknown command 2047723005 [ 3230.380415] binder: send failed reply for transaction 5927, target dead [ 3230.393362] binder: 26736:26745 ioctl c0306201 20000140 returned -22 [ 3230.406920] binder: undelivered TRANSACTION_COMPLETE [ 3230.426571] FAULT_INJECTION: forcing a failure. [ 3230.426571] name failslab, interval 1, probability 0, space 0, times 0 [ 3230.429548] audit: type=1804 audit(1551237448.323:52411): pid=26704 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5140/file0" dev="sda1" ino=17920 res=1 [ 3230.451908] CPU: 1 PID: 26751 Comm: syz-executor.4 Not tainted 5.0.0-rc8+ #88 [ 3230.468444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3230.477801] Call Trace: [ 3230.477824] dump_stack+0x172/0x1f0 [ 3230.477845] should_fail.cold+0xa/0x1b [ 3230.477862] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 3230.484058] ? lock_downgrade+0x810/0x810 [ 3230.484078] ? ___might_sleep+0x163/0x280 [ 3230.484098] __should_failslab+0x121/0x190 [ 3230.484114] should_failslab+0x9/0x14 [ 3230.509370] kmem_cache_alloc_node_trace+0x270/0x720 [ 3230.510182] audit: type=1804 audit(1551237448.323:52412): pid=26709 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5140/file0" dev="sda1" ino=17920 res=1 [ 3230.514480] ? __might_fault+0x12b/0x1e0 [ 3230.514504] __kmalloc_node+0x3d/0x70 [ 3230.514523] kvmalloc_node+0x68/0x100 03:17:28 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:29 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3230.514538] ? seq_dentry+0x2d0/0x2d0 [ 3230.514554] seq_read+0x832/0x1130 [ 3230.538141] binder: 26736:26745 unknown command 1081029633 [ 3230.541415] ? seq_dentry+0x2d0/0x2d0 [ 3230.541431] proc_reg_read+0x1fa/0x2c0 [ 3230.541449] ? proc_reg_unlocked_ioctl+0x2a0/0x2a0 [ 3230.545388] binder: 26736:26745 ioctl c0306201 20000600 returned -22 [ 3230.549019] ? rw_verify_area+0x118/0x360 [ 3230.549037] do_iter_read+0x4a9/0x660 [ 3230.549052] ? dup_iter+0x260/0x260 [ 3230.549076] vfs_readv+0xf0/0x160 [ 3230.553881] binder: 26736:26745 ioctl 4b6b 20000380 returned -22 [ 3230.556384] ? compat_rw_copy_check_uvector+0x3f0/0x3f0 [ 3230.556402] ? kasan_check_read+0x11/0x20 [ 3230.556431] ? __fget+0x367/0x540 [ 3230.556447] ? iterate_fd+0x360/0x360 [ 3230.556463] ? check_preemption_disabled+0x48/0x290 [ 3230.562606] audit: type=1804 audit(1551237448.333:52413): pid=26710 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7419/file0" dev="sda1" ino=17917 res=1 [ 3230.565851] ? wait_for_completion+0x440/0x440 [ 3230.565871] ? __fget_light+0x1a9/0x230 [ 3230.565891] do_preadv+0x1c4/0x280 [ 3230.565907] ? do_readv+0x290/0x290 [ 3230.569882] audit: type=1804 audit(1551237448.333:52414): pid=26701 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7419/file0" dev="sda1" ino=17917 res=1 [ 3230.574688] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 3230.574704] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 3230.574719] ? do_syscall_64+0x26/0x610 [ 3230.574733] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3230.574745] ? do_syscall_64+0x26/0x610 [ 3230.574763] __x64_sys_preadv+0x9a/0xf0 [ 3230.581779] binder: 26736:26745 ioctl 800454d7 200000c0 returned -22 [ 3230.585363] do_syscall_64+0x103/0x610 [ 3230.585384] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3230.585396] RIP: 0033:0x457e29 [ 3230.585420] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 03:17:29 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:29 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) [ 3230.585430] RSP: 002b:00007f10c3318c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 3230.596256] RAX: ffffffffffffffda RBX: 00007f10c3318c90 RCX: 0000000000457e29 [ 3230.596265] RDX: 0000000000000002 RSI: 0000000020000540 RDI: 0000000000000006 [ 3230.596274] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3230.596283] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f10c33196d4 [ 3230.596292] R13: 00000000004c4933 R14: 00000000004d8210 R15: 0000000000000007 [ 3230.776019] binder: BINDER_SET_CONTEXT_MGR already set 03:17:29 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:29 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) [ 3230.842077] binder: 26736:26745 unknown command 2047723005 [ 3230.853114] binder: 26736:26745 ioctl c0306201 20000140 returned -22 [ 3230.866910] binder: send failed reply for transaction 5930 to 26736:26745 [ 3230.868178] binder: 26736:26767 unknown command 1081029633 [ 3230.877778] binder: 26736:26753 ioctl 40046207 0 returned -16 03:17:29 executing program 4 (fault-call:4 fault-nth:1): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3230.887852] binder: 26736:26767 ioctl c0306201 20000600 returned -22 [ 3230.902459] binder: 26736:26761 ioctl 4b6b 20000380 returned -22 [ 3230.910040] binder: 26736:26745 ioctl 800454d7 200000c0 returned -22 03:17:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = mmap$binder(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)={r2}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:29 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:29 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:29 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) [ 3231.015792] binder: undelivered TRANSACTION_COMPLETE [ 3231.030185] FAULT_INJECTION: forcing a failure. [ 3231.030185] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 3231.042004] CPU: 0 PID: 26784 Comm: syz-executor.4 Not tainted 5.0.0-rc8+ #88 [ 3231.049282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3231.058647] Call Trace: [ 3231.061242] dump_stack+0x172/0x1f0 03:17:29 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 3231.064882] should_fail.cold+0xa/0x1b [ 3231.068782] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 3231.073889] ? mark_held_locks+0x100/0x100 [ 3231.078133] should_fail_alloc_page+0x50/0x60 [ 3231.082642] __alloc_pages_nodemask+0x1a1/0x710 [ 3231.087316] ? find_held_lock+0x35/0x130 [ 3231.091399] ? __alloc_pages_slowpath+0x2900/0x2900 [ 3231.096442] cache_grow_begin+0x9c/0x8c0 [ 3231.100513] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 3231.106055] ? check_preemption_disabled+0x48/0x290 [ 3231.111084] kmem_cache_alloc_node_trace+0x658/0x720 [ 3231.116192] ? find_held_lock+0x35/0x130 [ 3231.120262] ? __might_fault+0x12b/0x1e0 [ 3231.124328] __kmalloc_node+0x3d/0x70 [ 3231.128129] kvmalloc_node+0x68/0x100 [ 3231.131939] ? seq_dentry+0x2d0/0x2d0 [ 3231.135750] seq_read+0x832/0x1130 [ 3231.139311] ? seq_dentry+0x2d0/0x2d0 [ 3231.143118] proc_reg_read+0x1fa/0x2c0 [ 3231.147015] ? proc_reg_unlocked_ioctl+0x2a0/0x2a0 [ 3231.148477] binder: 26787:26796 got reply transaction with bad transaction stack, transaction 5933 has target 26787:26796 [ 3231.151949] ? rw_verify_area+0x118/0x360 [ 3231.151968] do_iter_read+0x4a9/0x660 [ 3231.151983] ? dup_iter+0x260/0x260 [ 3231.152008] vfs_readv+0xf0/0x160 [ 3231.152026] ? compat_rw_copy_check_uvector+0x3f0/0x3f0 [ 3231.152041] ? kasan_check_read+0x11/0x20 [ 3231.152059] ? __fget+0x367/0x540 [ 3231.152077] ? iterate_fd+0x360/0x360 [ 3231.152091] ? ___preempt_schedule+0x16/0x18 [ 3231.152108] ? wait_for_completion+0x440/0x440 [ 3231.152125] ? __fget_light+0x1a9/0x230 [ 3231.152142] do_preadv+0x1c4/0x280 [ 3231.152156] ? do_readv+0x290/0x290 [ 3231.152169] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 3231.152183] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 3231.152197] ? do_syscall_64+0x26/0x610 [ 3231.152211] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3231.152224] ? do_syscall_64+0x26/0x610 [ 3231.152243] __x64_sys_preadv+0x9a/0xf0 [ 3231.167561] binder_transaction: 19 callbacks suppressed [ 3231.167576] binder: 26787:26796 transaction failed 29201/-71, size 0-0 line 2816 [ 3231.171255] do_syscall_64+0x103/0x610 [ 3231.171277] entry_SYSCALL_64_after_hwframe+0x49/0xbe 03:17:29 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}, 0x45c) [ 3231.171290] RIP: 0033:0x457e29 [ 3231.171305] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 3231.171313] RSP: 002b:00007f10c3318c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 3231.171327] RAX: ffffffffffffffda RBX: 00007f10c3318c90 RCX: 0000000000457e29 [ 3231.171335] RDX: 0000000000000002 RSI: 0000000020000540 RDI: 0000000000000006 [ 3231.171343] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 03:17:29 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:29 executing program 4 (fault-call:4 fault-nth:2): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3231.171351] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f10c33196d4 [ 3231.171373] R13: 00000000004c4933 R14: 00000000004d8210 R15: 0000000000000007 [ 3231.194236] binder: release 26787:26796 transaction 5933 in, still active [ 3231.284317] binder: send failed reply for transaction 5933 to 26787:26796 [ 3231.348287] binder: release 26787:26803 transaction 5936 out, still active [ 3231.385229] binder: undelivered TRANSACTION_COMPLETE 03:17:29 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:29 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 3231.406443] binder: undelivered TRANSACTION_COMPLETE 03:17:29 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:29 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap$binder(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x2000000, 0x12, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0xfffffffffffffd5e, 0x0, &(0x7f0000000640)=[@clear_death={0x400c630f, 0x0, 0x2}, @free_buffer={0x40086303, r2}, @enter_looper, @enter_looper, @dead_binder_done, @free_buffer={0x40086303, r2}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=[@ptr={0x70742a85, 0x0, &(0x7f00000002c0), 0x0, 0x2, 0x9}, @flat={0x73682a85, 0xa, r2, 0x3}, @ptr={0x70742a85, 0x1, &(0x7f0000000400), 0x0, 0x4, 0x1e}], &(0x7f0000000440)=[0x20]}}, @reply={0x40406301, {0x0, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@flat={0x77622a85, 0x10b, r2, 0x2}], &(0x7f0000000180)=[0x48, 0x18]}}, @release={0x40046306, 0x1}], 0xffffffffffffffde, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:29 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) [ 3231.521277] binder: release 26787:26796 transaction 5936 in, still active [ 3231.528262] binder: send failed reply for transaction 5936, target dead 03:17:30 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x76}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:30 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\\\x04\x00'}, 0x45c) 03:17:30 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:30 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3231.617166] binder: 26831:26834 ioctl c0306201 20000580 returned -14 [ 3231.667649] binder: 26831:26834 got reply transaction with no transaction stack 03:17:30 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) [ 3231.717268] binder: 26831:26834 transaction failed 29201/-71, size 0-0 line 2801 [ 3231.754513] binder_alloc: binder_alloc_mmap_handler: 26831 20001000-20004000 already mapped failed -16 03:17:30 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x200000a4}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:30 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:30 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3231.850470] binder: 26831:26838 ioctl c0306201 20000580 returned -14 03:17:30 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x7ffff000}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3231.909133] binder: 26831:26834 got reply transaction with no transaction stack [ 3231.930557] binder_release_work: 25 callbacks suppressed [ 3231.930564] binder: undelivered TRANSACTION_ERROR: 29201 [ 3231.947109] binder: 26831:26834 transaction failed 29201/-71, size 0-0 line 2801 03:17:30 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) 03:17:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000000)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:30 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:30 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:30 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3232.047685] binder: undelivered TRANSACTION_ERROR: 29201 03:17:30 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0x20000177}], 0x2, 0x0) 03:17:30 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) [ 3232.150942] binder: 26885:26886 got reply transaction with bad transaction stack, transaction 5942 has target 26885:26886 [ 3232.183052] binder: 26885:26886 transaction failed 29201/-71, size 0-0 line 2816 03:17:30 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:30 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:30 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3232.224382] binder: release 26885:26886 transaction 5942 in, still active [ 3232.234013] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 3232.234021] binder_alloc: 26885: binder_alloc_buf, no vma [ 3232.247724] binder: send failed reply for transaction 5942 to 26885:26886 03:17:30 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0x7fffefdc}], 0x2, 0x0) [ 3232.306355] binder: 26885:26893 transaction failed 29189/-3, size 0-0 line 3035 [ 3232.342161] binder: undelivered TRANSACTION_ERROR: 29189 03:17:30 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:30 executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x200000, 0x20) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000200)={0x0, {0x2, 0x4e24, @remote}, {0x2, 0x4e21, @multicast2}, {0x2, 0x4e23, @multicast2}, 0x8, 0x0, 0x0, 0x0, 0x81, &(0x7f0000000180)='gre0\x00', 0x6, 0x7f}) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) r3 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x5, 0x2001) ioctl$TUNDETACHFILTER(r3, 0x401054d6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c601268ac0858b6c94114dbb4e82c15630000057c41b785396f5f2d282c09795f7d1f54640aad5942ed3c25341485dc54dcf44b713798ad9725d1eff5de0005"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$VIDIOC_QUERYSTD(r3, 0x8008563f, &(0x7f0000000080)) epoll_wait(r0, &(0x7f0000000380)=[{}, {}, {}, {}, {}, {}], 0x6, 0x69) mknod$loop(&(0x7f0000000280)='./file0\x00', 0x244, 0x1) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000500)='/dev/mISDNtimer\x00', 0x400, 0x0) dup2(r1, r2) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0163404000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000cd12c5c1576f1736414abeb64c3bc96e1fd41ad504326818414f132cd07f00000000000000cb45c4a403b4c58a775e33b5049987283accc522020d591dd1fc3d9d0e57b9b8ed3820182e3326597fccdc9f3e40896fb9985249c186d0b6fb3bd97b59eeebc9398cc60b078fe6a1839da8be1f5ab936aa919063779a50365b71d58b813eb0f40fb612391b4697fc9f02292c6c2484ca2158439d47d2f17c4a36264e532ef3269b2fbbc061b79df52b21671ecb12d29827a0cdd02f5721fd8c6f78d047662644560458d488295acf5501000000101782d6ea8cfdabd89636a5190a3dfd559c5f94741fe1ba2af7996b587c250d187e0f"], 0x0, 0x0, 0x0}) 03:17:30 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) [ 3232.419298] binder: undelivered TRANSACTION_COMPLETE [ 3232.425895] binder: undelivered TRANSACTION_ERROR: 29201 [ 3232.457648] binder: undelivered TRANSACTION_ERROR: 29189 03:17:30 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:30 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:17:31 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x3, 0x0) 03:17:31 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) [ 3232.554125] binder: 26920:26927 unknown command 1746034700 [ 3232.586765] binder: 26920:26927 ioctl c0306201 20000140 returned -22 03:17:31 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:31 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3232.665611] binder: 26920:26927 got reply transaction with bad transaction stack, transaction 5947 has target 26920:0 03:17:31 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) [ 3232.735121] binder: 26920:26927 transaction failed 29201/-71, size 72057594037927936-0 line 2816 03:17:31 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x8, 0x0) 03:17:31 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) [ 3232.784490] binder: send failed reply for transaction 5947 to 26920:26927 [ 3232.800560] binder: 26920:26957 transaction failed 29189/-22, size 0-0 line 2896 03:17:31 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) [ 3232.901043] binder: undelivered TRANSACTION_ERROR: 29189 03:17:31 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:31 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x9, 0x0) 03:17:31 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000280)='/dev/vcs#\x00', 0x0, 0x400) getsockname$packet(0xffffffffffffff9c, &(0x7f0000001bc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001c00)=0x14) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000001c40)={r3, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r4 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock\x00', 0x101000, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r4, 0xc0205647, &(0x7f0000000240)={0xfffffff, 0x100000000, 0x1ff, [], &(0x7f0000000200)={0x990af7, 0x2, [], @p_u8=&(0x7f0000000180)=0x229}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r5 = dup2(r0, r1) ioctl$SIOCAX25CTLCON(r5, 0x89e8, &(0x7f0000000000)={@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x1, 0x7, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @bcast, @null, @null]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:31 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) [ 3232.977832] binder: undelivered TRANSACTION_COMPLETE [ 3232.983096] binder: undelivered TRANSACTION_ERROR: 29201 [ 3232.988770] binder: undelivered TRANSACTION_ERROR: 29189 03:17:31 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 3233.115268] binder: 26982:26991 ioctl 89e8 20000000 returned -22 [ 3233.145486] binder: 26982:26991 got reply transaction with bad transaction stack, transaction 5951 has target 26982:26991 03:17:31 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:31 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0xfc8, 0x0) [ 3233.169460] binder: 26982:26991 transaction failed 29201/-71, size 0-0 line 2816 03:17:31 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:31 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\\\x00'}, 0x45c) [ 3233.221704] binder: release 26982:26991 transaction 5951 in, still active [ 3233.228688] binder: send failed reply for transaction 5951 to 26982:26991 [ 3233.237068] binder_alloc: 26982: binder_alloc_buf, no vma [ 3233.250506] binder: 26982:26991 transaction failed 29189/-3, size 0-0 line 3035 03:17:31 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) [ 3233.283083] binder: 26982:27005 ioctl 89e8 20000000 returned -22 [ 3233.328415] binder: undelivered TRANSACTION_ERROR: 29189 03:17:31 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:31 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0xfe3, 0x0) 03:17:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000240)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$EXT4_IOC_GROUP_ADD(r1, 0x40286608, &(0x7f0000000000)={0x100, 0xfffffffffffffffc, 0x72eb1d56, 0x6, 0x9, 0x7}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 3233.389637] binder: undelivered TRANSACTION_COMPLETE [ 3233.395124] binder: undelivered TRANSACTION_ERROR: 29201 03:17:31 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x80\x00'}, 0x45c) 03:17:31 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) [ 3233.515241] binder: 27025:27030 ioctl 40286608 20000000 returned -22 [ 3233.540855] binder: 27025:27030 got reply transaction with bad transaction stack, transaction 5956 has target 27025:27030 03:17:32 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:32 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3233.568006] binder: 27025:27030 transaction failed 29201/-71, size 0-0 line 2816 03:17:32 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x2) [ 3233.614846] binder: release 27025:27030 transaction 5956 in, still active [ 3233.623551] binder_alloc: 27025: binder_alloc_buf, no vma [ 3233.631461] binder: send failed reply for transaction 5956 to 27025:27030 [ 3233.643721] binder: 27025:27039 ioctl 40286608 20000000 returned -22 03:17:32 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:17:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x0, 0x2) write$P9_RSTAT(r2, &(0x7f0000000200)={0x4a, 0x7d, 0x2, {0x0, 0x43, 0xe50f, 0xb, {0x10, 0x2, 0x8}, 0x88010000, 0x2, 0xffffffff, 0xffffffff, 0x0, '', 0x10, '[/bdev{&trusted\x00'}}, 0x4a) ioctl$VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f0000000040)={0x764, 0x43564548, 0x2, @discrete={0x7, 0x49}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000019000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=ANY=[], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000280)="653e400f0866ba4200b00eee410f12800800000048b8c3000000000000000f23c80f21f835000060000f23f8c4427921e766f23ef264420f01f5674e0fc76a2ab9170800000f32c4e3590207230f20d835080000000f22d8", 0x58}], 0x1, 0x40, &(0x7f0000000100)=[@vmwrite={0x8, 0x0, 0x7, 0x0, 0x3, 0x0, 0x3f, 0x0, 0xffffffffffffda11}, @vmwrite={0x8, 0x0, 0x80000000, 0x0, 0x75, 0x0, 0x401, 0x0, 0x8}], 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:32 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) [ 3233.751348] binder: undelivered TRANSACTION_COMPLETE 03:17:32 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:32 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x3) 03:17:32 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3233.831262] binder_alloc: 27056: binder_alloc_buf size 21474836480 failed, no address space [ 3233.852716] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 03:17:32 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x4) 03:17:32 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) 03:17:32 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) [ 3233.968400] binder_alloc: 27056: binder_alloc_buf, no vma 03:17:32 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:32 executing program 1: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400000, 0x0) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000100)='fou\x00') sendmsg$FOU_CMD_GET(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40005410}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x28, r1, 0x4, 0x70bd2d, 0x25dfdbff, {}, [@FOU_ATTR_AF={0x8, 0x2, 0x2}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x67}]}, 0x28}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r2, r3) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:32 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3234.114298] binder: 27089:27092 got reply transaction with bad transaction stack, transaction 5965 has target 27089:27092 [ 3234.129907] binder: release 27089:27092 transaction 5965 in, still active [ 3234.151609] binder: 27089:27094 got reply transaction with no transaction stack [ 3234.161380] binder: send failed reply for transaction 5965 to 27089:27092 03:17:32 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf4\x00'}, 0x45c) 03:17:32 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x5) [ 3234.187041] binder: release 27089:27092 transaction 5968 out, still active [ 3234.218984] binder: undelivered TRANSACTION_COMPLETE 03:17:32 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:32 executing program 1: r0 = syz_open_dev$midi(&(0x7f0000000880)='/dev/midi#\x00', 0x40000, 0x141000) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000009c0)={&(0x7f00000008c0)=""/229, 0x0, 0x1000, 0xb326}, 0x18) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r1, r2) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 3234.243364] binder: undelivered TRANSACTION_COMPLETE 03:17:32 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) [ 3234.268405] binder: release 27089:27094 transaction 5968 in, still active [ 3234.297607] binder: send failed reply for transaction 5968, target dead [ 3234.336648] binder: 27107:27114 got reply transaction with bad transaction stack, transaction 5971 has target 27107:27114 [ 3234.373857] binder: release 27107:27114 transaction 5971 in, still active [ 3234.384477] binder: send failed reply for transaction 5971 to 27107:27114 03:17:32 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:17:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x3, 0x1ff, 0x7, 0x1, 0x8, 0xff, 0x9, 0x5, 0x97a, 0x7ff, 0x7, 0x1f}) 03:17:32 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x6) [ 3234.413174] binder: release 27107:27117 transaction 5974 out, still active 03:17:32 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) [ 3234.465082] binder: undelivered TRANSACTION_COMPLETE 03:17:32 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:32 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x01\x00'}, 0x45c) [ 3234.505738] binder: send failed reply for transaction 5974, target dead [ 3234.567310] binder: 27130:27136 got reply transaction with bad transaction stack, transaction 5976 has target 27130:27136 03:17:33 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:33 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x7) [ 3234.636524] binder: 27130:27136 ioctl 5403 20000000 returned -22 03:17:33 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:33 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) 03:17:33 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3234.721501] binder: release 27130:27136 transaction 5976 in, still active [ 3234.729206] binder: send failed reply for transaction 5976 to 27130:27136 [ 3234.741993] binder_alloc: 27130: binder_alloc_buf, no vma [ 3234.760970] binder: 27130:27159 ioctl 5403 20000000 returned -22 [ 3234.854816] kauditd_printk_skb: 280 callbacks suppressed [ 3234.854854] audit: type=1800 audit(1551237453.283:52695): pid=27166 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=17955 res=0 [ 3234.859980] binder: undelivered TRANSACTION_COMPLETE 03:17:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000440)='/dev/rfkill\x00', 0x0, 0x0) ioctl$BLKRAGET(r2, 0x1263, &(0x7f0000000880)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r3 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x2256, 0x81) sendmsg$unix(r3, &(0x7f0000000180)={&(0x7f0000000280)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000800)=[{&(0x7f0000000380)="d2511880b09f0e0fb01b9c338c1092f4e84b142d5fc1cce918894c931e29da7a3a0d8f7a8d6a8b71c38646cc05a2459a86f57b8688fb9d04222d3d222dded2ff7635b837cfe81d74835ba886122b24d9765ad55577920ebd24458dc86f8b172fd26bed7f9450ec562dcf67cba6bf94a1dedb9b07606ce8e8ef352148306389995038e8d5b87c093ec20209c331c4a4", 0x8f}, {&(0x7f0000000500)="6a27789db389b0a93aa23d6308ce8e3d51f881f84975303a16225b8a3c3063480b4a590d55bc406065317ea0f53db2c2bc5f9d8ab4e788cf04846c22f5d329c384e35912ac867e66498d7d77c48bbb405d0bdd70965fd3f6ad37dc523f8a3972e705d3e8aefd730c549e74ccbbceccbc7019f804ed218cfd66d76e97d6e6994a968ab6f9cc4dfe558e02f240d1aabfc1cee1e045c1ad0b3c6488abec70b20a667ee7964d65e680e947c88548c516fe8b37a24d3881e67014146c5700f4cfcb4f7e", 0xc1}, {&(0x7f0000000600)="66d2d7a805dd5a9c810ef42840c0c7fc6281b851e3bee295f961260f00905c8ab9a6ea84f133cc07081e0cf21cf2eccf46ea8432d347f2915478e9848142b6c7c46877ad181b84f60a47609ff46827660ce7001d4203cf0b0d5de9fc34e4d841d580cf1baa44139e9d8774eb78", 0x6d}, {&(0x7f0000000100)="f24ee0744688d6f5a7dad6cc07f95de54b37f4381251122ab6a46af62d8ef8c0a9fbf9b6c12e066804abda", 0x2b}, {&(0x7f0000000680)="6b8b01dfdd5bb2f2c9a719010ec0655e992f5c270864cf5910eddfb00785700e5412ffca2aa0aeb988eff99474e3df6182ce99c31390a948b0e7d4ada70953310eea5bc0b013193f2912d467b63fa0a459489ed402fd91e646994a512a705cca2122d62030", 0x65}, {&(0x7f0000000700)="55eb8fc621e4cf2e56f87c17ed73dc92eeec906a590856a08194e57b0a04e502e8bc0f336fb58a8efae8fc7c2d3150f6d512a28f138778a4ee8ad36817c1540025c591cbada2bb502ad43c47c320332a46a8d080a235f56cfb3624312d8ee6b28ee63ae0c9d67cc934c498025037e65003a8407c6210f3d9f87614e28402bc77ec5f8ff712bfa1bf7666230d3afefc4315b6ef6e65d41da52cab4a5aa43358fe910e3793e92cfbf95db501321af47e0e7d06d77d4a1a0abf6beeec9d876d964df9052b9172c3e50e9909f988992e251bdc7dc32257f9c639732f5518295d", 0xde}], 0x6, 0x0, 0x0, 0x4000}, 0x4000810) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000200)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x272, 0x0, 0x0}) 03:17:33 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:33 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x8) [ 3234.864666] audit: type=1804 audit(1551237453.293:52696): pid=27166 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4803/file0" dev="sda1" ino=17955 res=1 03:17:33 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:33 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:33 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) [ 3234.981535] binder: 27171:27179 got reply transaction with bad transaction stack, transaction 5981 has target 27171:27179 03:17:33 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x9) [ 3235.081509] binder: 27171:27179 ioctl c0306201 20000000 returned -14 [ 3235.091636] audit: type=1800 audit(1551237453.323:52697): pid=27167 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=17919 res=0 [ 3235.110668] binder: release 27171:27179 transaction 5981 in, still active [ 3235.110684] binder: send failed reply for transaction 5981 to 27171:27179 [ 3235.111400] binder_alloc: 27171: binder_alloc_buf, no vma 03:17:33 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:33 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:33 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) [ 3235.177606] audit: type=1804 audit(1551237453.323:52698): pid=27167 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5160/file0" dev="sda1" ino=17919 res=1 [ 3235.210595] binder: 27171:27192 ioctl c0306201 20000000 returned -14 03:17:33 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:33 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0xa) [ 3235.323516] audit: type=1804 audit(1551237453.323:52699): pid=27167 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5160/file0" dev="sda1" ino=17919 res=1 03:17:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000000)=0x0) fcntl$lock(r0, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x1000, 0x5, r3}) [ 3235.372540] binder: undelivered TRANSACTION_COMPLETE 03:17:33 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:33 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:33 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf4\xff\xff\xff\x00'}, 0x45c) 03:17:33 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) [ 3235.463404] audit: type=1804 audit(1551237453.343:52700): pid=27170 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4803/file0" dev="sda1" ino=17955 res=1 [ 3235.496086] binder: 27224:27231 got reply transaction with bad transaction stack, transaction 5986 has target 27224:27231 03:17:34 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x10) [ 3235.562983] binder: 27224:27231 ioctl 540f 20000000 returned -22 [ 3235.575670] audit: type=1804 audit(1551237453.353:52701): pid=27167 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5160/file0" dev="sda1" ino=17919 res=1 [ 3235.612027] binder: release 27224:27231 transaction 5986 in, still active [ 3235.617960] audit: type=1804 audit(1551237453.353:52702): pid=27172 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5160/file0" dev="sda1" ino=17919 res=1 [ 3235.624663] binder: send failed reply for transaction 5986 to 27224:27231 [ 3235.643170] binder: 27224:27231 got reply transaction with no transaction stack 03:17:34 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3235.669677] binder: 27224:27242 ioctl 540f 20000000 returned -22 03:17:34 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3235.710202] audit: type=1804 audit(1551237453.373:52703): pid=27170 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4803/file0" dev="sda1" ino=17955 res=1 03:17:34 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf5\xff\xff\xff\x00'}, 0x45c) 03:17:34 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}, 0x45c) 03:17:34 executing program 1: r0 = socket(0x5, 0x6, 0x7) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000400)={'broute\x00'}, &(0x7f0000000040)=0x78) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_G_PARM(r3, 0xc0cc5615, &(0x7f0000000200)={0xf, @output={0x0, 0x1, {0xffffffffffffba13}, 0x7, 0x7}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\f\a\x00\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r1, r2) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 3235.781215] binder: undelivered TRANSACTION_COMPLETE 03:17:34 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x48) [ 3235.819670] audit: type=1804 audit(1551237453.373:52704): pid=27176 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4803/file0" dev="sda1" ino=17955 res=1 03:17:34 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:34 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x4c) [ 3235.942663] binder: 27258:27272 unknown command 1804 03:17:34 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\xff\x00'}, 0x45c) 03:17:34 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3235.990981] binder: 27258:27264 got reply transaction with no transaction stack 03:17:34 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) 03:17:34 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3236.036156] binder: 27258:27272 ioctl c0306201 20000140 returned -22 03:17:34 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) [ 3236.127384] binder: BINDER_SET_CONTEXT_MGR already set [ 3236.142498] binder: send failed reply for transaction 5992 to 27258:27272 [ 3236.149692] binder: 27258:27272 unknown command 1804 [ 3236.160623] binder: 27258:27272 ioctl c0306201 20000140 returned -22 03:17:34 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x68) [ 3236.189088] binder: 27258:27264 ioctl 40046207 0 returned -16 03:17:34 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:17:34 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) setsockopt$nfc_llcp_NFC_LLCP_RW(r2, 0x118, 0x0, &(0x7f0000000040)=0x1, 0x4) r3 = dup2(r0, r1) ioctl$SIOCX25SSUBSCRIP(r3, 0x89e1, &(0x7f0000000200)={'lapb0\x00', 0x6b67, 0x833}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 3236.276472] binder: undelivered TRANSACTION_COMPLETE 03:17:34 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) 03:17:34 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:34 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3236.383166] binder: 27309:27312 ioctl 89e1 20000200 returned -22 [ 3236.404166] binder: 27309:27312 got reply transaction with bad transaction stack, transaction 5996 has target 27309:27312 03:17:34 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x6c) 03:17:34 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\b\x00'}, 0x45c) [ 3236.448058] binder_transaction: 15 callbacks suppressed [ 3236.448074] binder: 27309:27312 transaction failed 29201/-71, size 0-0 line 2816 [ 3236.503073] binder: BINDER_SET_CONTEXT_MGR already set [ 3236.513030] binder: release 27309:27312 transaction 5996 in, still active [ 3236.524563] binder: send failed reply for transaction 5996 to 27309:27312 [ 3236.532839] binder: 27309:27328 transaction failed 29189/-22, size 0-0 line 2896 03:17:34 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf4\x00'}, 0x45c) [ 3236.551243] binder: 27309:27312 ioctl 40046207 0 returned -16 [ 3236.563726] binder: 27309:27334 got reply transaction with no transaction stack 03:17:35 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x74) 03:17:35 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:35 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) [ 3236.606827] binder: 27309:27333 ioctl 89e1 20000200 returned -22 [ 3236.627461] binder: 27309:27334 transaction failed 29201/-71, size 0-0 line 2801 03:17:35 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:35 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) 03:17:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xc3, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad77938cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d18020000000000"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:35 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3236.795065] binder: undelivered TRANSACTION_COMPLETE 03:17:35 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x7a) 03:17:35 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:35 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) [ 3236.917089] binder: 27365:27373 got reply transaction with bad transaction stack, transaction 6001 has target 27365:27373 03:17:35 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) 03:17:35 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:35 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x1a0) [ 3237.006829] binder: 27365:27373 transaction failed 29201/-71, size 0-0 line 2816 [ 3237.026190] binder: release 27365:27373 transaction 6001 in, still active [ 3237.034556] binder: 27365:27387 transaction failed 29189/-22, size 0-0 line 2896 03:17:35 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) [ 3237.065283] binder: send failed reply for transaction 6001 to 27365:27373 03:17:35 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:35 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3237.130159] binder_release_work: 28 callbacks suppressed [ 3237.130166] binder: undelivered TRANSACTION_ERROR: 29189 03:17:35 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x300) 03:17:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffff82, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x5, 0x200000) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000180)={0x7, 0x2, 0x5, 0x1, 0x4, 0x4, 0x6, 0x800, 0xedb6, 0x6, 0x6}, 0xb) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000640)={{{@in6=@mcast1, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000740)=0x4c1e2b8614547c18) lsetxattr$security_capability(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='security.capability\x00', &(0x7f0000000440)=@v3={0x3000000, [{0x80}, {0x101, 0x8}], r3}, 0x18, 0x3) 03:17:35 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) [ 3237.248612] binder: undelivered TRANSACTION_COMPLETE [ 3237.267659] binder: undelivered TRANSACTION_ERROR: 29201 03:17:35 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:35 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x500) 03:17:35 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) [ 3237.305713] binder: undelivered TRANSACTION_ERROR: 29189 [ 3237.324293] binder: 27424:27426 ioctl c0306201 200001c0 returned -14 [ 3237.365708] binder_alloc: 27424: binder_alloc_buf, no vma [ 3237.371642] binder: undelivered TRANSACTION_COMPLETE [ 3237.394530] binder: 27424:27426 transaction failed 29189/-3, size 0-0 line 3035 03:17:35 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:35 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3237.424276] binder: send failed reply for transaction 6006, target dead [ 3237.464420] binder_alloc: binder_alloc_mmap_handler: 27424 20001000-20004000 already mapped failed -16 03:17:35 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:17:35 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x600) 03:17:36 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) [ 3237.534100] binder_alloc: 27424: binder_alloc_buf, no vma [ 3237.539700] binder: 27424:27426 transaction failed 29189/-3, size 0-0 line 3035 [ 3237.577860] binder: BINDER_SET_CONTEXT_MGR already set [ 3237.596624] binder: 27424:27446 ioctl 40046207 0 returned -16 03:17:36 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:36 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x700) [ 3237.622654] binder: 27424:27426 ioctl c0306201 200001c0 returned -14 [ 3237.646998] binder: 27424:27437 got reply transaction with no transaction stack [ 3237.680013] binder: undelivered TRANSACTION_ERROR: 29189 [ 3237.714781] binder: 27424:27437 transaction failed 29201/-71, size 0-0 line 2801 [ 3237.720507] binder: undelivered TRANSACTION_ERROR: 29190 03:17:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x7ff, 0x400) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:36 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf4\xff\xff\xff\x00'}, 0x45c) [ 3237.771284] binder: undelivered TRANSACTION_ERROR: 29201 03:17:36 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:36 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\\\x00'}, 0x45c) 03:17:36 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x900) 03:17:36 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:36 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) 03:17:36 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3237.895729] binder: 27488:27489 got reply transaction with bad transaction stack, transaction 6011 has target 27488:27489 [ 3237.931702] binder: 27488:27489 transaction failed 29201/-71, size 0-0 line 2816 03:17:36 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0xa00) 03:17:36 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf5\xff\xff\xff\x00'}, 0x45c) [ 3237.978486] binder: send failed reply for transaction 6011 to 27488:27489 [ 3237.979202] binder_alloc: 27488: binder_alloc_buf, no vma 03:17:36 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3238.020581] binder: 27488:27489 transaction failed 29189/-3, size 0-0 line 3035 03:17:36 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) [ 3238.086308] binder: 27488:27497 got reply transaction with no transaction stack [ 3238.109230] binder: undelivered TRANSACTION_ERROR: 29189 [ 3238.115771] binder: undelivered TRANSACTION_ERROR: 29201 03:17:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x4000, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000180)={0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000240)=0x24) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000280)={r3, 0x1, 0x7, [0x3, 0x6, 0x7, 0xfffffffffffffffd, 0xcec, 0x5, 0x4]}, &(0x7f00000002c0)=0x16) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000100)) r4 = getpgrp(0x0) r5 = syz_open_procfs(r4, &(0x7f0000000200)='personality\x00') ioctl$TIOCPKT(r5, 0x5420, &(0x7f0000000040)=0x6) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:36 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x4000) 03:17:36 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:36 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\xff\x00'}, 0x45c) [ 3238.192818] binder: undelivered TRANSACTION_ERROR: 29201 03:17:36 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:17:36 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf5\xff\xff\xff\x00'}, 0x45c) [ 3238.243196] binder: undelivered TRANSACTION_ERROR: 29189 [ 3238.275952] binder: 27526:27532 got reply transaction with bad transaction stack, transaction 6017 has target 27526:27532 03:17:36 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x4800) 03:17:36 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3238.341788] binder: send failed reply for transaction 6017 to 27526:27532 [ 3238.355358] binder_alloc: 27526: binder_alloc_buf, no vma 03:17:36 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) [ 3238.394695] binder: 27526:27547 got reply transaction with no transaction stack 03:17:36 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x4c00) 03:17:36 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:36 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\xff\x0f\x00'}, 0x45c) 03:17:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x5, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000040)={0x9, 0x3, 0x52040cd0, 0xa766d67, 0xfffffffffffffffc, 0x8, 0x8000, 0x5, 0x7a12, 0x55800, 0x59c65661, 0x9}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:37 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:37 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:37 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x6800) 03:17:37 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) [ 3238.587278] binder: 27568:27572 ioctl c0306201 200001c0 returned -14 [ 3238.614603] binder: 27568:27572 ioctl c0306201 20000140 returned -14 03:17:37 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x80\x00'}, 0x45c) [ 3238.657448] binder: 27568:27572 ioctl c0306201 20000600 returned -14 [ 3238.683201] binder: BINDER_SET_CONTEXT_MGR already set 03:17:37 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) [ 3238.709874] binder: 27568:27582 ioctl c0306201 200001c0 returned -14 03:17:37 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3238.776739] binder: 27568:27572 ioctl 40046207 0 returned -16 03:17:37 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:37 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x6c00) [ 3238.819931] binder: 27568:27596 ioctl c0306201 20000140 returned -14 [ 3238.850222] binder: 27568:27599 ioctl c0306201 20000600 returned -14 03:17:37 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) splice(r1, &(0x7f0000000000), r1, &(0x7f0000000040), 0xfffffffffffffeff, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:37 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:37 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:37 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x7400) 03:17:37 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) [ 3239.020897] binder: 27620:27622 got reply transaction with bad transaction stack, transaction 6024 has target 27620:27622 03:17:37 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x7a00) [ 3239.106210] binder: BINDER_SET_CONTEXT_MGR already set 03:17:37 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:37 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3239.147505] binder: 27620:27622 ioctl 40046207 0 returned -16 [ 3239.153400] binder: 27620:27642 got reply transaction with no transaction stack [ 3239.153772] binder_thread_release: 3 callbacks suppressed [ 3239.153782] binder: release 27620:27622 transaction 6024 in, still active 03:17:37 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) [ 3239.233789] binder: send failed reply for transaction 6024 to 27620:27622 03:17:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) fcntl$getownex(r2, 0x10, &(0x7f0000000000)={0x0, 0x0}) r4 = getpid() kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r1, &(0x7f0000000040)={r2, r0, 0x1}) 03:17:37 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x100000) 03:17:37 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:37 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3239.286088] binder_release_work: 2 callbacks suppressed [ 3239.286093] binder: undelivered TRANSACTION_COMPLETE 03:17:37 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 3239.379702] binder: 27660:27661 got reply transaction with bad transaction stack, transaction 6029 has target 27660:27661 03:17:37 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x1000000) 03:17:37 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\xff\xff\xf0\x00'}, 0x45c) 03:17:37 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00'}, 0x45c) [ 3239.493403] binder: BINDER_SET_CONTEXT_MGR already set [ 3239.512590] binder: release 27660:27661 transaction 6029 in, still active [ 3239.530642] binder: 27660:27661 got reply transaction with no transaction stack 03:17:37 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:38 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) [ 3239.542570] binder: send failed reply for transaction 6029 to 27660:27661 [ 3239.576372] binder: 27660:27679 ioctl 40046207 0 returned -16 03:17:38 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x2000000) 03:17:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000200)=[@acquire={0x40046305, 0x3}, @transaction={0x40406300, {0x3, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, &(0x7f0000000000), &(0x7f0000000040)=[0x20, 0x38, 0x20]}}], 0x88, 0x0, &(0x7f0000000500)="b8e7ef70adc7e086a0c344ba3cc32ad42351d4185101dd92b059aabf854362df239ec34f1bca9138ab05aff56148c86bef1fffc942ac2b3c4997b6f07b197fae0babea69bf38100c247adf65665f3eb5a5f79c5bf09b4a07f1137c6ef5ee56e35cac370810bae957bea88b9d9d0b9600b1ad68e2db0eed9352a7c183e9f0bd7089f3e92f2a664c6c"}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c230400"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = dup2(r0, r1) sendto$unix(r2, &(0x7f0000000280)="7a91d51281991eee120a81e806cc2e67cb954714e284e480d8256e971ba43ad70db54d61c09b2fe0c67afd66211b79d0e5608293a1c4f0561f77272b77c0b1049b6f7ed8133cb277d8274be490e5ba12c3817312c3187c", 0x57, 0x4000, &(0x7f0000000400)=@abs={0x1, 0x0, 0x4e22}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:38 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) [ 3239.678623] binder: undelivered TRANSACTION_COMPLETE 03:17:38 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:38 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3239.786066] binder: 27707:27712 Acquire 1 refcount change on invalid ref 3 ret -22 03:17:38 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x3000000) [ 3239.844176] binder: 27707:27712 got transaction to invalid handle [ 3239.875774] kauditd_printk_skb: 320 callbacks suppressed 03:17:38 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf4\x00'}, 0x45c) 03:17:38 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x01\x00'}, 0x45c) 03:17:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3239.875786] audit: type=1800 audit(1551237458.303:53025): pid=27724 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=16577 res=0 [ 3239.888164] binder: 27707:27723 unknown command 271116 [ 3239.915191] audit: type=1804 audit(1551237458.343:53026): pid=27724 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7459/file0" dev="sda1" ino=16577 res=1 03:17:38 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x4000000) 03:17:38 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3240.008340] binder: 27707:27712 got reply transaction with no transaction stack [ 3240.020427] audit: type=1804 audit(1551237458.343:53027): pid=27724 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7459/file0" dev="sda1" ino=16577 res=1 [ 3240.033899] binder: 27707:27723 ioctl c0306201 20000140 returned -22 03:17:38 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) [ 3240.108775] binder: 27707:27723 Acquire 1 refcount change on invalid ref 3 ret -22 [ 3240.137668] audit: type=1804 audit(1551237458.383:53028): pid=27724 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7459/file0" dev="sda1" ino=16577 res=1 [ 3240.175162] binder: send failed reply for transaction 6035 to 27707:27723 [ 3240.188502] binder: 27707:27723 got transaction to invalid handle [ 3240.190986] audit: type=1804 audit(1551237458.383:53029): pid=27729 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7459/file0" dev="sda1" ino=16577 res=1 [ 3240.230453] binder: 27707:27754 unknown command 271116 [ 3240.251227] audit: type=1800 audit(1551237458.393:53030): pid=27732 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=16689 res=0 [ 3240.283289] binder: undelivered TRANSACTION_COMPLETE 03:17:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = accept(0xffffffffffffff9c, 0x0, &(0x7f0000000180)) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000200)=0x3, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:38 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x5000000) 03:17:38 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) 03:17:38 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:38 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 3240.297381] audit: type=1804 audit(1551237458.393:53031): pid=27732 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5183/file0" dev="sda1" ino=16689 res=1 [ 3240.308110] binder: 27707:27754 ioctl c0306201 20000140 returned -22 [ 3240.334196] audit: type=1804 audit(1551237458.393:53032): pid=27732 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5183/file0" dev="sda1" ino=16689 res=1 [ 3240.394366] binder: 27764:27767 got reply transaction with bad transaction stack, transaction 6041 has target 27764:27767 [ 3240.412426] audit: type=1804 audit(1551237458.433:53033): pid=27737 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5183/file0" dev="sda1" ino=16689 res=1 [ 3240.428911] binder: release 27764:27767 transaction 6041 in, still active 03:17:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3240.455652] binder_alloc: 27764: binder_alloc_buf, no vma [ 3240.473211] binder: send failed reply for transaction 6041 to 27764:27767 03:17:38 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) 03:17:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0c6300009eb45d292fbc16a55a2de87f8ff85d967a775cd9e3500a44b928538271ada6bbff265b51e4eba1a85fb66e848b7f38596eacba45768d9b0496010c9c94b38282a78e78d2ca12fce055dcda2a10ad565d61632719918f4700a21083d5d60d29734490907430cab7daaad43bdb48724015366c3ae5cf7d6e5b02fcc3eebb083ee8d8d64d88087f2b57e7f27f5be548e619b8eb5ff60ba8d899d71c227a8aeb7bb7b97294b99b24069fc059279aa5b21fe9c2ee5642296b6d8c05cb043444b66e858a058be127c358a48c73be162c24b22d2cbd0c65c7c8353c33a378f1d4324461fc316f5b179d76f58d0acac97dba71b8c6445db341d06221b91a2540dd41cac129d7d462e9173c16111f2cc16d3ab48943d3b39959"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:38 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) [ 3240.516466] binder: undelivered TRANSACTION_COMPLETE 03:17:39 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:17:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x6000000) [ 3240.573694] audit: type=1804 audit(1551237458.433:53034): pid=27732 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5183/file0" dev="sda1" ino=16689 res=1 03:17:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3240.661506] binder: 27784:27796 got reply transaction with bad transaction stack, transaction 6046 has target 27784:27796 03:17:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x7000000) 03:17:39 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:39 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) [ 3240.739188] binder: release 27784:27796 transaction 6046 in, still active [ 3240.741547] binder_alloc: 27784: binder_alloc_buf, no vma [ 3240.755203] binder: send failed reply for transaction 6046 to 27784:27796 03:17:39 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) 03:17:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x8000000) [ 3240.855323] binder: 27784:27796 got reply transaction with no transaction stack 03:17:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x8020011, r1, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ION_IOC_HEAP_QUERY(r2, 0xc0184908, &(0x7f0000000100)={0x34, 0x0, &(0x7f0000000040)}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="272b837eb49ac91966e9ffa4f013bd619a73ec2068d3c894932bf9bc"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 3240.951061] binder: undelivered TRANSACTION_COMPLETE 03:17:39 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:17:39 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x9000000) 03:17:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:39 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3240.998847] binder: 27835:27836 unknown command 2122525479 03:17:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3241.098406] binder: 27835:27836 ioctl c0306201 20000140 returned -22 [ 3241.128372] binder: 27835:27849 got reply transaction with no transaction stack 03:17:39 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00'}, 0x45c) [ 3241.181006] binder: send failed reply for transaction 6052 to 27835:27836 [ 3241.189834] binder: 27835:27836 got reply transaction with no transaction stack 03:17:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0xa000000) 03:17:39 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:39 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10800}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r3, 0x400, 0x70bd2a, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008000}, 0x8000) 03:17:39 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) [ 3241.333242] binder: undelivered TRANSACTION_COMPLETE 03:17:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x10000000) [ 3241.408170] binder: 27881:27882 got reply transaction with bad transaction stack, transaction 6058 has target 27881:27882 03:17:39 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:39 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) [ 3241.472438] binder_transaction: 22 callbacks suppressed [ 3241.472454] binder: 27881:27882 transaction failed 29201/-71, size 0-0 line 2816 03:17:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:40 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x40000000) 03:17:40 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 3241.546414] binder: release 27881:27882 transaction 6058 in, still active [ 3241.578530] binder: send failed reply for transaction 6058 to 27881:27882 [ 3241.585931] binder: 27881:27882 got reply transaction with no transaction stack [ 3241.617500] binder: 27881:27882 transaction failed 29201/-71, size 0-0 line 2801 03:17:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:40 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}, 0x45c) 03:17:40 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) [ 3241.679991] binder: release 27881:27903 transaction 6061 out, still active [ 3241.700876] binder: undelivered TRANSACTION_COMPLETE 03:17:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:40 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x48000000) [ 3241.744864] binder: undelivered TRANSACTION_COMPLETE [ 3241.750023] binder: send failed reply for transaction 6061, target dead 03:17:40 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:40 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) [ 3241.888063] binder: 27927:27936 transaction failed 29201/-71, size 0-0 line 2801 03:17:40 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) 03:17:40 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x4c000000) [ 3241.929896] binder: send failed reply for transaction 6064 to 27927:27931 [ 3241.939788] binder_alloc: 27927: binder_alloc_buf, no vma [ 3241.954450] binder: 27927:27936 transaction failed 29189/-3, size 0-0 line 3035 03:17:40 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3242.005904] binder: 27927:27931 transaction failed 29201/-71, size 0-0 line 2801 03:17:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="01634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:17:40 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x68000000) [ 3242.106804] binder: undelivered TRANSACTION_COMPLETE 03:17:40 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:40 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00'}, 0x45c) 03:17:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:40 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3242.208629] binder: 27970:27972 got reply transaction with bad transaction stack, transaction 6070 has target 27970:27972 03:17:40 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x6c000000) [ 3242.282223] binder: 27970:27972 transaction failed 29201/-71, size 0-0 line 2816 [ 3242.314004] binder: release 27970:27972 transaction 6070 in, still active [ 3242.322200] binder_alloc: 27970: binder_alloc_buf, no vma 03:17:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3242.330547] binder: send failed reply for transaction 6070 to 27970:27972 [ 3242.344228] binder: 27970:27987 transaction failed 29189/-3, size 0-0 line 3035 [ 3242.355511] binder_release_work: 32 callbacks suppressed [ 3242.355517] binder: undelivered TRANSACTION_ERROR: 29189 03:17:40 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) 03:17:40 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x1, 0x400a80) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x1000000, 0x10, r1, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0c630000f27f8c470ca53da5c3dbf0cc254b52a338e602908a24c2d03c249bdd3247c53f787f2301fe92db04161c0ff9b95ff8f91942b2f9516c3f925ad6ea01e678f802868d341879fd1d1b7227da6ceaa15c14077a2bd404d7b4a460f07089228e0e7a45bdec58d7c10318b779bc2d0d4689ca3247875551b367123084e4635714e8eb1fe4d6e33df3a06d8845b37ce552de7f5035c46967d772b8fbf37cd7014aefd3539b37e801cb945b424dac"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:40 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3242.414638] binder: undelivered TRANSACTION_COMPLETE [ 3242.419916] binder: undelivered TRANSACTION_ERROR: 29201 03:17:40 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x74000000) [ 3242.480813] binder: undelivered TRANSACTION_ERROR: 29189 03:17:41 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3242.526982] binder: 28002:28004 got reply transaction with bad transaction stack, transaction 6075 has target 28002:28004 [ 3242.593526] binder: 28002:28004 transaction failed 29201/-71, size 0-0 line 2816 03:17:41 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:17:41 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x7a000000) 03:17:41 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf4\x00'}, 0x45c) [ 3242.636795] binder: release 28002:28004 transaction 6075 in, still active [ 3242.661587] binder: send failed reply for transaction 6075 to 28002:28004 03:17:41 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) 03:17:41 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3242.689391] binder: release 28002:28020 transaction 6078 out, still active 03:17:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$TCXONC(r2, 0x540a, 0x3ff) [ 3242.760356] binder: undelivered TRANSACTION_ERROR: 29201 [ 3242.765882] binder: undelivered TRANSACTION_ERROR: 29189 [ 3242.787630] binder: release 28002:28004 transaction 6078 in, still active 03:17:41 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0xa0010000) 03:17:41 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\\\x00'}, 0x45c) [ 3242.813556] binder: send failed reply for transaction 6078, target dead 03:17:41 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) 03:17:41 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:41 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) [ 3242.872117] binder: 28043:28045 got reply transaction with bad transaction stack, transaction 6080 has target 28043:28045 03:17:41 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3242.954498] binder: 28043:28045 transaction failed 29201/-71, size 0-0 line 2816 [ 3242.988141] binder: 28043:28062 ioctl 540a 3ff returned -22 03:17:41 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x1a0ffffffff) 03:17:41 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) [ 3243.021782] binder_alloc: 28043: binder_alloc_buf, no vma [ 3243.055290] binder: 28043:28062 transaction failed 29189/-3, size 0-0 line 3035 03:17:41 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:41 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00'}, 0x45c) 03:17:41 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3243.081214] binder_transaction: 2 callbacks suppressed [ 3243.081222] binder: 28043:28045 got reply transaction with no transaction stack [ 3243.090732] binder: 28043:28062 ioctl 540a 3ff returned -22 [ 3243.109783] binder: undelivered TRANSACTION_ERROR: 29201 [ 3243.115526] binder: undelivered TRANSACTION_ERROR: 29189 03:17:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="01634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002adce199af990022f42c23d5acaf9d1b3cf5d104647f10cdd9603671855717b947c2844049b597980e3518227cc2fe4f837886182f8c9c70e73ac6c7a99ff3ba4f8523b7ad019df45dd9bbe236cc5b025aee0f628b6c54c7119e8b294cab9ce0338098a4b58676b83b1cf44ca68fbb0ddc4b3ddc01127e84246d1ea2f2ed55cf445f332fa99e650714f0bd467b2854363aa66c6ad46092fca4dd9f1279587038856bab907e20fc4254f0e8a14f6e9b399cbddcf3bb4cff7d95f68dde17ec46b91600121dd82bfc7cd9650992357d399b695e8b5053a3d63ee70c59fa47aac82450600291703ef2c3e7fc9a"], 0x0, 0x0, 0x0}) [ 3243.137485] binder: undelivered TRANSACTION_ERROR: 29201 [ 3243.143083] binder: undelivered TRANSACTION_ERROR: 29189 03:17:41 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x10000000000000) [ 3243.207880] binder: 28083:28091 got reply transaction with bad transaction stack, transaction 6086 has target 28083:28091 03:17:41 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:41 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) 03:17:41 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:41 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) [ 3243.288575] binder_alloc: 28083: binder_alloc_buf, no vma [ 3243.310834] binder: undelivered TRANSACTION_ERROR: 29189 03:17:41 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x100000000000000) 03:17:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vcs\x00', 0x8000, 0x0) ioctl$KVM_S390_UCAS_UNMAP(r2, 0x4018ae51, &(0x7f0000000300)={0x2, 0x3f, 0x6}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xfffffe4d, 0x0, &(0x7f0000000180)=ANY=[@ANYRESDEC=r1], 0xffffffffffffff37, 0x0, 0x0}) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000400)={0x0, 0x0}, &(0x7f0000000440)=0xc) r4 = getgid() syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) lchown(&(0x7f0000000340)='./file0\x00', r3, r4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r5 = dup2(r0, r1) sched_yield() ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="016340400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) getdents(r5, &(0x7f0000000200)=""/208, 0xd0) ioctl$RTC_VL_READ(r5, 0x80047013, &(0x7f0000000100)) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x301000, 0x0) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000500)=0x5, 0x4) 03:17:41 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:41 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:17:41 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:17:41 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) [ 3243.484231] binder: 28116:28124 unknown command 808464432 [ 3243.489822] binder: 28116:28124 ioctl c0306201 20000000 returned -22 03:17:42 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x200000000000000) 03:17:42 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00'}, 0x45c) 03:17:42 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3243.672845] binder: 28116:28124 got reply transaction with no transaction stack [ 3243.691366] binder: 28116:28124 ioctl 80047013 20000100 returned -22 03:17:42 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x300000000000000) [ 3243.724904] binder: 28116:28137 unknown command 808464432 [ 3243.749670] binder: 28116:28137 ioctl c0306201 20000000 returned -22 03:17:42 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) 03:17:42 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:42 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00'}, 0x45c) [ 3243.788640] binder: 28116:28155 got reply transaction with no transaction stack [ 3243.805156] binder: 28116:28137 ioctl 80047013 20000100 returned -22 03:17:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x9, 0xe09406f6118518a6) 03:17:42 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:42 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x400000000000000) 03:17:42 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:42 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:42 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3244.000627] binder: 28175:28176 got reply transaction with bad transaction stack, transaction 6095 has target 28175:28176 03:17:42 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:42 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x500000000000000) 03:17:42 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:42 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3244.112109] binder_alloc: 28175: binder_alloc_buf, no vma [ 3244.134239] binder: 28175:28196 got reply transaction with no transaction stack 03:17:42 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:42 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x600000000000000) 03:17:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x800, 0x0) ioctl$KVM_SET_XSAVE(r2, 0x5000aea5, &(0x7f0000000640)={"50a3ec9f51a0f5f0133fec770fddf80b3591a0a03112b63c07cb49f0bf53d1ba3385a77e660ef81dfc1586ae602e5951e0faba1d4147fcd15eede8b4162b866ff9a099bb887ce286d578ec9c885246786a568bfba8d15796d162157276043e4c6ae9c2357ff391ba8808df18af85bce28a84aca5fcf9706779a596c9410d13fde2ab3b81379cef675ca33ac75884b8f23867cd82b0ed60342a67e91da53076739e96b747cd76f96cf4318ff1c6c9dd2ac3d3bef166ce4facea496743f087fd7c5cd4d18d29cd0afcf89ab6951efdec2065caa256235ffbe13733a068ac7e2b508547c1ce9a4ea1c793c896d5104bca3a54c59e815f8fe16ed907594cbeee97b1891762e13302fe0ea9082d9c341055fd4db2faa183330a6269e482de869c9db280355fef5570a7214237575c9dbc810837320ffe167b0ddec24c14ee760c1e1eaed7bf342872a4e6b25575fe68cbf705ee7a4e47c223c0dd1318591ff52d80c4284e42228890a2e83855b793e39d3b1f16493e57d42cb621d58ad88f50045f62acc025a433331ec29151c90602b1891ea11055a17677b85153e60db4e3d47336182a7d695d0d2259eb118d9ab81a5c7829791b622ebfdab1eb094fa36fb5907adacd156c11ed5da525f252e14e15d05b96357a3dabeaf8754315c26d33b47cfd6e1f7b860da95cb56a75231e81fd02da840dfc40fb2889c84a81ca6c1960b7c434b8cb676b8c82d9e1c4b3d9bb48d0a922259ee6c53df02d08df2cab3bc159041ba2db180005082f1f68d77d7e97c652cbcef10f76d70b3fe6377745fbb60e775152bcc3a0592bedf8e835b80dc52ec61e27c2d155c15d10acde89da162ffe48a9da1a9fe8b713d41d008f69fced38b556c8ef74343fcca9b4824677e7b4576fa4bec8a565cc4ab2375b3939bdaa56405c67dd67eb2f057cb07906df31892183bf3bcbdd1d59fd8dca3f8295062a4cdd8ca325263bb5a3f4bc0084049ff666c762ebaf9b55c07a63b9cb21ff292b981bff877312668254d74abcbb94ef6113b206d2b6b1d99a5255187ddd1bf2eca6b5653ba22b736ede861c5393c84ef771a0713b54cab7f5947df9d9729036f78a7a97f3a93235bb386d234808a461b9c52d7ef3b2c8b3d039e9c7be754ba928e1becebef8ff77fce73f63c0d184fbaae74b998c9d8b5d179f9f077d0c8790c6f0623defd31c5382c805f55134f3a7a576b7de8108f6d453d00618d97abeeb6c2c4bfba37c9dd2f31a7db89fde16059aa0b9eab6b844e4db600fe10bdfe43368bd8ea2b4bcdf2072ab0dff4c4aaf45dcc805181c9c06d99016b8d125786fab288f0ffe0d838e00dd3611a5245f78c286ee742bcfc6aeb7dd9edc49749467a2db157d11a04283c80ce24fee925a7203888d45db242ca6468445e52814c2be457980b4c25c732d2992eca63b2531c0ef6522bf"}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:42 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:42 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:42 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3244.329567] binder_release_work: 4 callbacks suppressed [ 3244.329572] binder: undelivered TRANSACTION_COMPLETE [ 3244.390778] binder: 28221:28222 got reply transaction with bad transaction stack, transaction 6101 has target 28221:28222 03:17:42 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x700000000000000) 03:17:42 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3244.454488] binder_thread_release: 3 callbacks suppressed [ 3244.454498] binder: release 28221:28222 transaction 6101 in, still active [ 3244.455018] binder_alloc: 28221: binder_alloc_buf, no vma [ 3244.460109] binder_send_failed_reply: 3 callbacks suppressed [ 3244.460116] binder: send failed reply for transaction 6101 to 28221:28222 03:17:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) setsockopt$inet6_MRT6_DEL_MFC(r0, 0x29, 0xcd, &(0x7f0000000000)={{0xa, 0x4e21, 0x7, @dev={0xfe, 0x80, [], 0xc}, 0x861}, {0xa, 0x4e24, 0x6, @mcast1, 0x1}, 0xf52, [0x10001, 0x1, 0x7, 0x2, 0x7, 0x29, 0x0, 0x5]}, 0x5c) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:42 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:43 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3244.577042] binder: undelivered TRANSACTION_COMPLETE 03:17:43 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:43 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x800000000000000) [ 3244.650714] binder: 28248:28249 got reply transaction with bad transaction stack, transaction 6106 has target 28248:28249 [ 3244.688328] binder: release 28248:28249 transaction 6106 in, still active [ 3244.692832] binder_alloc: 28248: binder_alloc_buf, no vma 03:17:43 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:43 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:43 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3244.711567] binder: send failed reply for transaction 6106 to 28248:28249 [ 3244.745279] binder: 28248:28267 got reply transaction with no transaction stack 03:17:43 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x900000000000000) 03:17:43 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:43 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = fcntl$dupfd(r0, 0x406, r1) ioctl$ION_IOC_HEAP_QUERY(r2, 0xc0184908, &(0x7f0000000100)={0x34, 0x0, &(0x7f0000000040)}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f0000000180)=r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 3244.882544] binder: undelivered TRANSACTION_COMPLETE [ 3244.889580] kauditd_printk_skb: 316 callbacks suppressed [ 3244.889593] audit: type=1804 audit(1551237463.313:53351): pid=28277 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5205/file0" dev="sda1" ino=17505 res=1 [ 3244.900864] audit: type=1804 audit(1551237463.323:53352): pid=28277 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5205/file0" dev="sda1" ino=17505 res=1 03:17:43 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:43 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:43 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:43 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0xa00000000000000) [ 3244.996522] binder: 28284:28290 ioctl c0184908 20000100 returned -22 [ 3245.031461] binder: 28284:28290 got reply transaction with bad transaction stack, transaction 6112 has target 28284:28290 [ 3245.086208] audit: type=1800 audit(1551237463.373:53353): pid=28282 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=17553 res=0 03:17:43 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9a\f\x00'}, 0x45c) [ 3245.129473] binder: release 28284:28290 transaction 6112 in, still active [ 3245.145181] binder: 28284:28304 ioctl c0184908 20000100 returned -22 [ 3245.153903] audit: type=1804 audit(1551237463.383:53354): pid=28280 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7480/file0" dev="sda1" ino=17553 res=1 [ 3245.166604] binder: send failed reply for transaction 6112 to 28284:28290 03:17:43 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:43 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:43 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x1000000000000000) [ 3245.224054] binder_alloc: 28284: binder_alloc_buf, no vma 03:17:43 executing program 1: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x80) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000040)={0x5}, 0x4) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r1, r2) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:43 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) [ 3245.322905] audit: type=1804 audit(1551237463.383:53355): pid=28280 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7480/file0" dev="sda1" ino=17553 res=1 [ 3245.326101] binder: undelivered TRANSACTION_COMPLETE 03:17:43 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:43 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:43 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x4000000000000000) 03:17:43 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) [ 3245.439070] audit: type=1804 audit(1551237463.403:53356): pid=28288 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5205/file0" dev="sda1" ino=17505 res=1 [ 3245.527827] binder: 28331:28335 got reply transaction with bad transaction stack, transaction 6117 has target 28331:28335 03:17:44 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3245.593251] audit: type=1804 audit(1551237463.403:53357): pid=28289 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5205/file0" dev="sda1" ino=17505 res=1 [ 3245.623284] binder: release 28331:28335 transaction 6117 in, still active [ 3245.636478] binder_alloc: 28331: binder_alloc_buf, no vma 03:17:44 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:44 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:44 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x4800000000000000) [ 3245.642499] binder: send failed reply for transaction 6117 to 28331:28335 [ 3245.742461] audit: type=1804 audit(1551237463.423:53358): pid=28280 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7480/file0" dev="sda1" ino=17553 res=1 03:17:44 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0c6700008487525e90eb7c1cfa4aba3cda45a85012bf19aa27cb181c5ac9eaacb88c18d64b01f55f2ff4f34766fc3fef8e3a9086261fb6e5bdbb38ea3c43af630509e0b4db8a84ca1cae8e424972d287c928f34304f55f4ba848a60edee170edbcbfc53d746aab1a1b0a19b8cde41b2e18aa0af806015ef9dca61e95a6db8b8b8175b774885acea4494e2c4af39ef6a7ad61848e4864d9c29361201d73c32117c43b8cfae1437ff1d14d8daa01a5cd8c8f461a9e6cad49975c902e"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$UI_END_FF_UPLOAD(r2, 0x406855c9, &(0x7f0000000400)={0x10, 0x1, {0x53, 0x7f, 0x7, {0xd86b, 0x20}, {0xed6, 0x100}, @period={0x5b, 0x401, 0x200, 0x0, 0x0, {0xd68, 0x100000000, 0xc16, 0xa}, 0x9, &(0x7f0000000000)=[0x1, 0x6, 0x8, 0x3, 0x1, 0xe1f4, 0x2, 0x1, 0x100000001]}}, {0x54, 0x3ff, 0x4, {0xb18f, 0x4b}, {0x9, 0x3f}, @period={0x59, 0x7fff, 0x3, 0x4, 0x7, {0x3, 0x4, 0x7, 0x4a}, 0x2, &(0x7f0000000040)=[0x401, 0x5]}}}) [ 3245.793784] binder: undelivered TRANSACTION_COMPLETE 03:17:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x4c00000000000000) [ 3245.820037] audit: type=1804 audit(1551237463.423:53359): pid=28282 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7480/file0" dev="sda1" ino=17553 res=1 03:17:44 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:44 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:44 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) 03:17:44 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3245.913915] audit: type=1800 audit(1551237463.423:53360): pid=28293 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=17745 res=0 [ 3245.949583] binder: 28380:28383 unknown command 26380 [ 3245.975757] binder: 28380:28383 ioctl c0306201 20000140 returned -22 03:17:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x6800000000000000) [ 3246.036596] binder: 28380:28383 got reply transaction with bad transaction stack, transaction 6122 has target 28380:0 03:17:44 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:44 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:44 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) [ 3246.124506] binder: 28380:28383 ioctl 406855c9 20000400 returned -22 [ 3246.141403] binder: send failed reply for transaction 6122 to 28380:28383 03:17:44 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) 03:17:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x6c00000000000000) [ 3246.184000] binder: 28380:28396 got reply transaction with no transaction stack [ 3246.201643] binder: 28380:28409 ioctl 406855c9 20000400 returned -22 [ 3246.212613] binder: 28380:28383 unknown command 26380 [ 3246.247656] binder: 28380:28383 ioctl c0306201 20000140 returned -22 [ 3246.321113] binder: release 28380:28409 transaction 6125 out, still active [ 3246.328333] binder: undelivered TRANSACTION_COMPLETE 03:17:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:44 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:44 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:44 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:44 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) 03:17:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x7400000000000000) [ 3246.375013] binder: undelivered TRANSACTION_COMPLETE [ 3246.380275] binder: send failed reply for transaction 6125, target dead 03:17:44 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:44 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3246.484245] binder_transaction: 19 callbacks suppressed [ 3246.484260] binder: 28437:28444 transaction failed 29201/-71, size 0-0 line 2816 03:17:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x7a00000000000000) [ 3246.547219] binder: release 28437:28444 transaction 6128 in, still active [ 3246.555025] binder_alloc: 28437: binder_alloc_buf, no vma [ 3246.565866] binder: send failed reply for transaction 6128 to 28437:28444 03:17:45 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) 03:17:45 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) [ 3246.603328] binder: 28437:28458 got reply transaction with no transaction stack [ 3246.603348] binder: 28437:28444 transaction failed 29189/-3, size 0-0 line 3035 [ 3246.640876] binder: 28437:28458 transaction failed 29201/-71, size 0-0 line 2801 03:17:45 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0xffffffffa0010000) 03:17:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) fcntl$addseals(r1, 0x409, 0xc) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:45 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3246.765464] binder: undelivered TRANSACTION_COMPLETE 03:17:45 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\\\x04\x00'}, 0x45c) 03:17:45 executing program 4: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000240)='/proc/capi/capi20ncci\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000280)='tls\x00', 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='environ\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3246.846065] binder: 28474:28482 transaction failed 29201/-71, size 0-0 line 2816 03:17:45 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:45 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 3246.901884] binder: BINDER_SET_CONTEXT_MGR already set [ 3246.907757] binder: release 28474:28482 transaction 6134 in, still active [ 3246.917258] binder: 28474:28489 transaction failed 29189/-22, size 0-0 line 2896 [ 3246.924988] binder: send failed reply for transaction 6134 to 28474:28482 03:17:45 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3246.959421] binder: 28474:28482 ioctl 40046207 0 returned -16 [ 3247.007924] binder: 28474:28501 got reply transaction with no transaction stack [ 3247.030679] binder: 28474:28501 transaction failed 29201/-71, size 0-0 line 2801 03:17:45 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) socket$inet_udplite(0x2, 0x2, 0x88) 03:17:45 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000180)={0x0, 0x5, 0x5, [0x27, 0x1, 0xffffffffffffffe1, 0x5, 0x6]}, &(0x7f00000001c0)=0x12) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f00000002c0)={r2, 0x4000800001, 0xffffffffffffffff, 0x3, 0x2}, &(0x7f0000000240)=0xffffffffffffffd5) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r3, 0x84, 0x16, &(0x7f0000000040)={0x7, [0x401, 0x12, 0xc6, 0x10001, 0x0, 0x19, 0x10000]}, 0x12) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000280)) preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:45 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3247.072806] binder: undelivered TRANSACTION_COMPLETE 03:17:45 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:45 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3247.216289] binder_transaction: 2 callbacks suppressed [ 3247.216302] binder: 28513:28514 got reply transaction with bad transaction stack, transaction 6139 has target 28513:28514 [ 3247.245320] binder: 28513:28514 transaction failed 29201/-71, size 0-0 line 2816 03:17:45 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:45 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3247.259948] binder: release 28513:28514 transaction 6139 in, still active [ 3247.267390] binder_alloc: 28513: binder_alloc_buf, no vma [ 3247.281583] binder: send failed reply for transaction 6139 to 28513:28514 [ 3247.296972] binder: 28513:28530 transaction failed 29189/-3, size 0-0 line 3035 03:17:45 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000040)=0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:45 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:45 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='mounts\x00') getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000040)={0x0, 0x1f, 0x9, 0x7, 0x3}, &(0x7f0000000100)=0x14) setsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000180)=@assoc_value={r3, 0xc000000000000000}, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r4 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) getpeername$packet(r4, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001640)=0x14) ioctl$sock_inet6_SIOCDELRT(r4, 0x890c, &(0x7f0000001680)={@mcast2, @dev={0xfe, 0x80, [], 0x23}, @ipv4={[], [], @multicast2}, 0x8, 0x5, 0x6, 0x400, 0x200, 0x40, r5}) [ 3247.443127] binder: undelivered TRANSACTION_COMPLETE [ 3247.448345] binder_release_work: 33 callbacks suppressed [ 3247.448351] binder: undelivered TRANSACTION_ERROR: 29201 03:17:45 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:45 executing program 4: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000340)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$binfmt_aout(r0, &(0x7f0000000380)={{0x107, 0x3, 0x1, 0x1eb, 0x10000057, 0xf15b, 0xa0, 0x1003}, "b3a0910e35d431d6d7fc1acb570d1603fe4f02cb369047ee42a9ae3b85467e6b7a"}, 0x2b) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r2, &(0x7f0000000300)={0xa}) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') setsockopt$netrom_NETROM_T4(r3, 0x103, 0x6, &(0x7f0000000040)=0x3, 0x4) preadv(r4, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3247.498177] binder: undelivered TRANSACTION_ERROR: 29189 03:17:46 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3247.549763] binder: 28551:28556 got reply transaction with bad transaction stack, transaction 6144 has target 28551:28556 03:17:46 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3247.623240] binder: 28551:28556 transaction failed 29201/-71, size 0-0 line 2816 [ 3247.635888] binder: 28551:28569 ioctl 890c 20001680 returned -22 03:17:46 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:46 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:46 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') fsetxattr(r0, &(0x7f0000000040)=@random={'user.', 'net/protocols\x00'}, &(0x7f0000000180)='net/protocols\x00', 0xe, 0x2) preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3247.665212] binder: release 28551:28556 transaction 6144 in, still active [ 3247.680397] binder: send failed reply for transaction 6144 to 28551:28556 [ 3247.694571] binder: 28551:28569 got reply transaction with no transaction stack 03:17:46 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) [ 3247.750147] binder: 28551:28582 ioctl 890c 20001680 returned -22 [ 3247.759299] binder: 28551:28569 transaction failed 29201/-71, size 0-0 line 2801 03:17:46 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3247.801231] binder: release 28551:28572 transaction 6147 out, still active [ 3247.810886] binder: undelivered TRANSACTION_ERROR: 29201 03:17:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000514b78b9c2b3d021b68f787135b232ccf9bc9b93fa3f6488d2c667c8c178113589d9c01c0f2722d77b4a8d1682ac3973f00b9414946ae68386c800c7c88e3cbdce8a065bbe0036e0d4a3da8b206fc8e500c743e38979e19a362f903d63ff0361"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:46 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f00000001c0)={0xf, 0x8, 0xfa00, {r3, 0x7}}, 0x10) ioctl$VIDIOC_S_DV_TIMINGS(r2, 0xc0845657, &(0x7f0000000200)={0x0, @reserved}) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r4, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:46 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) [ 3247.871954] binder: undelivered TRANSACTION_ERROR: 29201 [ 3247.877463] binder: undelivered TRANSACTION_ERROR: 29189 03:17:46 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) [ 3247.912624] binder: send failed reply for transaction 6147, target dead 03:17:46 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) [ 3248.005369] binder: 28596:28608 got reply transaction with bad transaction stack, transaction 6150 has target 28596:28608 03:17:46 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:46 executing program 4: socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = semget$private(0x0, 0x1, 0x0) semtimedop(r2, &(0x7f0000000040)=[{0x4, 0x7fffffff, 0x1000}, {0x2, 0x6, 0x1800}, {0x3, 0x5, 0x1800}, {0x2, 0x7, 0x800}, {0x0, 0x20, 0x1000}, {0x5, 0x3f, 0x800}], 0x6, &(0x7f0000000180)) r3 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') splice(r1, &(0x7f0000000080), r4, &(0x7f0000000240)=0x57, 0x4, 0x4) preadv(r4, &(0x7f0000000200)=[{&(0x7f00000001c0)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:46 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3248.080970] binder: send failed reply for transaction 6150 to 28596:28608 [ 3248.088052] binder_alloc: 28596: binder_alloc_buf, no vma [ 3248.119101] binder: undelivered TRANSACTION_ERROR: 29189 03:17:46 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9a\f\x00'}, 0x45c) 03:17:46 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x10) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r3 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x1, 0x2) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e24, 0xd4, @mcast1, 0x4}}, [0x7ff, 0x4f, 0x8, 0x40000000, 0x1, 0x5, 0x1000, 0x401, 0x2, 0xffffffff, 0x8, 0x2, 0x900000000000, 0x7, 0x2f]}, &(0x7f0000000040)=0x100) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000100)={r4, 0x0, 0xffffffffffffff45}, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080), 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 3248.211983] binder: undelivered TRANSACTION_ERROR: 29201 [ 3248.217503] binder: undelivered TRANSACTION_ERROR: 29189 03:17:46 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:46 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x406, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') ioctl$UI_END_FF_ERASE(r3, 0x400c55cb, &(0x7f0000000040)={0x3, 0x0, 0x2c2}) preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) write$binfmt_elf64(r2, &(0x7f0000000580)={{0x7f, 0x45, 0x4c, 0x46, 0x2, 0x7fffffff, 0x0, 0x70, 0xffffffff, 0x3, 0x3e, 0x6, 0x234, 0x40, 0x1c1, 0x5, 0x6e3c, 0x38, 0x2, 0x7, 0x17, 0x2}, [{0x70000001, 0x20, 0x3, 0x400, 0x9, 0x7fffffff, 0x2, 0x1}, {0x7, 0x2e, 0x0, 0x6, 0x8, 0x2, 0xffffffffffff8000, 0x4}], "f772c90acb9fc73e58d63445608745900d7359ed3480a4c634870f6a38d3e554058e4aa9863b37ecf477ff2b", [[], [], [], [], [], [], [], []]}, 0x8dc) 03:17:46 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:46 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:46 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) 03:17:46 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3248.375112] binder: 28632:28646 got reply transaction with no transaction stack [ 3248.397277] binder: BINDER_SET_CONTEXT_MGR already set [ 3248.440458] binder: 28632:28641 ioctl 40046207 0 returned -16 [ 3248.473736] binder: 28632:28658 got reply transaction with no transaction stack 03:17:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 3248.511052] binder: undelivered TRANSACTION_ERROR: 29201 [ 3248.516830] binder: undelivered TRANSACTION_ERROR: 29189 03:17:47 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$RTC_UIE_OFF(r1, 0x7004) utimensat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f0000000180)={{0x77359400}, {0x77359400}}, 0x100) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:47 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:47 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\\\x00'}, 0x45c) 03:17:47 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3248.609737] binder: 28669:28672 got reply transaction with bad transaction stack, transaction 6160 has target 28669:28672 [ 3248.635344] binder_alloc: 28669: binder_alloc_buf, no vma 03:17:47 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3248.679619] binder: 28669:28672 got reply transaction with no transaction stack 03:17:47 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f0000000040)=0xc000000000000) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:47 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}, 0x45c) 03:17:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x2200, 0x0) r3 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000200)="66b8000000000f23d00f21f866352000000b0f23f80f00dcbad104ec66b8001000000f23c00f21f86635010009000f23f866b9800000c00f326635000400000f30baf80c66b8947fc78066efbafc0ced0f01350fc7a8b0e3f2d2a24777b87e008ee8", 0x62}], 0x1, 0x15, &(0x7f0000000180)=[@dstype3={0x7, 0x4}, @flags={0x3, 0x140000}], 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:47 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:47 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x80\x00'}, 0x45c) 03:17:47 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) [ 3248.897071] binder: 28697:28700 got reply transaction with bad transaction stack, transaction 6166 has target 28697:28700 03:17:47 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000180)={0x8, {{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x2b}}}}, 0x88) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3248.971207] binder_alloc: 28697: binder_alloc_buf, no vma 03:17:47 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:47 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) 03:17:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0xfffffffffffffc42, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="01634040000000000000000000000000000000000000000000000000000000000000000000000000df5f0000000000000000000000000000000000000000001a00000000"], 0x0, 0x0, 0x0}) 03:17:47 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:47 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:47 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:17:47 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fe<\xcbZ\xb7\xff\xa2\xa3\xfb3\tE\x00') getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000180)=0x4) preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3249.193976] binder: 28722:28736 got reply transaction with no transaction stack 03:17:47 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) [ 3249.248467] binder: 28722:28730 got reply transaction with no transaction stack 03:17:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b65d843c93bbb71703c7923f4491ff0000000000000000"], 0x0, 0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000100)=0x0) ptrace$getregs(0xe, r2, 0x5ae11d88, &(0x7f0000000200)=""/181) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="8f7cf2420ad109383a7511402c514be894978352bc2327d4ef4caff79e9c7a088d9dc1c3b63cc09b7a7ddf79cc371f8073bfa815187f142e58139d5833c33f42462dba536da0fad843f9437ae75e0ea67afbb61464e6d1b8e1e07909ba075891c87f045f323c226641fe0773afe22bb965ac76"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:47 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:47 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r1, 0x4010ae74, &(0x7f0000000240)={0x1, 0x1, 0x9}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001fe) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x40, 0x0) [ 3249.357148] binder: 28753:28758 unknown command 1123187855 [ 3249.363895] binder: 28753:28758 ioctl c0306201 20000140 returned -22 03:17:47 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:47 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:47 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) [ 3249.409944] binder: 28753:28758 got reply transaction with bad transaction stack, transaction 6175 has target 28753:0 [ 3249.505820] binder_send_failed_reply: 3 callbacks suppressed [ 3249.505829] binder: send failed reply for transaction 6175 to 28753:28758 [ 3249.519902] binder: 28753:28761 unknown command 1123187855 03:17:48 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:48 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_inet_SIOCRTMSG(r1, 0x890d, &(0x7f0000000180)={0x0, {0x2, 0x4e20, @local}, {0x2, 0x4e20, @empty}, {0x2, 0x4e23, @loopback}, 0x4, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x7f, 0x200, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3249.552857] binder: 28753:28761 ioctl c0306201 20000140 returned -22 [ 3249.566036] binder_thread_release: 3 callbacks suppressed [ 3249.566045] binder: release 28753:28775 transaction 6178 out, still active [ 3249.584750] binder_release_work: 6 callbacks suppressed [ 3249.584755] binder: undelivered TRANSACTION_COMPLETE 03:17:48 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:17:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0xffffff40, 0x0, &(0x7f0000000300)=[@clear_death={0x400c630f, 0x4, 0x4}], 0xfffffffffffffe84, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:48 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) [ 3249.667889] binder: undelivered TRANSACTION_COMPLETE [ 3249.673180] binder: send failed reply for transaction 6178, target dead 03:17:48 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:48 executing program 4: socketpair$unix(0x1, 0x8000000008106025, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') ioctl$EXT4_IOC_GROUP_EXTEND(r2, 0x40086607, &(0x7f0000000280)=0x7ff) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000040)={0x2, 0x100000000, 0x8, 0x7381b5b0, 0x2, 0x8000, 0x6, 0x10001, 0x0}, &(0x7f00000001c0)=0x20) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000200)={r3, 0x7, 0x30, 0x1, 0xb4}, &(0x7f0000000240)=0x18) preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0xffffffffffffff93}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:48 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:48 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000180)=0xc) r3 = syz_open_procfs(r2, &(0x7f0000000200)='\b\x00\x00\x00\x00\x00\x00\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3249.832845] binder: 28797:28802 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4 [ 3249.854298] binder: 28797:28802 unknown command 0 [ 3249.874777] binder: 28797:28802 ioctl c0306201 200001c0 returned -22 03:17:48 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:48 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x01\x00'}, 0x45c) [ 3249.915726] kauditd_printk_skb: 300 callbacks suppressed [ 3249.915739] audit: type=1804 audit(1551237468.343:53661): pid=28814 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4867/file0" dev="sda1" ino=17990 res=1 [ 3249.945383] binder: 28797:28815 got reply transaction with no transaction stack 03:17:48 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3249.972499] binder: 28797:28815 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4 [ 3250.001915] binder: 28797:28815 unknown command 0 [ 3250.016174] binder: 28797:28815 ioctl c0306201 200001c0 returned -22 [ 3250.034987] audit: type=1804 audit(1551237468.413:53662): pid=28804 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4867/file0" dev="sda1" ino=17990 res=1 03:17:48 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:48 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x42000, 0x0) ioctl$KVM_ARM_SET_DEVICE_ADDR(r1, 0x4010aeab, &(0x7f0000000200)={0x6bb, 0x1000}) sendto$llc(r1, &(0x7f0000000240)="47c8381b383111c24efa3f3b75d3332185e475c81fdf91fa944c22498953a85ce96aeaf4a7236e7fecd8f5f7011b50a65d20f14e50767fa194ed46b7ce178aafdbca1c978d5e57712096037be213ce761ec58b8d899325bd89819331bdaf093fe40ca42df57ff0c08637dd7cf8ce08ddba9317ac8ed395b2c18d29d8c98f8fa14d718855223b23fc1554cadf4be953e25b3b417a7f0830721e0ff259fdade92b6a56936746a081d42d31e80c6ecea825304d35", 0xb3, 0x41, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') ioctl$KVM_SET_XCRS(r2, 0x4188aea7, &(0x7f0000000300)=ANY=[@ANYBLOB="04000000080000000900000000000000c40600000000000002000000000000008000000000e4ff00770a00000000000003000000000000001f000000040000003f00000000000000e21639596f4a8b2d893d666a47e8ad9f745d12e57384286f07c189cc35ee14d793cef69fd7df26357081afe7c8cf6a4eb62a52355eb1b62d66b3752fd9a522cb599819240da664b70a4172277b822bccf47dd914a2ae4b063eaba792d51cb628c591eb4e52303c3bfdc3f1340f7702a35427188cec8335a3b4c4974d282064b30f80d3f23bf0521affa3d8c312c4"]) preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x800, 0x0) ioctl$PPPIOCATTCHAN(r4, 0x40047438, &(0x7f00000001c0)=0x2) 03:17:48 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x40000, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x41, &(0x7f0000000200)={'mangle\x00', 0x3, [{}, {}, {}]}, 0x58) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:48 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:48 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) [ 3250.163461] audit: type=1800 audit(1551237468.433:53663): pid=28820 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=17982 res=0 03:17:48 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x1000, 0x638001) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r1, 0x0, r1) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000180)={'ipvs\x00'}, &(0x7f00000001c0)=0x1e) fsetxattr$security_smack_entry(r2, &(0x7f0000000b00)='security.SMACK64MMAP\x00', &(0x7f0000000b40)='ipvs\x00', 0x5, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BLKPG(r3, 0x1269, &(0x7f0000000500)={0x1, 0x5, 0xc9, &(0x7f0000000400)="c2ddbf92583f5d98f4efa5f7ab3dea1df56ce366faab2b6a90064c30416a49c97a3cbcc530bc89076c3959171929bf3f739c12f1a883f5b8a4447b42fcfdb13ed068724279e6fef6e028a5e208841f5901c31914d56fcb87d59148277208899aa62be6d72067c672d2925a8936762d3009f577a4bfc690c97d218b367dd4c84ce8f0785f6623835a0c6e5ff421eea163588b0060ca19b93bc1e07c11588c7be09d8d9997d25185a34ba3ebb00a80b03537c5ec5093d25a32fd3e85844cad5d12970fd9393939cd2520"}) getpid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000006c0)={0x0}, &(0x7f0000000700)=0xc) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000cc0)='/dev/sequencer\x00', 0x107800, 0x0) kcmp(r4, r4, 0x7, r0, r3) lookup_dcookie(0xffffffff, &(0x7f0000000bc0)=""/228, 0xe4) write$binfmt_elf32(r1, &(0x7f0000000740)={{0x7f, 0x45, 0x4c, 0x46, 0x5, 0x127b, 0x7, 0x3, 0xd6, 0x3, 0x3f, 0xe0c, 0x93, 0x38, 0x3ad, 0xc229, 0x6, 0x20, 0x2, 0x1000, 0x1, 0xfffffffffffffff8}, [{0x60000007, 0x9, 0x8, 0x3, 0x0, 0xb20, 0x3, 0x6}], "a9e00612fa4887f07234fcdc56f63c1f4a2eba3ff6508f2bbb18defbf4603d58dd627b1e1b1c1996ecef62364462f24e6f1c338f69b21770880fe7ccb17654824a60097121d2efeaf2e8e652e3bd33d3a2e70fab454a101dfe2d1af07cda3859c5587af4a9b38f", [[], [], []]}, 0x3bf) pwritev(r1, &(0x7f00000003c0)=[{&(0x7f0000000240)="a9c0a2ec888d451e83eb765aeb51c918ba2babfe7ef621b6dc65c68269602e9190a4a73023a3161729fba954960683643c9ec0f0874248e91a5ce5988469598274b4bac5165cbf57e5af521bd07bdc073eb59cf14fd04f98a45dfb49c1461f294d80acade5bb", 0x66}, {&(0x7f00000002c0)="2d1b2a764fd645619dedc622cb04341f849d48799bdf7bc4116990d20ad3da0585e3e840839c74190446fc2aaae115f5f8740351561f68b3b14a7de8fbafa3b0ec6ae54593ea4a89c175c0ad563e9b525ba473ae703c7285c633c89f94d337e2404089939d691e45031fc65d19608d94086729d66f1041a67e50e4e3f87c65ef49ac9cd1f92b11e067fcca8bb0c78143d92f4366f38ea1ccef1f1541cc65541060c4c68dd0995b2837ea7ab5181ce76bf574cb7d2775c52e0ef58b4a674a041217a740027291a0b0a097012ed18d41827f8e109b378758926d86cd5f56ea6e1a6792a0544e81cf00797b6f69", 0xec}], 0x2, 0x0) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f00000005c0)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x14, r5, 0x10000000000003, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x840) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r6, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) setsockopt$netrom_NETROM_T2(r3, 0x103, 0x2, &(0x7f0000000b80)=0x81, 0x4) ftruncate(r1, 0x8) 03:17:48 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) [ 3250.279773] audit: type=1804 audit(1551237468.443:53664): pid=28814 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4867/file0" dev="sda1" ino=17990 res=1 [ 3250.301044] binder: 28850:28853 got reply transaction with bad transaction stack, transaction 6183 has target 28850:28853 03:17:48 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3250.372252] binder: BINDER_SET_CONTEXT_MGR already set [ 3250.399902] binder: release 28850:28853 transaction 6183 in, still active 03:17:48 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:48 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:48 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x4001fd) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)) gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, r2, 0x0, 0xe, &(0x7f0000000240)='net/protocols\x00', 0xffffffffffffffff}, 0x30) r3 = fcntl$getown(r1, 0x9) r4 = syz_open_procfs(r3, &(0x7f00000002c0)='net/p\x81\x80\x00\x00\x00\x00\x00\x00\x00o\xf5\x13\b?\xcd\x8c\x93\xce\xa11\x90\x02I\xb6\x8a\xd9\xe9\x01`:sn\xcd\x9d\x93\xd6\x1b\xf5\xc772\x93\xaa\x94y\x8fc\xeah\xbe~\xf1X4\x89w\xe8\xd7\xc3\x02\xcfs6E~\xa6\x8b\x80\x1c#\xf6\\\x93\x05\xf3\xd9\x84\xa8\xb0\x9f`\x00\x11\r\xb9\x17\xd6,}\x10\xa1b~Z\xad,I\xc1\x1dQ\xdd\xc4V\x00\xc4H\xe1\'\xd9\x11.N;\x87)\xda\x82\xb6Om]b\x8f\x84\xc6\x0enY\xc7g\xbbl8\n\xce\xcfAO') preadv(r4, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3250.405954] audit: type=1804 audit(1551237468.443:53665): pid=28823 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4867/file0" dev="sda1" ino=17990 res=1 [ 3250.418081] binder: 28850:28853 ioctl 40046207 0 returned -16 [ 3250.448304] binder: send failed reply for transaction 6183 to 28850:28853 03:17:48 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3250.558055] audit: type=1800 audit(1551237468.443:53666): pid=28821 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=17983 res=0 03:17:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000004000/0x3000)=nil, 0x3000, 0x8, 0x420011, r0, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0xc5bf, 0x8000) ioctl$SG_SCSI_RESET(r2, 0x2284, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fstat(r0, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) bind$alg(r2, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 3250.604280] binder: undelivered TRANSACTION_COMPLETE 03:17:49 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) 03:17:49 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e23, 0xffffffffffffffff, @remote, 0x7}}, 0x8, 0x800}, &(0x7f0000000040)=0x90) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000240)={0x2, 0x200, 0x66, 0x2a4f, r2}, &(0x7f0000000280)=0x10) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:49 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3250.641769] audit: type=1804 audit(1551237468.463:53667): pid=28821 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5226/file0" dev="sda1" ino=17983 res=1 03:17:49 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:49 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 3250.758239] audit: type=1804 audit(1551237468.463:53668): pid=28821 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5226/file0" dev="sda1" ino=17983 res=1 03:17:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0xfe, 0x0, &(0x7f0000000640)=[@dead_binder_done={0x40086310, 0x2}, @release={0x40046306, 0x2}, @reply_sg={0x40486312, {{0x0, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@flat={0x73622a85, 0x100, r2, 0x1}, @fd={0x66642a85, 0x0, r0, 0x0, 0x2}], &(0x7f0000000100)=[0x38]}, 0x800}}, @increfs={0x40046304, 0x1}, @clear_death, @clear_death={0x400c630f, 0x2, 0x4}, @acquire_done={0x40106309, r2, 0x4}, @dead_binder_done={0x40086310, 0x2}, @clear_death={0x400c630f, 0x1, 0x2}, @reply_sg={0x40486312, {{0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@flat={0x77682a85, 0x100, r2}, @ptr={0x70742a85, 0x1, &(0x7f0000000180), 0x0, 0x0, 0x37}, @fda={0x66646185, 0x8, 0x1, 0x2a}], &(0x7f0000000280)=[0x38]}, 0x2}}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r3 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000600)={0x8, 0x0, &(0x7f0000000400)=[@release={0x40046306, 0x3}], 0xfffffc25, 0x0, 0x0}) 03:17:49 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000040)={0x28000000, 0x20, 0x21}) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:49 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf4\x00'}, 0x45c) 03:17:49 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3250.904342] audit: type=1804 audit(1551237468.463:53669): pid=28820 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7502/file0" dev="sda1" ino=17982 res=1 [ 3250.942329] audit: type=1804 audit(1551237468.463:53670): pid=28820 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7502/file0" dev="sda1" ino=17982 res=1 [ 3250.974321] binder: 28912:28915 BC_DEAD_BINDER_DONE 0000000000000002 not found 03:17:49 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:49 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:49 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xfffffffffffffffe) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3251.007741] binder: 28912:28915 Release 1 refcount change on invalid ref 2 ret -22 [ 3251.044726] binder: 28912:28915 got reply transaction with bad transaction stack, transaction 6188 has target 28912:0 03:17:49 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:49 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) [ 3251.132198] binder: 28912:28915 ioctl c0306201 20000600 returned -14 [ 3251.154897] binder: send failed reply for transaction 6188 to 28912:28915 [ 3251.168943] binder: 28912:28937 BC_DEAD_BINDER_DONE 0000000000000002 not found 03:17:49 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:49 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r1, 0x800442d2, &(0x7f0000000040)={0x9, &(0x7f0000000180)=[{0x0, 0x0, 0x0, @link_local}, {0x0, 0x0, 0x0, @remote}, {0x0, 0x0, 0x0, @remote}, {0x0, 0x0, 0x0, @link_local}, {0x0, 0x0, 0x0, @random}, {0x0, 0x0, 0x0, @random}, {0x0, 0x0, 0x0, @dev}, {0x0, 0x0, 0x0, @remote}, {0x0, 0x0, 0x0, @local}]}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3251.209234] binder: 28912:28937 Release 1 refcount change on invalid ref 2 ret -22 [ 3251.230436] binder: 28912:28937 got reply transaction with bad transaction stack, transaction 6191 has target 28912:0 [ 3251.233068] binder: 28912:28933 Release 1 refcount change on invalid ref 3 ret -22 03:17:49 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3251.309904] binder: 28912:28933 ioctl c0306201 20000600 returned -14 [ 3251.323203] binder: release 28912:28937 transaction 6191 out, still active 03:17:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0xffffffffffffff50, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x23e, 0x0, 0x0}) 03:17:49 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) 03:17:49 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:49 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:49 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') socket$tipc(0x1e, 0x7, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x2400, 0x5) preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3251.434692] binder: send failed reply for transaction 6191, target dead [ 3251.529822] binder: 28966:28975 ioctl c0306201 20000600 returned -14 [ 3251.546189] binder: release 28966:28975 transaction 6194 in, still active [ 3251.553711] binder_alloc: 28966: binder_alloc_buf, no vma [ 3251.559414] binder: send failed reply for transaction 6194 to 28966:28975 [ 3251.574426] binder_transaction: 19 callbacks suppressed 03:17:50 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:50 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3251.574441] binder: 28966:28977 transaction failed 29189/-3, size 0-0 line 3035 03:17:50 executing program 4: syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x9, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) fcntl$dupfd(r0, 0x0, r0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') getsockname$llc(r1, &(0x7f0000000080)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f00000000c0)=0x10) preadv(r1, &(0x7f0000000540), 0x0, 0x0) 03:17:50 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:17:50 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) [ 3251.632104] binder: 28966:28975 ioctl c0306201 20000600 returned -14 03:17:50 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup(r0) ioctl$EVIOCSCLOCKID(r2, 0x400445a0, &(0x7f0000000000)=0x40) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="01634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:17:50 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:50 executing program 4: socketpair$unix(0x1, 0x8, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x1009}}, 0x20) write$uinput_user_dev(r2, &(0x7f00000003c0)={'syz1\x00', {0x401, 0x0, 0xe1c7, 0x81}, 0xb, [0xfffffffffffffffb, 0x5, 0x80e, 0x5, 0x5a, 0xe9c, 0x4, 0x3, 0x7, 0x2, 0xfffffffffffffffd, 0xffffffffffff7fff, 0x6c4b28a2, 0x4, 0x10001, 0x8, 0x9, 0x2, 0x1, 0xfffffffffffffffd, 0x1, 0xff, 0x769, 0x3, 0x0, 0x5, 0x7fff0, 0xe000000000000000, 0x8, 0x8001, 0x89, 0x9b5, 0x1ff, 0x8, 0x0, 0x9, 0x7654cdab, 0x8000, 0x2, 0x7, 0x7fff, 0x2, 0x1, 0x9, 0x6d1, 0x3f, 0x1, 0x1000, 0x4, 0x10000, 0x8, 0x1f, 0x3, 0xffffffff, 0x6, 0x2, 0x200, 0x4, 0x8001, 0x3, 0x1, 0x1, 0x200], [0xfff, 0x9abb, 0x4, 0x7, 0x40000, 0xa6c, 0xffffffffffffffff, 0x0, 0x3, 0xff, 0x35, 0x1c0000000000, 0xa, 0x6, 0x8001, 0x2, 0x6, 0x1, 0x3f, 0x9, 0xe01b, 0x5, 0x0, 0x0, 0x8000, 0x2, 0x8001, 0x4, 0x9, 0x1, 0x4, 0x8000, 0x401, 0x4, 0x5, 0x7, 0xb8, 0x0, 0x1, 0x10000, 0x9, 0x7, 0x5b07, 0x2, 0x6, 0x7f, 0x5, 0x1, 0x4, 0x4, 0x40, 0xc1, 0xac0, 0x1000, 0x369, 0x0, 0x5, 0x0, 0x7f, 0x2, 0x100000000, 0x3, 0x81, 0x561d], [0x7, 0x2, 0x1, 0x0, 0xfffffffffffffffd, 0xdb, 0x8000, 0xdd7, 0xfffffffffffff7f3, 0x6, 0x100000000, 0x4, 0x9, 0x100000001, 0x9f5e, 0xffffffffffffff3a, 0x8000000, 0x9, 0x1f, 0x2, 0xd607, 0x0, 0xfffffffffffff09d, 0x1, 0x3d, 0x8, 0x0, 0x3, 0x9, 0xb517, 0x100000001, 0x180000000000000, 0xc00000, 0x0, 0x101, 0x3, 0x3, 0x0, 0xfffffffffffffffe, 0x1, 0x6, 0xa0c2, 0xfff, 0x1, 0x3, 0x0, 0x0, 0x7ff, 0x4, 0x1, 0x8, 0x2, 0x6, 0xb9b, 0x400, 0x1, 0x8, 0x5, 0x40, 0x1, 0x0, 0x1e5, 0x6, 0x7fff], [0x3ff, 0x9, 0x1, 0x800, 0x0, 0x1, 0x200, 0x3, 0x4, 0x4, 0x101, 0x2, 0x1, 0xbb43, 0x7c8, 0x0, 0x800, 0xcbe, 0x2, 0x4, 0x9cf, 0x0, 0x5, 0x6, 0x7, 0x3, 0x800, 0x4, 0xb7e, 0x400, 0x8, 0x7fffffff, 0x6, 0x5a92, 0x100000000, 0x8d, 0x1000, 0x100, 0x7, 0x8a, 0x80000000, 0x8, 0x3f, 0x2, 0x1, 0x4, 0x5, 0x7f, 0x10000, 0x1, 0x2, 0x2c0, 0x55b, 0x7, 0x6, 0x4, 0x5547, 0x9, 0x8, 0x3, 0x3, 0x5, 0x7, 0xb]}, 0x45c) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r3, 0xffff, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x3, @dev={0xfe, 0x80, [], 0x23}, 0xaa}, @in6={0xa, 0x4e23, 0x0, @mcast1, 0x9}}}, 0x118) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r4 = getpid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, r2, 0x0, 0x20, &(0x7f00000000c0)='wlan0\xda)+nodevkeyringlouser\xd6user\x00', 0xffffffffffffffff}, 0x30) fcntl$getownex(r1, 0x10, &(0x7f0000000140)) r6 = gettid() r7 = syz_open_procfs(r6, &(0x7f00000001c0)='nel\xdd\xd7\x92V\xf5\x06\xdb\x11\x00\x00\x00') preadv(r7, &(0x7f0000000540), 0x2, 0x0) ioctl$NBD_CLEAR_QUE(r7, 0xab05) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x71, 0x2, 0x4, 0x0, 0x0, 0x7fffffff, 0x800, 0xa, 0x0, 0x1, 0xc1, 0x3, 0x89, 0x3, 0x20000000, 0x1, 0x8, 0x9, 0x3ff, 0xffffffff, 0x5f5d, 0x17c4, 0x7, 0x10000, 0x10001, 0x401, 0x9, 0x7, 0x86a, 0x6, 0x52, 0x3f, 0x80000001, 0x7675, 0x2, 0x401, 0x0, 0x5, 0x1, @perf_bp={&(0x7f0000000000), 0x2}, 0x80, 0x8, 0xfffffffffffff801, 0x8, 0x8, 0x7fff, 0xf341}, r4, 0xe, r5, 0x2) [ 3251.768871] binder: undelivered TRANSACTION_COMPLETE 03:17:50 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3251.856388] binder: 29004:29009 ioctl 400445a0 20000000 returned -22 [ 3251.873523] binder: 29004:29009 got reply transaction with bad transaction stack, transaction 6198 has target 29004:29009 [ 3251.894702] binder: 29004:29009 transaction failed 29201/-71, size 0-0 line 2816 03:17:50 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\b\x00'}, 0x45c) 03:17:50 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') socket$key(0xf, 0x3, 0x2) preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3251.915373] binder: release 29004:29009 transaction 6198 in, still active [ 3251.923949] binder: 29004:29009 ioctl 400445a0 20000000 returned -22 [ 3251.931698] binder: send failed reply for transaction 6198 to 29004:29009 [ 3251.951950] binder_alloc: 29004: binder_alloc_buf, no vma 03:17:50 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) [ 3251.984032] binder: 29004:29016 transaction failed 29189/-3, size 0-0 line 3035 03:17:50 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:17:50 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001c80)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000200)={{{@in6=@ipv4={[], [], @local}, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in6=@ipv4={[], [], @empty}}}, &(0x7f0000000040)=0xe8) stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = gettid() r6 = getpgid(0xffffffffffffffff) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000018c0)={{{@in6=@empty, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f00000019c0)=0xe8) r8 = getgid() ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000001a00)=0x0) syz_open_dev$binder(&(0x7f0000001c40)='/dev/binder#\x00', 0x0, 0x802) getresuid(&(0x7f0000001a40)=0x0, &(0x7f0000001a80), &(0x7f0000001ac0)) r11 = getegid() sendmsg$netlink(r2, &(0x7f0000001c00)={&(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001880)=[{&(0x7f0000000640)={0x178, 0x11, 0x10, 0x70bd2c, 0x25dfdbfc, "", [@generic='r', @typed={0x60, 0x74, @binary="a33a7f93db0a929c5ff8cc0cbaab9ad8118ee51597e30802c9d6303cd818bf9cc29516270b340772fde503b892550903fa45cb536b6a1997b977296002088dc4a35ebfd2269d40e175e79c718bb526da00c7e9fc036cc9ea06d8"}, @generic="f06a097fc3462e5258a2f8e608c5038d6582ca0266f212d1047206a1f934d1ae43f872f44520455b6a0b52327b4f1f4e81c60c7982b8026a63df0951a5f2b6c960447dc8cfb1c38742e5af16e75770024c0cf79be697a36c61f72b32c9da7d448a250180d95565d86ae0c0d468344732b3d6b11b2eefa788079c373b31b2c5da61c20609cb5ad94f3ff4f6f3aca8dd463ac37747ab5f5753b7a0cbb18d63261c92bd2b68e6964c524c68dd8d0a66b06f6d9fa358407e24f0090f", @generic="38ce0d6f55afb2f2919d23153eba8121662c70c59552e955032999fff443cb5cc8bd6d8fdff7570c3f17f3b5c87fbf0bea02511abe3bb4f9b64b3ce53c8f32c114bbbcc27e04d02137bca5b4"]}, 0x178}, {&(0x7f00000007c0)=ANY=[@ANYBLOB="881000002700000226bd7000ffff00006c102f0008002200", @ANYRES32=r3, @ANYBLOB="08007b00ac1414bb0c0074002500000000000000e540aaef6b71b1c5419435522275011cef201e13df388cfd0173abc24a0a0175106434d79e9e22e634d9a65a0de492c0121ec79389ec64a814004000ff020000000000000000000000000001a351f382d0c420d7f4b10fc4309c5da1c706df3d958e9baec25c19705fab324b0bf311edaa975368c5585ff5a2d5e1a28003cd7de2a7418a313014970e1fb84758756276348d9256cf829c88ffcdce66579a8f92b537cfa0adb70c29b5154bc63cb40a3887ad83dbff4dd838973f8b3b9855f7a0f21a0cd7e4c67358dff314ea5ff0ec5a1a56eab7940c0d696f14a37b41c776387a4f9d8be874233439fa175e3740de374e0898f68e43259fec17fdd2b1a5c7449fe7bad0a2f8d45ad56587b36f478e9e03e20cc3103873263e8a0761f97e2b48fa96a0b6017f52c2e2d7e77424b554cdb337320530ba175c67d43724ab96becdcb7d13bc0510c58aec9c0c1dafeee481361aead42d0db2f56c3b6909e3556d2271774d27732bec4177f677be63cd10ab986edddba3b94fc5193df26d0f823abc4c01eb0b089009ed58c9f1745fac6cb3132efa8df30ebe1ffdbf8f26e7fccda2f4587e9b661fdee8c0cedb3ebc064d8224525ae5de67392d8fe286105c8f9d603bb14782cf4218340154ac1b1a90ad03e0090ec29f64867e43e2452fa89aa5e6116693d0f3243fce7e2bd165fa4598977036f452ce3bf9fca6e7782fa5dab164aff40073d2e1d7ac98d2a74ecf0ccb8de60bb2e98a83ae676bb737b3fc6ba213621d35375a930b163e05a4f4d86a0f7ee319b52ad25ea9c31f50a41fd298bd2e1351227c44c7e12bcbd40312e9894393b698ac05f065b158645c14e1b708d181328e20cf14d8fd1dad4c6edbbba9960258c499c229901b0c5f8bd5af4b61cf84565bb9e8dc18c9b4faf0dc9090f5b61463a70ecf9dc9a328b5ec52ded8078e21c67d7b476b7f46b15553cc3277db7e9e671430724c75e40f851e6fa2459b44e211c0011d41f8d899d9c22d91046e7d47f78e190cdb2f38bb0ae2f62d1fe80e8fab22943ff3b3fb949efb2a9ea40b11d974a3bd63528fac3e9c4d9228008ad84dce3fd6a10adb64ae12f2adb5e3af13391133d0ffc1aa196eeb240e3fa4c6adbea8f3e397b0fddc8e5a7fa196a4e9c6bd694cd4ca4367fd7b2be181e5bc4ea389cd80a49e9ff592e3be36aedc5fb0d00b36ab48b1c06a67cd43c8a6b4b7b0cde27b71684ffdc4bf87bdeb10842946a6d5633e51300887fe3ca7b4ae6859e6f29098f97a9b427b53fde447fff964a02f82bb8861e9a3f4753088311487264ec28291766413df63548fc4c10a01cdbc89c43cb051a8551d74b2edbf5caf88e5fef015b53ca39e39b65b05fcddd36f5646dd51ef9ba5d691bef1d6cc303c133f2bc949e399229de51d9185fc5755d98b9c22bda5af874eb1d2f8542d21129a71ad0532f23f238331786c0d778c4e2f4d0dfca02924b5094309f49098030a44810f4eea59b6a042d9df1bc3973f29d052ca8ec8b6b582fb367c1f709fae4a3149d0d723fd1cc7ee82367ba6fc477b2b54e613bfc1d373d998f239ca366653b711158000371f1a92971600a0ea1775c1833eb3ee2e5bf3d3ab2c2b3ef59f0defcc5909f29975acc4139d3d414ca986d26865d5aa4e234cfaec3f724d8966d19221ce42d3de05a6b1841f40058c43fd1069e2791a3e7b547991bbb8ecd9a3c1099e3dbb535c806680523a22fe5c9a17591ee756b4af786534b94516e6daac28353fda9d380bd878bda045b8e2b35cc032ca538f7158b237ec400ed27dd7da2f5d68ac62a038ec1a079463284b216098ed1810151a62648c996740fe8b7c1ad1ea73301fbca24665ade1dde2b7be2a0778c1c907dd046691cf7a95eafdb9c45e11dfe275b05cf6a836f6cb1a1b9b3e52554223447be1606f579ac1d2c93925480603a2b5529563de4e3e47042b78eb4902ca4b27b3d037e0c4ac050224af2abc3c6e41e6a6d1c50cf0af3a86aae08b43f6b589c356c663b914c18ec91ec23265d575f232564eedc2428ccffda9fb66c682622d05ee1c8fc51018526209ab41fbaede4c5deb828d7919381979a4fc5dcd08b073a1faa48d88ed7f8fe2d7acc4f4fd4baf804f2e4bbae187b62a5ee6d410c864c1962699f47b6c32d0cee9f73a830ff44ce506d56b929a41d0d39487d9a8ece72ce812f1e142387c4651e8a8d1e87eeb0825ca560602c550c346fa68508a283150820e58471df76bd3b3aee7fa3e46a38b12ea77260377ed0b1ae6540f9eeaad01a01a60e4445a08ef20483cadd8c403485636bb04e3a1cf07ce4a5587549513ff42df774b6c215832d79d2e8330cb12183580697079baa4c7c89a63d8fa0f06fd099d5c53c0436ccfaa26592abc8dc68dadc0738d513b4a3d35c5663e5dbabb88b1f429c1c65b34c699330f4e1dd897e22d3c0e36215d2619f34c2121027eec913a8c477660254563576f440a4d9962ba663a6f51519c8bbcd12e8133965c632059cf737b45a620fa03b4c4b8663297a795742b3fa5ff8b73d65a2df54aedf16e6624812ae52456fabcac3749e2462aa37f4593576194729f45ad82bf2a076542bcd542bc3bbb0b66aa21a69185c902ce898de6d004bd3c24b6660ba72c089a33fd6a9dae134385bf89f2c1846d069610a1d9077aecd9be313b41a8d59af1d51862b89a479d4ae1cd934b642771c7c632bce425ddf84eff3ae996c836fbf19419f639e6fb40f4508ec5825ec1ead9f17bad6693058ab70e87eb4664ac80ffb00b088f20e2e5ecfd1d076eeaae44605c71db4757071004a239f2121f5951e723be96fe73eefbcd62293da277de5d71bfd3380b515366105fcc0e38fa8700022325102c9d2865132a54db9461e6080c4e9576a8bc36bdd2751da4fe1a8b3ac85f9c96b104f150be51ee7d819b28a328394f59e9b2fb431d3dd09eb909045193bacb9d24d21b45e0245476f27276bd75b7e692eb21fc9dc27136c490f5b75ae98a98f42281613c378e0a0eada18fb621558039d2d62f495414595310cb697055337f2293ba49b3681f0f19e313915386f9fae3b9bf9c0ded0e28c8fb9bee4fa3184841142c43d46421b2e9d091067c9f7da7036d60e9732d006b751a92fdac98db92960d4ad85f92a72ecf27f33d7183470641c3930484b4f4cc675df53e4458609e505292c42968377ad721954f256300593f006feca8a0952bc3a07b71ee636ec871945f1296d3e00af26762b715c790d1e683baef64af51601a41d2bfa0c495008aa0698391f2990f51b44d3764d2ab8dd8a4e8264e77d7443b9fa39ea690ba74dba05f13208881953fe3c3569eb44d20050d7524b8d19df583f72608d3209610b5056666a2bebd75ea89485beaf191200d20622761c7ab64653ba2ec7da88fbba4bbfcbb54a04ed1058b59aeaf9af9b3c5b6eb1cde250765bc9ca23d99b9c9b6d02576fa581954b8496f8c21b75271a1d627e431001088d819f578bd0f17d27a12a11c732df9ed895d369e000442a87d6b9e8836b11dc4e37078fc8e2e469caabfdc0b314f66828717cb8467060b8a1d8376308b1228a320109f579141b97cf79325fcb0e1f92e5aae2262664be0df1c2e0599e9caa55bcb505713e3b6c6d2986007669fdc62cd58ce04ef1720fc367048e2a87a88332c8b21700d9e1f8891428b4c92e3f4b1a015e7b27d010f6663f3802df3c624805490cd3a6bc459c2d95d4da236da37e2257889e4de2e1522b60db8723c243918dc617404148324498e27d11211b2e6b2b628e600644515b7f8e8a557b640d99170ed8a0e90ab416a6597d797d230fc037a7e582e1360b350a05ba1f12213bcca4f18483e27e70b42eb65c40000000000000000ba852fdf64970b4de8d166c842524199289f0e5538c2cb1025e83b9fd12cdec68309501428417f647e79191e5d8e4b83b3bad40a1f53cc31afb904ef34db8df1a1a5d430be618064f30f6fdde164a37440200efe2772752979ddf97c71d42af343958466fecd145cf40bea54d02e34b5c443346f809b86c3daa6d2e2bfad03acb7c0330220e1d042fa393b8389dc63b662236c657e2ed587df408a9a058a47f730f1808ce993c0e108929b8a88433fb95ca47ff3aa2340ae22f5cd17d2272e15c23c7955d0d767cbb9386029bef7f1c78a9f0bd5cf2bd489056ad7c85b26b0d04e652f5f8f8b6aa44dbb8a019af8fd767e37e6804a6055610858c5d27a403aa2919a11d99c62f986277feae813f380d227a702d76f203cc64aa42506171357ccf2d74fa94eeb8781fb41c761a636e97a69c1a20adede11a5da78d1327215d7ba10d471277cc12af316e0ba14770cf583695fb5eb0339732281673d68cb6ac1d912402451a7a4dd8f5caf8e16415544a2f0d1c4ca03a88cf068255a50d65846003a2c4a3ffa9d1ffdf365b9fa86e0bea2034801ec7f1774f63eaa1a34b2e38a8518c86f4c449a5dda21c90a2ff5d0db9f0b13a8465f82f3c748a76efd57e11144a973c47c291b6b23569d7d01435d499e23605b01e71262b35e9d2c11cad3dea3458baf7139c2ab017dcb8f571debf3ea3b13bff138edd90ddb28f36d271281e254ac4d09365719c89e2d91ddafdcb43eb714bf5b67c3340b97d9669d9e3cda81366dbcb9d057c5937d8a7db676049e665d9d18b90fe6c31f532c3ecadb258f188eca74f3aa398003c7ee359c828b5e16e1f7dfb412e285827d364949300e92b008983f19830f875bf3e7307fba0c03ea7921965d1472b503fcee4e5f431f1cc8ac40e6ec0b820c0b698243b7df21dcf9ba0f366a93c6cfceb6f855eed613d16048d879c04d007b6806ae88fb995557cba527c796bebac4d7b71a467c0320c41e358f7aa71373dfe7d333fb3f2b8c96d588dee34418afdf45c9287f3daf4709015f56637ce2b8555dec9920b6ee2d8941c7b2f02ea00e4a8b41076594e165e223dbbc9fa984f9cee1a076b37cb067cbdd86d49ff82c77053cbe6b446305ddf2767b306a8f32cf8eed44f80324958f04642042428be4a4e1cafe5453d8dc26d5eccc8cfca7457a8b11dbdd2dd8c2d99b0d4f744abe54009b885b8dc0b0dcbc2defb0f3d07c160b68ac01671f5d3db0e1b9570a70ae3abfd5d1ff18ed479211d9f6c1c8cae5499cf4b145c34ff5962d9a85894f4ac4ca1d28e6843ab4b6cdb6dcecce2c36b32bbdbae5af710dccfbcb963bbffdc47dfac122fdd0431654655a2f690bca796e3b9bce7786453187d148c3b4f0f95a7d4f9f63480c2d84d298728cd101d31ddee237acd3ab8323061d6de90d4a6043e29357af940807ced29979b3a20a37fe35c8fee86c554c375b65bc04ed368402fe2c78c017880f730b5dc1ac75514b50c813979a5cd93c6d88c04f7b15d7d73151a29582ed8a700acdf874334af0cfb37c4e90a65e968dab71c4d01111008b7e35951e886639ce4b54eb43bcf0ba9d7e81166dc839b5ec6b6f8c90fae4046f4e383f4a1600866804be9a1731182613c440060053535c7dce644c30783793da82dacb0dbc48dd838d2b1b2545284ffd42f5fe4b20f0d5b9d636412cccbee4aee04995b03f371cf9ba3ddb8d7b9ed4ff17478c811c15e401c3d0616945a98ba2288ee1f09fcb65d5a575a6ed1070f5d7e565005cabccca50e563f4746c46e1383db1a5b10663cb0071f919efce32e6c42191e20ec0b54291036728f04459cad1cebcf08dd5a0869bc83a7b29db3a7db12b15720b60944a844e9f97f4973453348f6878f3dd648459791ccfca50db6c3b531409f8f26f86ab27f9fb81b5fafce0fd548b991ce866fc218dd6a6f3edcda034022e63ff28dcec4afbbbb72143c45995aaf91caa86a5fa50704c7e0776146eff8007ce385af88a8c9a4e9e7c525a699ea90c000d000700000000000000"], 0x1088}, {&(0x7f0000000100)={0x1c, 0x22, 0x210, 0x70bd2b, 0x25dfdbfb, "", [@nested={0xc, 0x47, [@typed={0x8, 0x2d, @u32=0x7ff}]}]}, 0x1c}, {&(0x7f0000000500)={0xf0, 0x33, 0x0, 0x70bd2b, 0x25dfdbfb, "", [@nested={0xe0, 0xe, [@typed={0x8, 0x3, @uid=r4}, @typed={0x14, 0x94, @str='/dev/binder#\x00'}, @typed={0x8, 0x5c, @pid=r5}, @generic="d5546dc1cf57e71124c599087112729f25c789e7a860978ab9d89b3bb01de66cb98cfb77557ec072af24c032fa16c652740572349d58864adb942a71d09f607aef7b883750f7a8bd672c728e1522a942947884c2128211c0c894df4d46bfa2168abbc3cb0357850e81e86c220de6ed398c4661df52201a7b9c331ecf42c617e6dcbc5766715f4793c1a7ed321b1cd305bdd48969e805f643ee541fecffec6a416bfde3aaa4faf10f1fd46de66d86b3515bb5af99fc"]}]}, 0xf0}], 0x4, &(0x7f0000001b00)=[@rights={0x30, 0x1, 0x1, [r0, r0, r1, r0, r0, r1, r1, r2]}, @cred={0x20, 0x1, 0x2, r6, r7, r8}, @rights={0x18, 0x1, 0x1, [r2]}, @rights={0x18, 0x1, 0x1, [r0, r2]}, @rights={0x28, 0x1, 0x1, [r1, r2, r1, r1, r1, r2]}, @cred={0x20, 0x1, 0x2, r9, r10, r11}], 0xc8}, 0x4000090) [ 3252.090210] binder: undelivered TRANSACTION_COMPLETE 03:17:50 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:50 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf4\xff\xff\xff\x00'}, 0x45c) [ 3252.158144] binder: 29039:29042 ioctl c0306201 200001c0 returned -14 03:17:50 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x10000008) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, 0x7fffffff) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x10000, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:50 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) [ 3252.204138] binder: 29039:29047 ioctl c0306201 20000140 returned -14 [ 3252.238711] binder: 29039:29042 ioctl c0306201 20000600 returned -14 03:17:50 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3252.294444] binder: 29039:29047 ioctl 540f 20001a00 returned -22 03:17:50 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:50 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) socket$inet_tcp(0x2, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3252.372473] binder: 29039:29066 ioctl c0306201 200001c0 returned -14 03:17:50 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf5\xff\xff\xff\x00'}, 0x45c) 03:17:50 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) [ 3252.414787] binder: 29039:29042 ioctl c0306201 20000140 returned -14 03:17:50 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3252.491105] binder: 29039:29047 ioctl c0306201 20000600 returned -14 [ 3252.491688] binder: 29039:29078 ioctl 540f 20001a00 returned -22 03:17:51 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer2\x00', 0x40000, 0x0) ioctl$TUNGETFEATURES(r1, 0x800454cf, &(0x7f0000000380)) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$DRM_IOCTL_ADD_CTX(r2, 0xc0086420, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_DMA(r2, 0xc0406429, &(0x7f0000000300)={r3, 0x3, &(0x7f0000000200)=[0x5, 0x4, 0x7ff], &(0x7f0000000240)=[0x0, 0x5, 0x100], 0x5, 0x7, 0x91, &(0x7f0000000280)=[0x1f, 0x3, 0x8, 0x80, 0x100, 0x3, 0x7fff], &(0x7f00000002c0)=[0xffffffff]}) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r4, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) futimesat(r2, &(0x7f0000000040)='./file0\x00', &(0x7f0000000180)={{0x77359400}}) 03:17:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r2, 0x4008af13, &(0x7f0000000040)={0x3, 0x9}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0163404000000000000000000000000000000000000000000083b95952740000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:17:51 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:51 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\xff\x00'}, 0x45c) 03:17:51 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:51 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:51 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000180)=[@in={0x2, 0x4e21, @multicast1}, @in6={0xa, 0x4e22, 0x7, @loopback, 0x9}, @in6={0xa, 0x4e20, 0x477, @rand_addr="c5df91d008df86e548feb332ff820764", 0x2}, @in={0x2, 0x4e21, @local}, @in6={0xa, 0x4e24, 0x3fc, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x5}, @in={0x2, 0x4e20, @loopback}, @in6={0xa, 0x4e23, 0x7, @local, 0x401}], 0xa0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:51 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3252.798027] binder: 29098:29114 got reply transaction with no transaction stack [ 3252.824856] binder: 29098:29114 transaction failed 29201/-71, size 0-0 line 2801 03:17:51 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:51 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) [ 3252.873818] binder: 29098:29101 got reply transaction with no transaction stack [ 3252.903217] binder_release_work: 26 callbacks suppressed [ 3252.903222] binder: undelivered TRANSACTION_ERROR: 29201 [ 3252.920974] binder: 29098:29101 transaction failed 29201/-71, size 0-0 line 2801 03:17:51 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:51 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x7, 0x1) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r1, 0xc1205531, &(0x7f0000000180)={0x1, 0x1, 0x7, 0x1, [], [], [], 0x7fffffff, 0x6, 0x100, 0x9, "0bcfe2a7ca348b88542e5c8d509e1ce9"}) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') ioctl$TIOCMSET(r1, 0x5418, &(0x7f00000002c0)=0x2) preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3252.953861] binder: undelivered TRANSACTION_ERROR: 29201 03:17:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00e00000"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:51 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:51 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = dup3(r0, r0, 0x8617f545312f8560) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0xd000) getsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000200)={@multicast1, @broadcast, 0x0}, &(0x7f00000002c0)=0xfffffffffffffe9a) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f0000000300)={@remote, 0x23, r2}) r3 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') ioctl$FS_IOC_ENABLE_VERITY(r1, 0x6685) preadv(r4, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:51 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) 03:17:51 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) [ 3253.109821] binder: 29139:29142 unknown command 57344 [ 3253.157118] binder: 29139:29142 ioctl c0306201 20000140 returned -22 03:17:51 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}, 0x45c) 03:17:51 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:51 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001fd) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000040)=0x5000) preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3253.199964] binder: 29139:29149 got reply transaction with no transaction stack [ 3253.238584] binder: 29139:29149 transaction failed 29201/-71, size 0-0 line 2801 03:17:51 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\\\x00'}, 0x45c) [ 3253.300417] binder: send failed reply for transaction 6209 to 29139:29142 [ 3253.307967] binder_alloc: 29139: binder_alloc_buf, no vma [ 3253.325597] binder: 29139:29149 transaction failed 29189/-3, size 0-0 line 3035 03:17:51 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) [ 3253.353898] binder: 29139:29142 unknown command 57344 [ 3253.370313] binder: 29139:29142 ioctl c0306201 20000140 returned -22 03:17:51 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000040)) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000280)=0x0) r4 = syz_open_procfs(r3, &(0x7f00000002c0)='net/ip6_tables_names\x00') preadv(r4, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:51 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) [ 3253.421654] binder: undelivered TRANSACTION_ERROR: 29189 03:17:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:51 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:52 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) [ 3253.527185] binder: undelivered TRANSACTION_COMPLETE [ 3253.532929] binder: undelivered TRANSACTION_ERROR: 29189 [ 3253.538454] binder: undelivered TRANSACTION_ERROR: 29201 03:17:52 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:52 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:52 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0xe}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:52 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) [ 3253.678775] binder_alloc: 29196: binder_alloc_buf, no vma [ 3253.705739] binder: 29196:29202 transaction failed 29189/-3, size 0-0 line 3035 03:17:52 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) [ 3253.752916] binder: send failed reply for transaction 6214 to 29196:29202 03:17:52 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000040), 0x0, 0x0) 03:17:52 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 3253.799268] binder_alloc: binder_alloc_mmap_handler: 29196 20001000-20004000 already mapped failed -16 03:17:52 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3253.868522] binder: BINDER_SET_CONTEXT_MGR already set [ 3253.905136] binder: 29196:29202 ioctl 40046207 0 returned -16 [ 3253.926645] binder: 29196:29229 got reply transaction with no transaction stack [ 3253.934474] binder_alloc: 29196: binder_alloc_buf, no vma [ 3253.940314] binder: 29196:29222 transaction failed 29189/-3, size 0-0 line 3035 [ 3253.947977] binder: 29196:29229 transaction failed 29201/-71, size 0-0 line 2801 03:17:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="01634040000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000007e438ac46ce49d947c075d54992a35cf2096ae5390a9b8fb6340f91349b57e77f036ef068803654014f8443a98fa30f08c47c2db120d81320f733c7abefdf89cdc181efdc8d00bfa2c6e123fc9c0571c90a99ec45a4c1dbcb8defe84ae9217bb"], 0x0, 0x0, 0x0}) 03:17:52 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf4\x00'}, 0x45c) 03:17:52 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) fgetxattr(r1, &(0x7f0000000180)=@random={'security.', 'net/protocols\x00'}, &(0x7f00000001c0)=""/214, 0xd6) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BLKRRPART(r0, 0x125f, 0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000040)=0x0) ioctl$CAPI_GET_FLAGS(r1, 0x80044323, &(0x7f00000002c0)) r3 = syz_open_procfs(r2, &(0x7f0000000000)='net/protocols\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) getsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, &(0x7f0000000300), 0x4) [ 3253.957446] binder: undelivered TRANSACTION_ERROR: 29190 [ 3253.963203] binder: undelivered TRANSACTION_COMPLETE [ 3253.978546] binder: undelivered TRANSACTION_ERROR: 29189 03:17:52 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf5\xff\xff\xff\x00'}, 0x45c) [ 3254.005220] binder: undelivered TRANSACTION_ERROR: 29201 [ 3254.018775] binder: undelivered TRANSACTION_ERROR: 29189 03:17:52 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:52 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3254.054111] binder: 29233:29242 got reply transaction with bad transaction stack, transaction 6219 has target 29233:29242 03:17:52 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:52 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000240)=""/72) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') ioctl$DRM_IOCTL_AGP_INFO(r1, 0x80386433, &(0x7f0000000180)=""/148) preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3254.149916] binder: release 29233:29242 transaction 6219 in, still active [ 3254.166757] binder_alloc: 29233: binder_alloc_buf, no vma [ 3254.177196] binder: send failed reply for transaction 6219 to 29233:29242 [ 3254.210543] binder: undelivered TRANSACTION_ERROR: 29189 03:17:52 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xff\xff\x0f\x00'}, 0x45c) 03:17:52 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) 03:17:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x100) ioctl$KVM_GET_API_VERSION(r2, 0xae00, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="01634040000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000045e7000000000000000000000000"], 0x0, 0x0, 0x0}) [ 3254.282673] binder: undelivered TRANSACTION_COMPLETE 03:17:52 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:52 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:52 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$VIDIOC_SUBDEV_S_EDID(r1, 0xc0285629, &(0x7f0000000180)={0x0, 0x49096809, 0x0, [], &(0x7f0000000040)=0x6}) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3254.423078] binder: 29273:29279 got reply transaction with bad transaction stack, transaction 6224 has target 29273:29279 [ 3254.456717] binder: release 29273:29279 transaction 6224 in, still active [ 3254.464381] binder: 29273:29279 got reply transaction with no transaction stack 03:17:52 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) 03:17:52 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3254.482007] binder: send failed reply for transaction 6224 to 29273:29279 [ 3254.493861] binder: undelivered TRANSACTION_COMPLETE 03:17:52 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x80\x00'}, 0x45c) 03:17:53 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3254.535823] binder: release 29273:29286 transaction 6227 out, still active [ 3254.570497] binder: undelivered TRANSACTION_COMPLETE 03:17:53 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x7) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') ioctl$TUNSETVNETLE(r3, 0x400454dc, &(0x7f0000000040)=0x1) preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x105a9, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="106308400100000000000000076304e7beb102002711e04003000000"], 0xffffffb2, 0x0, 0x0}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x8000, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000300)={0x0, 0x16cfc567, 0x6}, &(0x7f0000000340)=0x8) setsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000400)=@assoc_value={r3, 0x71}, 0x8) ioctl$SG_GET_VERSION_NUM(r2, 0x2282, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000001c0)={0x0, r2, 0x4422, 0x0, 0x400000000100de, 0x2}) r4 = dup2(r0, r1) setsockopt$inet_dccp_buf(r4, 0x21, 0xcf, &(0x7f0000000240)="510917299f7837ac85f519c310465e45b59e2ef9a76c8ddc8d8f76cb92e7eb8172bd40f6896600389621050bb5acb1c876e98f164e2b82dc42d806be1ffb75a93cc1dab6", 0x44) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000100), &(0x7f0000000180)=0x4) [ 3254.657331] binder: release 29273:29279 transaction 6227 in, still active [ 3254.667063] binder: send failed reply for transaction 6227, target dead 03:17:53 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:53 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) [ 3254.720138] binder: 29310:29312 BC_DEAD_BINDER_DONE 0000000000000001 not found [ 3254.751073] binder: 29310:29312 unknown command -419142905 [ 3254.756949] binder: 29310:29312 ioctl c0306201 200002c0 returned -22 03:17:53 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000040)=0x8, 0x4) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:53 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:53 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) [ 3254.777588] binder: 29310:29320 ioctl c028660f 200001c0 returned -22 03:17:53 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3254.884409] binder: 29310:29312 got reply transaction with no transaction stack [ 3254.907622] binder: 29310:29320 BC_DEAD_BINDER_DONE 0000000000000001 not found [ 3254.915256] binder: 29310:29320 unknown command -419142905 [ 3254.925182] kauditd_printk_skb: 290 callbacks suppressed 03:17:53 executing program 4: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x200802, 0x0) ioctl$SIOCX25SENDCALLACCPT(r0, 0x89e9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r0, 0xc0945662, &(0x7f0000000200)={0x7, 0x0, [], {0x0, @bt={0x71a, 0x7, 0x1, 0x0, 0x5, 0x1000, 0x1, 0xffffffffffffffc1, 0x82d, 0x40, 0x8000, 0x6, 0x3, 0xfffffffffffffffe, 0x2, 0x24}}}) r3 = fcntl$dupfd(r1, 0x0, r1) epoll_ctl$EPOLL_CTL_DEL(r3, 0x2, r2) r4 = syz_open_dev$sndpcmp(&(0x7f00000002c0)='/dev/snd/pcmC#D#p\x00', 0x5, 0x4000) r5 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci\x00', 0x400000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r5, 0x40046205, 0x80) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') fsetxattr(r0, &(0x7f0000000180)=@known='trusted.overlay.metacopy\x00', &(0x7f00000001c0)='\\securitycpusetsystem\x00', 0x16, 0x2) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x3000000, 0x13f56576673f4ab4, r0, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r4, 0x541b, &(0x7f0000000300)) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x101003, 0x0) preadv(r4, &(0x7f0000000440)=[{&(0x7f0000001c00)=""/76, 0x307}, {&(0x7f0000001c80)=""/192}, {&(0x7f0000001d40)=""/220}, {&(0x7f0000000100)=""/50}], 0x1000022a, 0x0) 03:17:53 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) [ 3254.925195] audit: type=1804 audit(1551237473.353:53961): pid=29324 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5246/file0" dev="sda1" ino=18010 res=1 [ 3254.929618] binder: 29310:29320 ioctl c0306201 200002c0 returned -22 [ 3254.935328] audit: type=1800 audit(1551237473.353:53962): pid=29333 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=16884 res=0 03:17:53 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:17:53 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) [ 3255.060948] binder: 29310:29320 ioctl c028660f 200001c0 returned -22 [ 3255.094954] binder: 29310:29346 got reply transaction with no transaction stack 03:17:53 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3255.128371] audit: type=1804 audit(1551237473.353:53963): pid=29333 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7521/file0" dev="sda1" ino=16884 res=1 03:17:53 executing program 1: r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0x4a40) ioctl$VIDIOC_DECODER_CMD(r0, 0xc0485660, &(0x7f0000000200)={0x6, 0x0, @start={0x4, 0x1}}) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r3 = dup2(r1, r2) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000040)={0x0, r1, 0x6, 0x1, 0x10000, 0x10001}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:53 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\xff\xff\xf0\x00'}, 0x45c) 03:17:53 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:53 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0xfffffffffffffc00, 0x80000) ioctl$VIDIOC_SUBDEV_G_CROP(r0, 0xc038563b, &(0x7f0000000180)={0x1, 0x0, {0x800, 0x80000000, 0x1, 0x2}}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x800, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x3) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:53 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf4\xff\xff\xff\x00'}, 0x45c) [ 3255.261334] audit: type=1804 audit(1551237473.353:53964): pid=29333 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7521/file0" dev="sda1" ino=16884 res=1 03:17:53 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3255.328235] binder: 29365:29367 ioctl c028660f 20000040 returned -22 03:17:53 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) [ 3255.401264] binder: 29365:29380 got reply transaction with no transaction stack [ 3255.426432] audit: type=1804 audit(1551237473.393:53965): pid=29334 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5246/file0" dev="sda1" ino=18010 res=1 [ 3255.429672] binder: release 29365:29367 transaction 6234 in, still active 03:17:53 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x2, 0x12, r1, 0xa) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x7f, 0x80) dup3(r0, r0, 0x80000) 03:17:53 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000180)={{{@in6, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}}}, &(0x7f0000000040)=0xe8) connect$packet(r1, &(0x7f0000000280)={0x11, 0x1f, r3, 0x1, 0x47, 0x6, @broadcast}, 0x14) preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:54 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3255.524359] audit: type=1804 audit(1551237473.403:53966): pid=29330 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4887/file0" dev="sda1" ino=18016 res=1 [ 3255.545055] binder: send failed reply for transaction 6234 to 29365:29367 03:17:54 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf5\xff\xff\xff\x00'}, 0x45c) [ 3255.605792] binder: undelivered TRANSACTION_COMPLETE [ 3255.625270] audit: type=1804 audit(1551237473.403:53967): pid=29337 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4887/file0" dev="sda1" ino=18016 res=1 03:17:54 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x01\x00'}, 0x45c) [ 3255.658533] binder_alloc: 29394: binder_alloc_buf, no vma [ 3255.672081] audit: type=1804 audit(1551237473.413:53968): pid=29333 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7521/file0" dev="sda1" ino=16884 res=1 03:17:54 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) ioctl$KVM_GET_DEBUGREGS(r2, 0x8080aea1, &(0x7f0000000180)) [ 3255.718263] binder: 29394:29411 got reply transaction with no transaction stack 03:17:54 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:54 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3255.794262] binder_alloc: 29394: binder_alloc_buf, no vma [ 3255.798299] audit: type=1804 audit(1551237473.413:53969): pid=29338 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7521/file0" dev="sda1" ino=16884 res=1 [ 3255.837099] binder: 29394:29411 got reply transaction with no transaction stack 03:17:54 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\xff\x00'}, 0x45c) 03:17:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = dup2(r0, r0) getsockopt$inet_sctp_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f00000000c0)=@assoc_value={0x0, 0xffffffff}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000180)={0x7, 0x8, 0xd00e, 0x0, r3}, &(0x7f0000000200)=0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:54 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:54 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x18d800, 0x0) ioctl$NBD_DO_IT(r1, 0xab03) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3255.970302] audit: type=1800 audit(1551237473.513:53970): pid=29349 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=18011 res=0 03:17:54 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:54 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) [ 3256.056993] binder_alloc: 29435: binder_alloc_buf, no vma [ 3256.082016] binder: send failed reply for transaction 6245 to 29435:29437 03:17:54 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:54 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3256.120737] binder_alloc: binder_alloc_mmap_handler: 29435 20001000-20004000 already mapped failed -16 [ 3256.155989] binder: BINDER_SET_CONTEXT_MGR already set [ 3256.156006] binder_alloc: 29435: binder_alloc_buf, no vma 03:17:54 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:54 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 3256.185894] binder: 29435:29437 ioctl 40046207 0 returned -16 03:17:54 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) [ 3256.279293] binder: 29435:29468 got reply transaction with no transaction stack [ 3256.309601] binder: undelivered TRANSACTION_COMPLETE 03:17:54 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0x400) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000400)={0x2, 0x0, [{0x1f002, 0xbc, &(0x7f00000002c0)=""/188}, {0xf004, 0xe0, &(0x7f0000000700)=""/224}]}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0063404000000400000000000000b0faf9e1106806bc530a70870000000000000000000000000000000000000000e7000000000000000000000000000000000000000000000000000000000000000000467b88d92ee8bb62e737e02b98e5779d10b6b3b6dac61acc8f5c6f027d74ba845e946327b153dcbcaf7e59167dd0025c675f25d891"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0xc0, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0c6300109d46bbf71c1e283089a37b744ea9183ab51cdfd38dff2e0ef4f8d1e2eeff61a85275424570eb7499f8611e82f4eca100fd05000000c54eb9dd07df2f9521050076095b882455f9859bc9505d9ed40c9248fa24efbcea0bdfac649fd87b91333e0a323854f627eab3e42c6280929a29a84a57826a01bacb91bb02ec7c816cae8d913cf0d175e46836a4fbc00eb65d57925b7d416e8fdb2400000000fb350600000000988571e4afcff4333c3c0e000000000000000000000000000000"], 0x17b, 0x0, &(0x7f0000000800)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d180279169689325986d770e08cbee9be687109c49665c2afb6b33de7db89481f14936ccea373ba513e407ad96fd1cb869e217a7ee32dde5f3ecb1abc831c61460f834e5c33525dabaf4bf2e3cac68b6773dd006cc81264ad3eba4b2d52b01c7a5b4738efdfe9a85ecc4d407862ddf029595571de0fab6e182cc0c8a583ca4f56d9193624f155ddce1782b0e4da13eb8ffa5b9e601e302f31300fcdf418cf91d6b4d54fe94bb3da721d55c7960e2a6ac61180456c98725e2eb06af6e85bbcc28bbcb344c73be16bdb74359538b8132e73e6136b9e70e33f9b01e440e8773c587a9b7fb2b9efb148f6e41696be8bd05e3f17dc4780d2952e5ae171129a7326739a896938835583711eae88520b733a31ea5cbecafab904e88622acbb9560a286b3539d9e06f86ae23bef0a1fa706398e966d79325be2"}) r3 = dup2(r1, r0) getsockopt$netrom_NETROM_N2(r3, 0x103, 0x3, &(0x7f0000000100)=0x8000, &(0x7f0000000180)=0x4) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgroups(0x1, &(0x7f0000000040)=[r4]) r5 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x100, 0x0) ioctl$LOOP_SET_FD(r5, 0x4c00, r1) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r5, 0xc058534f, &(0x7f00000009c0)={{0x100, 0x1}, 0x0, 0x6, 0x2, {0x1, 0x7}, 0x401, 0x8000}) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000480)={0x0, 0x9}, &(0x7f00000004c0)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r5, 0x84, 0x1b, &(0x7f00000005c0)={r6, 0xe, "387014eb0c4d7b6332ee1164a716"}, &(0x7f0000000980)=0x16) 03:17:54 executing program 4: syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x1, 0x200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:54 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:54 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:54 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00'}, 0x45c) [ 3256.466599] binder: 29484:29487 got transaction to invalid handle [ 3256.522077] binder: 29484:29493 unknown command 268460812 [ 3256.550963] binder: 29484:29493 ioctl c0306201 20000140 returned -22 03:17:55 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:17:55 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair(0x1d, 0x80000, 0xffff, &(0x7f0000000040)) ioctl$VIDIOC_G_STD(r1, 0x80085617, &(0x7f0000000200)=0x0) ioctl$VIDIOC_S_STD(r1, 0x40085618, &(0x7f0000000240)=r2) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000000180)={0x0, 0xd7, 0x20, 0x6}, &(0x7f00000001c0)=0x18) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000580)={0x5, 0x0, [{0x0, 0x59, &(0x7f0000000280)=""/89}, {0x0, 0x7c, &(0x7f0000000300)=""/124}, {0x3000, 0x1f, &(0x7f0000000380)=""/31}, {0x6000, 0x45, &(0x7f00000003c0)=""/69}, {0x2, 0xba, &(0x7f0000000440)=""/186}]}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x7fff) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r3, &(0x7f00000007c0)=[{&(0x7f0000000800)=""/104, 0x68}, {&(0x7f0000000700)=""/23, 0x17}, {&(0x7f0000000740)=""/83, 0x53}], 0x1000000000000079, 0x4000000000000) 03:17:55 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3256.574449] binder: 29484:29487 got reply transaction with no transaction stack [ 3256.588368] binder_transaction: 16 callbacks suppressed [ 3256.588382] binder: 29484:29487 transaction failed 29201/-71, size 0-0 line 2801 [ 3256.638333] binder_alloc: binder_alloc_mmap_handler: 29484 20001000-20004000 already mapped failed -16 03:17:55 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:55 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) [ 3256.683658] binder: 29484:29493 got transaction to invalid handle [ 3256.707575] binder: BINDER_SET_CONTEXT_MGR already set [ 3256.715972] binder: 29484:29487 ioctl 40046207 0 returned -16 [ 3256.728037] binder: 29484:29493 transaction failed 29201/-22, size 0-15138816 line 2896 [ 3256.758897] binder: 29484:29487 unknown command 268460812 [ 3256.765798] binder: 29484:29493 got reply transaction with no transaction stack [ 3256.785129] binder: 29484:29487 ioctl c0306201 20000140 returned -22 03:17:55 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3256.837290] binder: 29484:29493 transaction failed 29201/-71, size 0-0 line 2801 03:17:55 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000580)={0x0, 0x5, 0x7, 0x0, 0x0, 0x1ff}, &(0x7f00000005c0)=0x14) setsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000600)={r3, 0x6}, 0x8) ioctl$BLKSECDISCARD(r1, 0x127d, &(0x7f0000000040)=0x3) pwritev(r0, &(0x7f0000000440)=[{&(0x7f0000000180)="026b4675c6f018e74b7fe777d607ff97e2fb1d91f655fb510c4f4f", 0x1b}, {&(0x7f00000001c0)="6cbd62fa789495b815bec06a0f7952ba7f9a2f1e21aa8ee4effe174cb148587bf74833eeecf41a7e2389d80554441a58a9e5212756528bfdc858c387491bf952462e1c430e9cf70ce1617335cd9707443c99360f969e70da0ca0af2b504999", 0x5f}, {&(0x7f0000000240)="fb6c1a2cbc5e83d78513e6ded9ccae60e9d339e45ac3659065b1da1f2944346cb94063375218c7b6b52898bac9b72a78eecbd19702f8b566f9a04941cced884fa8e36e", 0x43}, {&(0x7f00000002c0)="70cc4ef48b287fa59a0ef5373e8df0b80b4edea8f0c9ce611511033de93fc6d7fa68e15594f750edbe995b69621ff550e6c9506bfe19350486366cb95183dd725e51526270be9964f2f18369c300ba854aebca5910170150f3dbf32d5eb2a08c6f64c5dca1362cf14faf8438e962fe03d56de626a8931a395a29bf2f09b3495e2a5fd29080cb2544df7a6719671e93a5027f1978d513ea9d05b3ab1b3473d0b83cef7c7d79e6d3f6b8b0ca8e8b93d445dd6305a3cc3a44f720d7106977e439b5d0fbf5a9c806aca576b288f50cf6e757837d2c0e91dd16d413bb29c124886d4e4a81f4a4acf2a245e4dafef2f6bcfc7c1794cf", 0xf3}, {&(0x7f00000003c0)="43eb784acbc93786b8489129dd2c7f03c88ce3bbd58512106d08f4388bdbf0b1a40c2acc3c0a397f7f70da484e5df83c08d0c721465ffa7e4a4cf265b02e05201de23a", 0x43}], 0x5, 0x0) ioctl$KVM_SET_DEBUGREGS(r1, 0x4080aea2, &(0x7f00000004c0)={[0x1000, 0x3005], 0x81, 0x10, 0x8}) 03:17:55 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:55 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf4\x00'}, 0x45c) 03:17:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, 0xfffffffffffffffe, 0x30000, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x2, 0x20}, &(0x7f0000000040)=0xc) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000200)={r2, @in6={{0xa, 0x4e22, 0x80, @mcast1, 0x8000}}}, &(0x7f0000000100)=0x84) setxattr$trusted_overlay_nlink(&(0x7f0000000440)='./file0\x00', &(0x7f0000000580)='trusted.overlay.nlink\x00', &(0x7f00000005c0)={'L+', 0x9}, 0x28, 0x2) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000180)=ANY=[@ANYRES32=r3, @ANYRESDEC=r0], &(0x7f00000002c0)=0x2) setsockopt$netrom_NETROM_T1(r1, 0x103, 0x1, &(0x7f0000000400)=0x64ac, 0x4) perf_event_open$cgroup(&(0x7f0000000500)={0x7, 0x70, 0x200, 0x7fffffff, 0x9, 0x400, 0x0, 0x9, 0xc0010, 0x1, 0x259, 0x3, 0xc, 0x7, 0x1, 0x3, 0x8, 0x40, 0x2, 0x7, 0x3cc, 0x0, 0x15, 0x7, 0x9, 0x98b0, 0x7, 0x1, 0x8001, 0x5, 0xffffffffffffffdc, 0x4434, 0x3e343841, 0x0, 0x1, 0x9, 0xcc, 0x100, 0x0, 0x2, 0x1, @perf_config_ext={0x7fffffff, 0x9}, 0x800, 0xfffffffffffff801, 0x8000, 0x8, 0x2, 0x3ff, 0xfff}, r1, 0x2, r1, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r4) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:55 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:55 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3257.088437] binder: 29538:29541 got reply transaction with bad transaction stack, transaction 6255 has target 29538:29541 [ 3257.122406] binder: 29538:29541 transaction failed 29201/-71, size 0-0 line 2816 03:17:55 executing program 4: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r1, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x3, &(0x7f0000000040)=0x3) 03:17:55 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) 03:17:55 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3257.161615] binder: BINDER_SET_CONTEXT_MGR already set [ 3257.169995] binder: 29538:29552 ioctl 40046207 0 returned -16 [ 3257.178772] binder: release 29538:29541 transaction 6255 in, still active [ 3257.211351] binder: 29538:29541 transaction failed 29189/-22, size 0-0 line 2896 [ 3257.214311] binder: send failed reply for transaction 6255 to 29538:29541 03:17:55 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:55 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x100, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000440)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @loopback}}, 0x0, @in=@multicast2}}, &(0x7f00000002c0)=0xe8) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, 0x5) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000300)={@rand_addr="6268a860c4e840542d7619c82fcfdf27", r2}, 0x14) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, &(0x7f0000000180)={0x9, 0x7fffffff, 0x7fffffff, 0x403}) openat$audio(0xffffffffffffff9c, &(0x7f0000000340)='/dev/audio\x00', 0x1, 0x0) r3 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0xffffffffffff05a7) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='autogroup\x00') preadv(r4, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000400)='/proc/self/net/pfkey\x00', 0x80200, 0x0) 03:17:55 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3257.254609] binder: 29538:29552 transaction failed 29201/-71, size 0-0 line 2801 03:17:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$tipc(&(0x7f0000000000)='TIPC\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 3257.362261] binder: undelivered TRANSACTION_COMPLETE 03:17:55 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) 03:17:55 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:17:55 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:55 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000280)='/dev/cec#\x00', 0x3, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000002c0)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000340)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0x100, @mcast1, 0x3f}, {0xa, 0x4e23, 0x1f, @local, 0x400}, r2, 0x3f}}, 0x48) r3 = fcntl$dupfd(r0, 0x0, r0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20010000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4040004) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r3, 0x84, 0x6c, &(0x7f0000000180)={0x0, 0x3d, "4a3b73655016f4e468c325238a8225949dfc983e8faaa06233a642e32e96d80d90a7589519d146a15e31c0dde91d3422be3fe157d534e79927f26d0b88"}, &(0x7f0000000200)=0x45) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000240)={r5, 0x8}, 0x8) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r6, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r6, 0xc0305710, &(0x7f0000000040)={0x1, 0xffffffff, 0x100000001, 0xa6ab}) [ 3257.437181] binder: 29575:29579 got reply transaction with bad transaction stack, transaction 6260 has target 29575:29579 03:17:55 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3257.501459] binder: 29575:29579 transaction failed 29201/-71, size 0-0 line 2816 [ 3257.556959] binder: release 29575:29579 transaction 6260 in, still active [ 3257.574487] binder_alloc: 29575: binder_alloc_buf, no vma [ 3257.594692] binder: send failed reply for transaction 6260 to 29575:29579 03:17:56 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x40, 0x0) getsockname$inet(r1, &(0x7f0000000180)={0x2, 0x0, @multicast2}, &(0x7f00000001c0)=0x10) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:56 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) [ 3257.612118] binder: 29575:29593 transaction failed 29189/-3, size 0-0 line 3035 [ 3257.646690] binder: 29575:29606 transaction failed 29201/-71, size 0-0 line 2801 03:17:56 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:56 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:56 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2c630050324d5ae50b6ac57b5694fa78418e5576ca571e85d9750d06332864db72f42131ca851dd7eabd80a0912ca4118669288bfaa6412749a6612f5402e971184e96b15134def35ff5867f0197542c50f4fc0930b11127018ed8cb2fd7e3084b6a87b7aa92ef5558f1af3d089dfaa1226cb8b7c4e51147d9"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$EVIOCGID(r2, 0x80084502, &(0x7f0000000080)=""/19) 03:17:56 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3257.812932] binder: undelivered TRANSACTION_COMPLETE 03:17:56 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = syz_open_dev$cec(&(0x7f0000000240)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$IOC_PR_PREEMPT(r1, 0x40046109, &(0x7f0000000040)={0x10}) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:56 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:17:56 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:56 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) [ 3257.931762] binder: 29631:29635 unknown command 1342202668 [ 3257.947437] binder: 29631:29635 ioctl c0306201 20000140 returned -22 03:17:56 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:17:56 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') ioctl$KVM_ENABLE_CAP_CPU(r1, 0x4068aea3, &(0x7f0000000180)={0x7b, 0x0, [0x8, 0x0, 0x5d7, 0x3]}) preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x1e2, 0x0) [ 3258.026170] binder: 29631:29635 got reply transaction with bad transaction stack, transaction 6266 has target 29631:0 03:17:56 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:56 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3258.071913] binder: 29631:29654 ioctl 80084502 20000080 returned -22 [ 3258.110748] binder: 29631:29635 transaction failed 29201/-71, size 0-0 line 2816 03:17:56 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:56 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r0) r3 = request_key(&(0x7f0000000180)='ceph\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)='\x00', 0xfffffffffffffffe) keyctl$update(0x2, r3, &(0x7f0000000240), 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000240)={[{0x0, 0x1, 0xffffffff, 0x8, 0x34bfab, 0x4, 0x3, 0x3, 0x1e000, 0x80, 0x5, 0x8, 0x9}, {0x401, 0x8, 0xb2, 0x10001, 0x4, 0x2, 0x0, 0x5, 0x1f, 0x8, 0x0, 0x100000000, 0x1}, {0x34a, 0x8001, 0x1, 0x1, 0x3, 0x9, 0x0, 0x4000000000000000, 0x4, 0x2d, 0x6, 0x0, 0x22}], 0x1}) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') ioctl$VIDIOC_G_STD(r1, 0x80085617, &(0x7f0000000040)) preadv(r4, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3258.177214] binder: send failed reply for transaction 6266 to 29631:29635 [ 3258.184735] binder_alloc: 29631: binder_alloc_buf, no vma [ 3258.220460] binder: 29631:29635 unknown command 1342202668 [ 3258.226592] binder: 29631:29635 ioctl c0306201 20000140 returned -22 [ 3258.266554] binder: 29631:29668 ioctl 80084502 20000080 returned -22 [ 3258.311757] binder_release_work: 30 callbacks suppressed [ 3258.311764] binder: undelivered TRANSACTION_ERROR: 29189 03:17:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r2, 0xc040564b, &(0x7f0000000000)={0x100000001, 0x0, 0x1016, 0x8, 0x5, {0xf2a, 0x4}}) 03:17:56 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00'}, 0x45c) 03:17:56 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:56 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:56 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) [ 3258.373289] binder: undelivered TRANSACTION_COMPLETE [ 3258.378501] binder: undelivered TRANSACTION_ERROR: 29201 [ 3258.389025] binder: undelivered TRANSACTION_ERROR: 29189 03:17:56 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) r3 = getpgid(0x0) r4 = syz_open_procfs(r3, &(0x7f0000000040)='mounts\x00') ioctl$VIDIOC_QUERYMENU(r4, 0xc02c5625, &(0x7f0000000180)={0x4, 0x0, @value=0x10001}) 03:17:56 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3258.481025] binder: 29686:29693 got reply transaction with bad transaction stack, transaction 6271 has target 29686:29693 03:17:56 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) 03:17:57 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:17:57 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) [ 3258.573717] binder: 29686:29693 ioctl c040564b 20000000 returned -22 [ 3258.595550] binder: BINDER_SET_CONTEXT_MGR already set 03:17:57 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fcntl$getownex(r1, 0x10, &(0x7f0000000280)={0x0, 0x0}) r3 = syz_open_procfs(r2, &(0x7f0000000240)='net/anycast6\x00') prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f00000001c0), &(0x7f0000000200)=0x4) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000180)={r4, r5/1000+10000}, 0x10) [ 3258.626798] binder: 29686:29709 ioctl 40046207 0 returned -16 [ 3258.626820] binder: release 29686:29693 transaction 6271 in, still active [ 3258.644309] binder: send failed reply for transaction 6271 to 29686:29693 [ 3258.656716] binder: 29686:29715 ioctl c040564b 20000000 returned -22 03:17:57 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3258.736058] binder: undelivered TRANSACTION_ERROR: 29201 [ 3258.756802] binder: undelivered TRANSACTION_ERROR: 29189 03:17:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:57 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\\\x00'}, 0x45c) [ 3258.786752] binder: undelivered TRANSACTION_COMPLETE [ 3258.792925] binder: undelivered TRANSACTION_ERROR: 29201 [ 3258.802877] binder: undelivered TRANSACTION_ERROR: 29189 03:17:57 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop-control\x00', 0x80000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:57 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:57 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:17:57 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3258.867736] binder: 29730:29736 got reply transaction with bad transaction stack, transaction 6276 has target 29730:29736 [ 3258.944032] binder: BINDER_SET_CONTEXT_MGR already set [ 3258.978747] binder: release 29730:29736 transaction 6276 in, still active [ 3258.986418] binder: 29730:29736 ioctl 40046207 0 returned -16 03:17:57 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0xfffffffffffffffc, r0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r2, 0x800c6613, &(0x7f0000000200)={0x0, @aes128, 0x3, "7cfa8782575a397f"}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xfe) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='\x03f\xecUR\x1c\b0[onet/llc\x00') bind$unix(r0, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f00000001c0)={'rose0\x00', 0x400}) preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:57 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00'}, 0x45c) [ 3258.997487] binder: send failed reply for transaction 6276 to 29730:29736 [ 3259.025840] binder: undelivered TRANSACTION_ERROR: 29189 03:17:57 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:17:57 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) inotify_init1(0x80000) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x81, 0x0) dup2(r0, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:57 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:57 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$TIPC_SRC_DROPPABLE(r1, 0x10f, 0x80, &(0x7f0000000040)=0x50d1df8a, 0x4) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) ioctl$SIOCX25SENDCALLACCPT(r2, 0x89e9) [ 3259.150805] binder: undelivered TRANSACTION_COMPLETE [ 3259.155950] binder: undelivered TRANSACTION_ERROR: 29201 [ 3259.176330] binder: undelivered TRANSACTION_ERROR: 29189 03:17:57 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) [ 3259.230129] binder_alloc: 29767: binder_alloc_buf, no vma 03:17:57 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:57 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3259.290749] binder: send failed reply for transaction 6280 to 29767:29773 [ 3259.317863] binder_alloc: binder_alloc_mmap_handler: 29767 20001000-20004000 already mapped failed -16 03:17:57 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) socket$vsock_dgram(0x28, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:57 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:57 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) [ 3259.390719] binder: BINDER_SET_CONTEXT_MGR already set [ 3259.396041] binder: 29767:29773 ioctl 40046207 0 returned -16 03:17:57 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) [ 3259.481237] binder_alloc: 29767: binder_alloc_buf, no vma [ 3259.501187] binder_transaction: 3 callbacks suppressed [ 3259.501196] binder: 29767:29786 got reply transaction with no transaction stack 03:17:58 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3259.545155] binder: undelivered TRANSACTION_COMPLETE 03:17:58 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000000)={0x0, 0x4, 0x85, 0x5}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000100000000004000000000000000000000000000090000000000000000000000000000000000000000000000000000005f1d000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:58 executing program 4: socket(0x19, 0x8000f, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) getpeername$packet(r1, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000004c0)=0x14) sendmsg$xdp(r1, &(0x7f0000000600)={&(0x7f0000000500)={0x2c, 0x4, r2, 0xc}, 0x10, &(0x7f00000005c0)=[{&(0x7f0000000580)="42aeeb3397f028213708ec090b94267b2cacc1434e9f62e9f062bc220bbdbc21f0975d3868", 0x25}], 0x1, 0x0, 0x0, 0x800}, 0x840) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:58 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00'}, 0x45c) 03:17:58 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}, 0x45c) 03:17:58 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:58 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:58 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$security_ima(r1, &(0x7f0000000040)='security.ima\x00', &(0x7f0000000180)=@v2={0x5, 0x3, 0x3, 0x0, 0x40, "598d3ad5615ff4a6e3ecf846fb8889533e0b6a47b6f8a7d4e87b6d1e939b59f1122358f3e1279a10e895b29eaaf92834074e169d508c2cfb2057945e40c16190"}, 0x4a, 0x2) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000200)={0x0, 0x1}) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3259.778341] binder: 29833:29836 ioctl 40305828 20000000 returned -22 [ 3259.779141] binder: 29833:29836 got reply transaction with bad transaction stack, transaction 6285 has target 29833:29836 03:17:58 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:17:58 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3259.886401] binder: release 29833:29836 transaction 6285 in, still active [ 3259.909170] binder: send failed reply for transaction 6285 to 29833:29836 [ 3259.909450] binder: 29833:29849 ioctl 40305828 20000000 returned -22 03:17:58 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000240)='\x8f\xfd\xfe\x87\xdc\x94oR$\x9aA\x90F3/3\x103a\xe5%\x98H\xa6\x9e\xed\xf2\nf)\xa4\xd9N\x81\xbb\xd2&\x89ah//\xde\x13\x0fl\xbd\xb1\xae\xa9\xdd\xb7\xc0H\x02V0j1g\xa3\xc3||_j\xeb:\x96\x83\b!\x01\xf5\xf9yW947\x85\xbc0$\xdcr\x1cAO\xb8]8\x15\x8c\xac|z4\xe2^\xa8\xa5s\xca\v\xe3\x8e\xf1,\x9d\x9d\xb1\xe7F\x9c\xb4\xf0\x99\xc2\x8c\xeeS\x94y\x96\xfe\xa1\x03\xab\x8eR\xc2\xb2A\x1b\xc2\xc6\x1d=\v\xe5\xcbT\xa8r\xbd\xdd\x98\xdcQ%Wa\xb9\xeb\xe50\x16{\xff\xa9E') write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r2, &(0x7f00000000c0)={0x12, 0x10, 0xfa00, {&(0x7f0000000000), r3, r1}}, 0x18) [ 3259.949569] kauditd_printk_skb: 292 callbacks suppressed [ 3259.949581] audit: type=1800 audit(1551237478.373:54263): pid=29853 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=16663 res=0 [ 3259.988444] binder_alloc: 29833: binder_alloc_buf, no vma 03:17:58 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) [ 3259.990792] binder: 29833:29859 got reply transaction with no transaction stack [ 3260.013966] audit: type=1800 audit(1551237478.393:54264): pid=29857 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=18015 res=0 03:17:58 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) [ 3260.082213] audit: type=1804 audit(1551237478.413:54265): pid=29853 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4907/file0" dev="sda1" ino=16663 res=1 03:17:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400000, 0x0) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000040)=0x5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:58 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:17:58 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:58 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket(0x1, 0x80000, 0x5) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x1b, "62dbeb8552350766f28c2694552bcf370651a5093b5ded9f7690b5"}, &(0x7f0000000180)=0x23) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f00000001c0)={r2, 0x26, "ffefc9340c62c491ad94b8258bc3778426a734d4a652597111895aea26bc6f46a8c3aecb9057"}, &(0x7f0000000200)=0x2e) r3 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r4, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3260.135925] binder: undelivered TRANSACTION_COMPLETE [ 3260.213838] audit: type=1804 audit(1551237478.413:54266): pid=29853 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4907/file0" dev="sda1" ino=16663 res=1 [ 3260.253510] audit: type=1804 audit(1551237478.423:54267): pid=29857 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5268/file0" dev="sda1" ino=18015 res=1 [ 3260.256347] binder: 29875:29882 got reply transaction with bad transaction stack, transaction 6291 has target 29875:29882 [ 3260.277370] audit: type=1804 audit(1551237478.423:54268): pid=29857 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5268/file0" dev="sda1" ino=18015 res=1 03:17:58 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) [ 3260.313054] audit: type=1804 audit(1551237478.443:54269): pid=29853 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4907/file0" dev="sda1" ino=16663 res=1 [ 3260.340366] audit: type=1804 audit(1551237478.443:54270): pid=29862 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir032924171/syzkaller.nMAygB/4907/file0" dev="sda1" ino=16663 res=1 03:17:58 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:58 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000340)='dns_resolver\x00', &(0x7f0000000380)=@builtin='builtin_trusted\x00') r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r1, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x80, r4, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}]}, @TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1592}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MEDIA={0x30, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_TOL={0x8}]}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x4000004}, 0x10) preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:58 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:17:58 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00'}, 0x45c) [ 3260.493467] audit: type=1804 audit(1551237478.473:54271): pid=29857 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5268/file0" dev="sda1" ino=18015 res=1 03:17:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) socket$inet(0x2, 0x80805, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) r3 = geteuid() getresgid(&(0x7f0000000040), &(0x7f0000000180), &(0x7f00000001c0)=0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000004c0)='fou\x00') getsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000500)={0x0, 0x1}, &(0x7f0000000740)=0x8) setsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000780)=@assoc_value={r6, 0x4}, 0x8) sendmsg$FOU_CMD_ADD(r2, &(0x7f00000005c0)={&(0x7f0000000480), 0xc, &(0x7f0000000580)={&(0x7f0000000700)=ANY=[@ANYBLOB="30000077a69d8e031100", @ANYRES16=r5, @ANYBLOB="100526bd7000fedbdf25010000000800040002000000080002000a0000000400050004000500"], 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) sendmsg$nl_route(r1, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000680)={&(0x7f00000007c0)=ANY=[@ANYBLOB="14acb9e6a56e0cb91bd0561361edde00df1f938cc86e0307d36fcc9aa60df8fa533f0730d2afd3d363349797f9b93c58b340f22d61d5d0ca0f40216d52416eec0098b76ef114976d2d78c54763a8b0fe0ebcc1755de94d6ddbae068ab6297328cd6e64279b629c77daca60c2a356da976a60ace1a966d81e5b0fa1e398945c94e2218d7e46a68cf6cd5a3192011f46435f09885f9295e6677d0da91680193200f088ca6343d20242e31a948f5c5e7dcde9a0aa11fb7c9d30c39f0fbebb3fec13b62a6c0bd332a5e9dc58"], 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x800) ioctl$VIDIOC_SUBDEV_G_EDID(r2, 0xc0285628, &(0x7f0000000440)={0x0, 0x20, 0x7, [], &(0x7f0000000400)=0x100000001}) fstat(r1, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="50010000ffffffff0500000000000000000000000000000003000000000000000700000000000000f80b000000000000010400000200000002000000000000009f000000000000000100000000000000080000000000000007000000000000000200000000000000ff070000656d000005000000800000007f000000", @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="730100000200000000000000010000000000000001000100000000000c00000020000000766d6e6574316d643573756d0000000005000000000000000300000000000000ff0ffaffffff00005bf0ffffffffffffffffff7f0400000002000000000000001e0800000000000000000000000000000000008000000000080000000000000009000000000000000300000001000100ff0f00006100000000000000", @ANYRES32=r7, @ANYRES32=0xee01, @ANYBLOB="0400000007000000000000000500000000000000fffffffffeffffff0000000000000100"], 0x150) 03:17:59 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:59 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) [ 3260.556720] audit: type=1804 audit(1551237478.473:54272): pid=29863 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5268/file0" dev="sda1" ino=18015 res=1 [ 3260.566637] binder: release 29875:29882 transaction 6291 in, still active [ 3260.587970] binder_alloc: 29875: binder_alloc_buf, no vma [ 3260.675481] binder: send failed reply for transaction 6291 to 29875:29882 03:17:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000000200)) 03:17:59 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:17:59 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) 03:17:59 executing program 4: socketpair$unix(0x1, 0x400000005, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000180)=""/69) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000200)=0xc) getresgid(&(0x7f0000000240), &(0x7f0000000280)=0x0, &(0x7f00000002c0)) socket$key(0xf, 0x3, 0x2) write$P9_RGETATTR(r1, &(0x7f0000000300)={0xa0, 0x19, 0x2, {0x110, {0x9a, 0x4, 0x8}, 0x13, r3, r4, 0x401, 0x3, 0x6, 0x81, 0x3, 0x0, 0x7, 0x5, 0xffffffffffffff56, 0x8b9, 0x37, 0x3, 0x13b, 0x5f4c, 0xffffffff}}, 0xa0) preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3260.758458] binder: undelivered TRANSACTION_COMPLETE 03:17:59 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:59 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) [ 3260.808197] binder: 29927:29932 got reply transaction with bad transaction stack, transaction 6296 has target 29927:29932 03:17:59 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3260.885793] binder: 29927:29943 ioctl 4c05 20000200 returned -22 03:17:59 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf4\x00'}, 0x45c) 03:17:59 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3260.931512] binder: BINDER_SET_CONTEXT_MGR already set [ 3260.936835] binder: 29927:29932 ioctl 40046207 0 returned -16 [ 3260.946622] binder: release 29927:29932 transaction 6296 in, still active [ 3260.957509] binder: 29927:29951 ioctl 4c05 20000200 returned -22 [ 3260.968498] binder: send failed reply for transaction 6296 to 29927:29932 03:17:59 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:17:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f00000001c0), 0x1000000000000142, 0x0) 03:17:59 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:17:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x101000, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, r3, 0x400, 0x70bd25, 0x25dfdbfb, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x40) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:17:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_dccp(0xa, 0x6, 0x0) sendto$inet6(r1, &(0x7f0000000180)="3f58144da3b53c9dc40ecff14aa05d48b7333f23414cec9c5f9eda8ed4026449dd21533a16abb07ed40c4b9e553fd7af109d79f119f88f24a4043d685e7ef9b52cb6eac12812964d1c921fa74d6913ac7db3b4b01cbdbcfab7b3ab118f0e95b69095f426c1340a37e1d72d7fc8565855507cf9f50f44e918edc56b6b5d6cba2eac374e5b", 0x84, 0x4, &(0x7f0000000040)={0xa, 0x4e20, 0x5, @mcast2}, 0x1c) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:17:59 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3261.177039] binder: undelivered TRANSACTION_COMPLETE 03:17:59 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) 03:17:59 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) [ 3261.295442] binder: 29977:29980 got transaction to context manager from process owning it [ 3261.319336] binder: BINDER_SET_CONTEXT_MGR already set 03:17:59 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:17:59 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:17:59 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) [ 3261.352190] binder: 29977:29980 ioctl 40046207 0 returned -16 [ 3261.370063] binder: 29977:29994 got reply transaction with no transaction stack 03:17:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000040)={0x0, 0x7f}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00000001c0)={r4, 0x101, 0x20}, &(0x7f0000000200)=0xc) 03:17:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@decrefs={0x40046307, 0x3}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0163404000000000170000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 3261.485484] binder: release 29977:29988 transaction 6301 out, still active [ 3261.516504] binder: undelivered TRANSACTION_COMPLETE 03:17:59 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3261.532499] binder: send failed reply for transaction 6301, target dead 03:18:00 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:18:00 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:18:00 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00'}, 0x45c) [ 3261.598603] binder: 30013:30015 DecRefs 0 refcount change on invalid ref 3 ret -22 03:18:00 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:00 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e24, @remote}}}, &(0x7f0000000040)=0x84) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000240)={r2, 0x9}, 0x8) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f00000002c0)=0xdf6, 0x4) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)) preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3261.667630] binder: 30013:30025 got reply transaction with no transaction stack 03:18:00 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3261.710597] binder_transaction: 18 callbacks suppressed [ 3261.710613] binder: 30013:30025 transaction failed 29201/-71, size 0-0 line 2801 03:18:00 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3261.812770] binder: send failed reply for transaction 6304 to 30013:30015 [ 3261.825541] binder_alloc: 30013: binder_alloc_buf, no vma 03:18:00 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:18:00 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:18:00 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) ioctl$FIBMAP(r2, 0x1, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, 0x0) ioctl$DRM_IOCTL_SET_SAREA_CTX(r2, 0x4010641c, &(0x7f0000000380)={0x0, &(0x7f0000000300)=""/123}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) pipe(0x0) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000540)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x1c, &(0x7f0000000000), &(0x7f0000000040)=0x4) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r4, 0xc0305710, &(0x7f0000000100)={0x1, 0x3, 0x100000000}) sendmmsg(r3, &(0x7f0000005fc0), 0x8000000000000fc, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r5, 0x6685) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r6, 0x0) write$binfmt_misc(r6, &(0x7f00000005c0)=ANY=[@ANYBLOB="73797a05f484275e316a227f400942dfdafa911ffc7eb326cfa9538a448c71cbec499c6e94c91100e4aa7f714158c2bd8ecca6352a529af254e093f2b223d4510c89fc18fba17783c51a1db07d62001bc6732113fdcd9e9afe7c50f675d7dd3a466fd25a76a5ed798e91f12b8c33134206e7792a54f047e11fca330a3ea25c66ac8495d9a99b33803279acce9d67ebbabee3fd5270bc585c72d9ca33fddd1ace9f95013148d01247f04202c607f2b91891cdcd01e99d37f5106ca91737cfb9c3cf7a924f79f7a1a1fc9cf7a42037de1abb991a941f242bb071cc41724b78f06901b75b5b144cbf95eccb70c11c61e50fc74082"], 0xf3) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0xffff0000, 0x18, 0x1500, {0x0, &(0x7f0000000040), 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x1a000]}}, 0x95) r7 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) preadv(0xffffffffffffffff, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3261.856118] binder: 30013:30025 transaction failed 29189/-3, size 0-0 line 3035 [ 3261.925516] binder: 30013:30015 DecRefs 0 refcount change on invalid ref 3 ret -22 03:18:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:18:00 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:00 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3262.004925] binder: undelivered TRANSACTION_COMPLETE 03:18:00 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00'}, 0x45c) 03:18:00 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:18:00 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:00 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3262.174005] binder: 30069:30076 got reply transaction with bad transaction stack, transaction 6309 has target 30069:30076 [ 3262.207740] binder: 30069:30076 transaction failed 29201/-71, size 0-0 line 2816 [ 3262.243727] binder: release 30069:30076 transaction 6309 in, still active [ 3262.268857] binder_alloc: 30069: binder_alloc_buf, no vma [ 3262.286644] binder: send failed reply for transaction 6309 to 30069:30076 03:18:00 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:18:00 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3262.300336] binder: 30069:30083 transaction failed 29189/-3, size 0-0 line 3035 03:18:00 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:18:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x404000, 0x0) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x4, 0x4) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 3262.409494] binder: undelivered TRANSACTION_COMPLETE [ 3262.513026] binder: 30103:30108 got reply transaction with bad transaction stack, transaction 6314 has target 30103:30108 [ 3262.544571] binder: 30103:30108 transaction failed 29201/-71, size 0-0 line 2816 03:18:01 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000180)={{0x67, @multicast2, 0x4e23, 0x3, 'sed\x00', 0x2, 0x80, 0x4a}, {@multicast2, 0x4e21, 0x4, 0x81, 0xaf, 0x8}}, 0x44) 03:18:01 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:01 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:18:01 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:18:01 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) [ 3262.560733] binder: release 30103:30108 transaction 6314 in, still active [ 3262.567928] binder_alloc: 30103: binder_alloc_buf, no vma [ 3262.573584] binder: send failed reply for transaction 6314 to 30103:30108 [ 3262.626219] binder: 30103:30111 transaction failed 29189/-3, size 0-0 line 3035 03:18:01 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:01 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\\\x04\x00'}, 0x45c) [ 3262.670113] binder: 30103:30108 got reply transaction with no transaction stack [ 3262.706536] binder: 30103:30108 transaction failed 29201/-71, size 0-0 line 2801 03:18:01 executing program 4: r0 = syz_open_dev$vbi(&(0x7f0000000340)='/dev/vbi#\x00', 0x0, 0x2) ioctl$sock_x25_SIOCDELRT(r0, 0x890c, &(0x7f0000000200)={@remote={[], 0x2}, 0x9, 'tunl0\x00'}) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) getsockopt$llc_int(r1, 0x10c, 0x8, &(0x7f0000000040), &(0x7f0000000180)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:18:01 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9a\f\x00'}, 0x45c) 03:18:01 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = dup2(r0, r1) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 3262.881386] binder: undelivered TRANSACTION_COMPLETE 03:18:01 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000040)=[0x9, 0x163]) preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:18:01 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:18:01 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:18:01 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) [ 3262.949659] binder: 30153:30156 ioctl 541b 20000000 returned -22 [ 3262.976338] binder: 30153:30156 got reply transaction with bad transaction stack, transaction 6320 has target 30153:30156 03:18:01 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3263.035959] binder: 30153:30156 transaction failed 29201/-71, size 0-0 line 2816 03:18:01 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000580)={0x6, 0x0, [{0x4000, 0xdd, &(0x7f0000000180)=""/221}, {0x1000, 0x80, &(0x7f0000000280)=""/128}, {0x100004, 0x40, &(0x7f0000000040)=""/64}, {0xf000, 0xfd, &(0x7f0000000300)=""/253}, {0x4000, 0x74, &(0x7f0000000400)=""/116}, {0xd000, 0x96, &(0x7f0000000480)=""/150}]}) [ 3263.084819] binder: release 30153:30156 transaction 6320 in, still active [ 3263.093137] binder_alloc: 30153: binder_alloc_buf, no vma [ 3263.099916] binder: send failed reply for transaction 6320 to 30153:30156 [ 3263.122651] binder: 30153:30169 transaction failed 29189/-3, size 0-0 line 3035 03:18:01 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3263.134817] binder: 30153:30156 ioctl 541b 20000000 returned -22 03:18:01 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0xa, 0x3) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000040)=0x7, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0000000092e3e345683d11a95536bffc1ff782bd497c2443c49a06b3"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:18:01 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3263.222918] binder: undelivered TRANSACTION_COMPLETE 03:18:01 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000040)=0x0) r3 = syz_open_procfs(r2, &(0x7f0000000000)='net/protocols\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:18:01 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:18:01 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3263.353281] binder: 30190:30200 unknown command 0 [ 3263.358497] binder: 30190:30200 ioctl c0306201 20000140 returned -22 03:18:01 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:18:01 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) bind$unix(r0, &(0x7f00000001c0)=@file={0x0, './file0\x00'}, 0x6e) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000240)={0x40, 0x1}, 0x10) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000180)={0xfbf0000, 0x101, 0x5, [], &(0x7f0000000040)={0x99097f, 0x5, [], @p_u32=0xffffffffffffffff}}) [ 3263.395700] binder: 30190:30194 got reply transaction with no transaction stack 03:18:01 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) [ 3263.462829] binder: 30190:30194 transaction failed 29201/-71, size 0-0 line 2801 03:18:01 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:01 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:18:02 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:18:02 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) semget(0x1, 0x0, 0x5) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) accept$unix(r2, &(0x7f0000000180)=@abs, &(0x7f0000000040)=0x6e) semget(0x0, 0x3, 0x2) socket$vsock_dgram(0x28, 0x2, 0x0) [ 3263.563839] binder: BINDER_SET_CONTEXT_MGR already set [ 3263.603651] binder: send failed reply for transaction 6325 to 30190:30200 [ 3263.616200] binder: 30190:30200 ioctl 40046207 0 returned -16 [ 3263.616310] binder: 30190:30194 unknown command 0 [ 3263.680584] binder_release_work: 29 callbacks suppressed [ 3263.680591] binder: undelivered TRANSACTION_ERROR: 29189 [ 3263.681102] binder: 30190:30200 got reply transaction with no transaction stack [ 3263.686446] binder: 30190:30194 ioctl c0306201 20000140 returned -22 [ 3263.765481] binder: undelivered TRANSACTION_ERROR: 29201 03:18:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x2, 0x0, &(0x7f0000000300)=[@clear_death={0x400c630f, 0x2, 0x4}], 0xfffffffffffffd05, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:18:02 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:18:02 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000040)=0x20, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:18:02 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:02 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:18:02 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) [ 3263.820988] binder: undelivered TRANSACTION_ERROR: 29201 [ 3263.826505] binder: undelivered TRANSACTION_COMPLETE 03:18:02 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3263.872152] binder: undelivered TRANSACTION_ERROR: 29189 [ 3263.900791] binder: 30260:30262 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 03:18:02 executing program 4: r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/audio\x00', 0x0, 0x0) ioctl$TIOCNOTTY(r0, 0x5422) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x100ffe, 0x0) ioctl$BLKBSZGET(r2, 0x80081270, &(0x7f0000000180)) ioctl$IOC_PR_CLEAR(r2, 0x401070cd, &(0x7f0000000400)={0x9}) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000440)=0x9, 0x4) r3 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r4, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) write$UHID_CREATE2(r4, &(0x7f00000001c0)={0xb, 'syz0\x00', 'syz1\x00', 'syz1\x00', 0xba, 0x2, 0x2, 0x2, 0xff, 0x7, "1f4079162de669e6246d203a5962aedae3c6857d26b20ac98c11d836de7321bbdd00f5974e8eec29f0cd57e742d9cf29c712dcb994071548d84ad74dddedbe4d8098501032fddc0043de5338a23843af6717f3395d8817733d128b36f1037398adf5a786f7c71676b1824ed440412d579e16ac0f6a6b65a03b1fb07b3b2f22d49c55c232d4891626cf9fbc72653c25fe5ac15530211d922f06902f9bb36c0e29a93125cb2e25942916d358c5210ee30923afd12ca7165ab317bc"}, 0x1d2) [ 3263.930563] binder: 30260:30262 ioctl c0306201 20000000 returned -14 03:18:02 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:18:02 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:18:02 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3263.980983] binder: 30260:30262 got reply transaction with no transaction stack [ 3264.006908] binder_alloc: binder_alloc_mmap_handler: 30260 20001000-20004000 already mapped failed -16 03:18:02 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) [ 3264.067606] binder: BINDER_SET_CONTEXT_MGR already set [ 3264.111714] binder: 30260:30272 got reply transaction with no transaction stack [ 3264.117447] binder: 30260:30280 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 3264.164733] binder: undelivered TRANSACTION_ERROR: 29201 [ 3264.166793] binder: 30260:30280 ioctl c0306201 20000000 returned -14 [ 3264.177616] binder: 30260:30279 ioctl 40046207 0 returned -16 [ 3264.204294] binder: undelivered TRANSACTION_ERROR: 29201 03:18:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000000007a5eb142e7e5bce000000000000000021a2b4805e968b1029df24ccf5d411f375f4f258bc4482b8c1"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) stat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000980)={{{@in=@multicast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@empty}}, &(0x7f00000005c0)=0xe8) syz_mount_image$jfs(&(0x7f0000000180)='jfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x8, &(0x7f0000000840)=[{&(0x7f0000000240)="df41ba05443a9877cb1839d8ee3997425ecd00f057dd56", 0x17, 0x7}, {&(0x7f0000000280)="c8f11b9603c717d21da3e0b714c4dc82c5a6b37499c5e722338cc5f6af8785767e26a3b93ff4dd75f7280719b489014551c2a1259deb96d24411544a3500d379d0adefd2aebe18fee572ffefb0", 0x4d, 0x7f}, {&(0x7f0000000300)="bf866b965fc7a8df33c32aa9bb670c95d823edb6cb59aecff8f3b7af11f762c4c41194dd7d8f73110808795667561ac7d02bca3c", 0x34}, {&(0x7f0000000340)="0a96be40c79f3553c4d425442693a4f6549b6e73d82d", 0x16, 0x4358}, {&(0x7f0000000500)="2368d427b27bca9ed528a581e62d9a759b1cbd17ef7c449243828c6bbaf25094441c39f060af73519bc20578d3ed334fc187397eae254e0fc05fbbd3395dc9814d1542324eb46bd67f2486e131e5fd228c35b26360330a87df0844d8d617923b0899c99cdd7e9bbc1b1b0166d1effff35d53c7d2ae2fcbb8beec72f36c4096cc6f92b6ad2abfddc4ed5195466ce4", 0x8e, 0x2daf}, {&(0x7f0000000400)="d6087f7cf8bd9547f5", 0x9}, {&(0x7f0000000640)="08ed94ee2156f5c698f7d20f691ae20b314212381106c046a93afdc9884a11901c0b9d0dd574e335ce6c328c014fd980c524ba64f5b8fba21c879dba79acee5a8dd9f0b50f9fe9e3c1a52b9eb7e6b2a40588173be9e50e18c994283f86c99e30cec0c9aa74d34a03185b2de3f6fd835f3802d2d0e72aff386a591832baa946dee10dcc9a19e5d2b797618db47ba1455b80bae9f5fb545c8e702018ce5b24ac2c6556ce9d2220b913ebc8aa25be87372ddc40d5330f99807b52f712053dec8b47815e0d2685cf81b1fa8792c46ee3a2fba909f6d30c544c44394eb8186e9208ad86b7b2ea5c58", 0xe6, 0x750}, {&(0x7f0000000740)="272a83800327e98700a426d078e11c812b8520cd44ead82b4bbd9e75ccffd39ffaccc917b4c70a6a605edef542f5dfd9bab8c889b638a97a869e1773c0b1512b44a60ce35e981509d3ba0304d112a423b5c5f83335a2a8ce51dba09ba0ecabde0af1ac3c02f65aa9e8f664b20a4d457a4de4bbda6692a076255f6c4b2c3d94f8de9db9bc6224e44165dc203e77d47b13d2490bda4a3e915652322943fcf68a63279b2927b0247c90f85f01c30840756ba0a74d8deb4fefca01484d80c56113482a1af690f4b14322e8127a25f05c5c5fd25d2702ce84359c386ae68e", 0xdc, 0x80000000}], 0x1c50, &(0x7f0000000a80)={[{@errors_continue='errors=continue'}, {@usrquota='usrquota'}, {@noquota='noquota'}, {@errors_remount='errors=remount-ro'}, {@resize_size={'resize', 0x3d, 0x8}}, {@usrquota='usrquota'}, {@integrity='integrity'}, {@nodiscard='nodiscard'}, {@resize_size={'resize', 0x3d, 0x3}}, {@nointegrity='nointegrity'}], [{@euid_eq={'euid', 0x3d, r2}}, {@appraise='appraise'}, {@fowner_gt={'fowner>', r3}}, {@subj_user={'subj_user'}}]}) r4 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$TIOCGLCKTRMIOS(r4, 0x5456, &(0x7f0000000100)={0x6, 0x7, 0x4, 0x2, 0x15, 0x200, 0x0, 0x1, 0x7, 0x6, 0x0, 0x6}) 03:18:02 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:18:02 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:18:02 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:02 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:18:02 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:18:02 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3264.338854] binder_alloc: 30301: binder_alloc_buf size 9092227700026179584 failed, no address space 03:18:02 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) 03:18:02 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f0000000180)={0xf, 0x3, {0x57, 0x80000001, 0x9, {0x10001, 0x4}, {0x2f29, 0x1f}, @cond=[{0x1f, 0x8, 0xffffffffffffffea, 0x0, 0x7f, 0x81}, {0x400, 0x5b, 0x6, 0x80000001, 0x4}]}, {0x53, 0x80, 0x7, {0x400, 0xa0}, {0x6, 0x40}, @cond=[{0x3136, 0x6, 0xa931, 0x8, 0x8, 0xffffffffffffffff}, {0x60, 0x7, 0x4d8545dd, 0x1000, 0x4, 0x7fffffff}]}}) [ 3264.417701] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 03:18:02 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:18:02 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) [ 3264.458572] binder: undelivered TRANSACTION_ERROR: 29201 [ 3264.469832] binder: 30301:30310 got reply transaction with no transaction stack 03:18:03 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3264.528655] binder: 30301:30310 ioctl 5456 20000100 returned -22 [ 3264.605719] binder_alloc: binder_alloc_mmap_handler: 30301 20001000-20004000 already mapped failed -16 [ 3264.672081] binder: BINDER_SET_CONTEXT_MGR already set [ 3264.692861] binder: 30301:30310 ioctl 40046207 0 returned -16 [ 3264.709459] binder_alloc: 30301: binder_alloc_buf, no vma [ 3264.717350] binder: undelivered TRANSACTION_ERROR: 29189 [ 3264.723522] binder: 30301:30350 got reply transaction with no transaction stack [ 3264.731373] binder: 30301:30319 ioctl 5456 20000100 returned -22 [ 3264.733993] binder: undelivered TRANSACTION_ERROR: 29201 03:18:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0xfffffffffffffffc) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = creat(&(0x7f0000000a80)='./file0\x00', 0x8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000b00)={{{@in6=@mcast1, @in6=@ipv4={[], [], @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@initdev}}, &(0x7f0000000c00)=0xe8) sendmsg$nl_generic(r2, &(0x7f0000000f80)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x10220000}, 0xc, &(0x7f0000000f40)={&(0x7f0000000c40)={0x2fc, 0x3d, 0x200, 0x70bd2c, 0x25dfdbfb, {0x1a}, [@typed={0xc, 0x27, @u64}, @typed={0x14, 0x90, @binary="4c600721e030b8da7025c4c8c4ce"}, @typed={0x8, 0x19, @ipv4=@multicast2}, @typed={0x8, 0xc, @uid=r3}, @typed={0x8, 0x5, @u32=0x727c}, @nested={0x1e0, 0x94, [@typed={0x14, 0x5a, @ipv6=@mcast1}, @typed={0x8, 0x4e, @fd=r1}, @typed={0x8, 0x35, @u32=0x4}, @typed={0x14, 0x31, @str='/dev/binder#\x00'}, @generic="df8f5eed2a51e16ee9fa2eb3a1bee3be9ae1c01b8e6e13be2e6c0100c0c28584eadb30ecfe7d8dd05ea010ed07bae76287d3db728ba3eafd8fe28c1555165faf4bf764c999212a2a7bcf0df19a4043e7bc284e3e1e4568d9add8902c0d9f1343be898fbbb5ceb8eccbc47e977644aa61e37e376ffdacb59ef0aa2b009d00cbc5a6acf1478d893eb9529975dab35c10fbeb57d7fc0b93af86e0d18d2567b4a0d99c3d974f763c8b4239ba3470c9010f2d65db4a6163c85d312818a77e9cdb2d3ae9b4fc105ad7ef9de88097fdb03cabe2d00a576da7831824c3597e278a9e45612598aded40d1fd7ba4c2355c916a767c3e2f", @generic="7d4c84ad0965645a802e4dbc749878795081fb120146e8472a67f35cf1e76e4c347829be1667e050dbf31632a4e8f1dc72104fd361f57f8c4e51214e46e5194051acae144ed4abc210c1d798b9338a04d46dfe6e1dfb588b09283d0bbc76277ac1b172aa9608aa460786e26f4b07bbbe979326fdbdabaec0a738d6379336d383ed251ac695ce80d41ee703499e26a4e700d4deccdd796d17e9bae1217c80a70e794fb3492d3d44f9265ca3e785470e3716"]}, @generic="bc418a001ac5174eb86c33221937a5c257911438adca8e46eac11fdd9ecf816892", @nested={0xac, 0x3b, [@generic="37f7bfc8b04fd721616fab95d87f1a30c1e49b9e56f180fdf44176a2e40972a1d8cbb68ee02c6b0c4b8ece075dee797fb9067f415ac4f1ccc2a6c6cf35ed0681a72fc0e495f7862f98ab7d868e536f1a583839e60ab1ebc14a43c3d4e332138e219d283c8809faa664b371e342cfd1269b98c2f8f90d156406213f8b4ab00576450f5c8ece3b1996fc08cd6aa9a1785c309b6cd949aa692ac520c42f67962ad256c193febe6c"]}]}, 0x2fc}, 0x1, 0x0, 0x0, 0x4}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r4 = dup2(r0, r1) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0xa0, &(0x7f0000000200)=[@in={0x2, 0x4e21, @rand_addr=0x7360}, @in={0x2, 0x4e22, @local}, @in6={0xa, 0x4e24, 0x0, @mcast1, 0x4}, @in6={0xa, 0x4e20, 0x10001, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0xe}}, 0xa9}, @in6={0xa, 0x4e22, 0x5, @empty, 0x9}, @in6={0xa, 0x4e20, 0x3, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}, @in={0x2, 0x4e21, @empty}]}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r4, 0x84, 0x6c, &(0x7f0000000500)={r5, 0xf5, "509da13890ad111aa08732e549d1aaff799f63e27d1aff1fea17d73963ea86f49686570212abb8bf36f714306df29154f983a3368bc6920f383c6a02fda205164b69414667474182d32ae106e132ecf886ac0900b384c4f89834aa0e63ec5eacea4b7ca0c9a73b84fe9882619590d2d22b1c8b0dfa61c5cc430a171857a0996dff97553af0b647004c0187dbc9f5355bf26a57fc6227cd8095b693959d621d517fb047c4abc6133085e8d30589a15fe8c796e9a6e76912580f5f0a27474f2d6db29d3a3432740a0731c1e4a23b1432897d8b8d8f9cc95c09e953532f2043ef349bd50806f035315fae9149c913708d18cb75b412dd"}, &(0x7f0000000100)=0xfd) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:18:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000180)={r3, r4/1000+30000}, 0x10) flock(r2, 0x4) pipe(&(0x7f00000002c0)) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r2, 0x110, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') ioctl$sock_bt_bnep_BNEPCONNADD(r2, 0x400442c8, &(0x7f00000001c0)={r5, 0xff, 0x5, "c98512f706a703ed9a956fd81c66d1774aef58be314674f5923f6a39ec37f3f3b045a5b71f7b3cc6f81eccd43a2527a68c492c5e32e881491fd233901021a59436ca17497c25e3a92ea8e7b9a56228e92d8af27217029f3c15d824a1b4e7ac54cbdaea0ca8c1d3a88d223d6214e6727dce62b19f354c9036baf8f82156db9dd99d93f8ba37f55d78710913067bc0b842673bd99368110f1307534c56c0dc8af75fab04aca05718a678100376c369c132de7beabe494bff2cd7cc35cae5098bed36053ba925617028613cdd2a580b439c0dd708c5c6"}) preadv(r5, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:18:03 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:18:03 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\\\x00'}, 0x45c) 03:18:03 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:03 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) [ 3264.745433] binder: undelivered TRANSACTION_ERROR: 29201 03:18:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x3, 0x101000) mq_timedreceive(r2, &(0x7f0000000200)=""/133, 0x85, 0x22, 0x0) ioctl$VHOST_RESET_OWNER(r2, 0xaf02, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c630004"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:18:03 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000040), &(0x7f0000000180)=0x8) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r1, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:18:03 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) 03:18:03 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) 03:18:03 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x80\x00'}, 0x45c) [ 3264.930745] binder: 30371:30379 unknown command 67134220 03:18:03 executing program 4: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:18:03 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3264.996256] binder: 30371:30379 ioctl c0306201 20000140 returned -22 [ 3265.005592] kauditd_printk_skb: 298 callbacks suppressed [ 3265.005604] audit: type=1800 audit(1551237483.443:54571): pid=30387 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=18036 res=0 [ 3265.023833] binder: 30371:30390 got reply transaction with no transaction stack [ 3265.068611] binder_alloc: binder_alloc_mmap_handler: 30371 20001000-20004000 already mapped failed -16 03:18:03 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:18:03 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) [ 3265.111826] audit: type=1804 audit(1551237483.483:54572): pid=30395 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7561/file0" dev="sda1" ino=18036 res=1 [ 3265.137106] binder: BINDER_SET_CONTEXT_MGR already set [ 3265.143117] binder: 30371:30379 ioctl 40046207 0 returned -16 03:18:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') ioctl$VIDIOC_G_CROP(r2, 0xc014563b, &(0x7f0000000040)={0xb, {0x8, 0xb7, 0xf31a, 0x14}}) preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:18:03 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3265.216482] audit: type=1804 audit(1551237483.483:54573): pid=30387 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7561/file0" dev="sda1" ino=18036 res=1 [ 3265.247894] binder_alloc: 30371: binder_alloc_buf, no vma [ 3265.287760] binder: 30371:30390 unknown command 67134220 [ 3265.301880] binder: 30371:30390 ioctl c0306201 20000140 returned -22 [ 3265.324174] audit: type=1800 audit(1551237483.513:54574): pid=30394 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=18056 res=0 [ 3265.344481] binder: 30371:30379 got reply transaction with no transaction stack [ 3265.352577] binder: release 30371:30379 transaction 6340 out, still active [ 3265.362416] binder: undelivered TRANSACTION_COMPLETE [ 3265.384888] binder: send failed reply for transaction 6340, target dead [ 3265.394713] audit: type=1804 audit(1551237483.513:54575): pid=30394 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5289/file0" dev="sda1" ino=18056 res=1 03:18:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000deffffff00000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = dup2(r0, r1) getsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000000)=0x4, &(0x7f0000000040)=0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000100), &(0x7f0000000180)=0xc) 03:18:03 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:18:03 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:18:03 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x4001fd) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) write(r1, &(0x7f0000000240)="c3cc2c01801824fda3cd17684374c2bae4ed7ade44d92cf82d6da2c29b4e759d72cfb076c3d3ed70408e253178ce1d75c49897022b0cf7ba1edf013ef14b3c659f32a37df12d97836242bb1b9e873978a4aca353150c5766311f55a43250e91a1b0b1246507d9f92849cb83608814ed20fa111f65fd60691f2e9cee7b5e7f2fb46", 0x14) 03:18:03 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) [ 3265.449289] audit: type=1804 audit(1551237483.523:54576): pid=30394 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5289/file0" dev="sda1" ino=18056 res=1 [ 3265.550386] audit: type=1804 audit(1551237483.523:54577): pid=30395 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7561/file0" dev="sda1" ino=18036 res=1 [ 3265.576247] binder: 30437:30442 unknown command 0 03:18:04 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000040)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:18:04 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:04 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) [ 3265.584306] audit: type=1804 audit(1551237483.523:54578): pid=30398 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir505209377/syzkaller.GJLDU9/7561/file0" dev="sda1" ino=18036 res=1 [ 3265.604693] binder: 30437:30442 ioctl c0306201 200001c0 returned -22 03:18:04 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:18:04 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) [ 3265.667603] binder: 30437:30448 got reply transaction with no transaction stack [ 3265.685310] audit: type=1800 audit(1551237483.533:54579): pid=30396 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=18057 res=0 [ 3265.724136] binder: 30437:30458 unknown command 0 03:18:04 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3265.775665] binder: 30437:30458 ioctl c0306201 200001c0 returned -22 [ 3265.802708] audit: type=1804 audit(1551237483.533:54580): pid=30394 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir647747761/syzkaller.kXUnPG/5289/file0" dev="sda1" ino=18056 res=1 03:18:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="006340400000f90000000000000000007100000000000000000000000000000000000000000000000000000000000000000008000000000000001f00000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0xfffffffffffffff8, 0x80080) write$P9_RAUTH(r2, &(0x7f00000000c0)={0x14, 0x67, 0x1, {0x57, 0x0, 0x3}}, 0x14) dup2(r0, r1) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$VIDIOC_S_EDID(r3, 0xc0285629, &(0x7f0000000280)={0x0, 0x3, 0xc043, [], &(0x7f0000000180)=0x7}) 03:18:04 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000200)=0x0) r3 = syz_open_procfs(r2, &(0x7f0000000380)='nou\x7fcol\xfd\x93\x00\x00\x00\x00\x00') preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000000), &(0x7f0000000040)=0x14) 03:18:04 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x01\x00'}, 0x45c) 03:18:04 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) 03:18:04 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:18:04 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:04 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) recvmmsg(r2, &(0x7f0000003a40)=[{{&(0x7f0000000180)=@hci, 0x80, &(0x7f0000000480)=[{&(0x7f0000000200)=""/199, 0xc7}, {&(0x7f0000000040)=""/17, 0x11}, {&(0x7f0000000300)=""/245, 0xf5}, {&(0x7f0000000400)=""/72, 0x48}], 0x4, &(0x7f0000000580)=""/174, 0xae}, 0x27}, {{&(0x7f00000004c0)=@can, 0x80, &(0x7f0000001740)=[{&(0x7f0000000640)=""/4096, 0x1000}, {&(0x7f0000001640)=""/216, 0xd8}], 0x2, &(0x7f0000001780)=""/225, 0xe1}, 0x2}, {{&(0x7f0000001880)=@nl=@proc, 0x80, &(0x7f0000001a40)=[{&(0x7f0000001900)=""/44, 0x2c}, {&(0x7f0000001940)=""/222, 0xde}], 0x2, &(0x7f0000001a80)=""/52, 0x34}, 0x100000001}, {{0x0, 0x0, &(0x7f0000001f80)=[{&(0x7f0000001ac0)=""/29, 0x1d}, {&(0x7f0000001b00)=""/234, 0xea}, {&(0x7f0000001c00)=""/235, 0xeb}, {&(0x7f0000001d00)=""/240, 0xf0}, {&(0x7f0000001e00)=""/115, 0x73}, {&(0x7f0000001e80)=""/251, 0xfb}], 0x6}, 0x4}, {{&(0x7f0000002000)=@hci, 0x80, &(0x7f0000002100)=[{&(0x7f0000002080)=""/49, 0x31}, {&(0x7f00000020c0)=""/55, 0x37}], 0x2, &(0x7f0000002140)=""/66, 0x42}}, {{&(0x7f00000021c0)=@ethernet={0x0, @local}, 0x80, &(0x7f0000002280)=[{&(0x7f0000002240)=""/35, 0x23}], 0x1, &(0x7f00000022c0)=""/162, 0xa2}, 0x9}, {{&(0x7f0000002380)=@isdn, 0x80, &(0x7f00000037c0)=[{&(0x7f0000002400)=""/211, 0xd3}, {&(0x7f0000002500)=""/4096, 0x1000}, {&(0x7f0000003500)=""/151, 0x97}, {&(0x7f00000035c0)=""/18, 0x12}, {&(0x7f0000003600)=""/236, 0xec}, {&(0x7f0000003700)=""/144, 0x90}], 0x6}, 0x9}, {{&(0x7f0000003840)=@nl=@proc, 0x80, &(0x7f00000039c0)=[{&(0x7f00000038c0)=""/199, 0xc7}], 0x1, &(0x7f0000003a00)=""/20, 0x14}}], 0x8, 0x40002001, &(0x7f0000003c40)={0x0, 0x1c9c380}) 03:18:04 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:18:04 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x45c) [ 3266.063201] binder: 30489:30496 got transaction to invalid handle 03:18:04 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:18:04 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:04 executing program 4: socketpair$unix(0x1, 0x4000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3266.111303] binder: 30489:30505 got transaction to invalid handle 03:18:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) userfaultfd(0x80000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x101000, 0x0) bind$rose(r2, &(0x7f0000000040)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1, @bcast}, 0x1c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000500)) r3 = dup2(r2, r1) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000180)=0xc) getresuid(&(0x7f0000000200)=0x0, &(0x7f0000000240), &(0x7f0000000280)) fstat(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000002c0)={r4, r5, r6}, 0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:18:04 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9a\f\x00'}, 0x45c) 03:18:04 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00'}, 0x45c) 03:18:04 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3266.259079] binder: release 30519:30520 transaction 6352 in, still active [ 3266.274080] binder: send failed reply for transaction 6352 to 30519:30520 03:18:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x10400, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000180)={0x3, 0x20, [0x2, 0x6, 0x9, 0xfffffffffffffff7, 0x401, 0x2, 0x5, 0x1]}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000050000000000000000000b171726aa35000000000000000000000000000000000000000000000000000000000000000024000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) getpeername$packet(r1, &(0x7f0000000700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000740)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000780)={'vcan0\x00', r3}) r4 = dup2(r0, r2) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) shmget$private(0x0, 0x6000, 0x200, &(0x7f0000003000/0x6000)=nil) ioctl$CAPI_MANUFACTURER_CMD(r4, 0xc0104320, &(0x7f0000000040)={0x4, &(0x7f0000000200)="16ff3657f808809a2c38455f865819744d770647764174a4a534fe36fdeede5760a7b96795a2bcfe8e530e67986cdabae8a98d9144739913c07a33c5dcdcc053408b0327bffef1a94030877306242a8afdec4e2050ea7892cbc40b45a7b6333ca79afd45fe2c07df88"}) ioctl$TIOCGSID(r4, 0x5429, &(0x7f0000000000)=0x0) fcntl$setown(r4, 0x8, r5) 03:18:04 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) [ 3266.321192] binder: release 30519:30520 transaction 6354 out, still active [ 3266.328250] binder: undelivered TRANSACTION_COMPLETE 03:18:04 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') ioctl$TIOCSCTTY(r1, 0x540e, 0x8) preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3266.399352] binder: undelivered TRANSACTION_COMPLETE [ 3266.412111] binder: release 30519:30521 transaction 6354 in, still active [ 3266.429724] binder: 30541:30542 got reply transaction with bad transaction stack, transaction 6356 has target 30541:30542 03:18:04 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:18:04 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3266.460484] binder: send failed reply for transaction 6354, target dead [ 3266.481110] binder: 30541:30542 ioctl c0104320 20000040 returned -22 03:18:04 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00'}, 0x45c) 03:18:04 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') r4 = getpid() getresuid(&(0x7f0000000040), &(0x7f0000000180)=0x0, &(0x7f00000001c0)) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000002c0)={r4, r5, r6}, 0x161) preadv(r1, &(0x7f0000000480)=[{&(0x7f0000000300)=""/183, 0xb7}, {&(0x7f00000003c0)=""/190, 0xbe}], 0x2, 0x0) preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3266.506638] binder: 30541:30542 ioctl 5429 20000000 returned -22 03:18:05 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3266.566041] binder: release 30541:30542 transaction 6356 in, still active [ 3266.573152] binder_alloc: 30541: binder_alloc_buf, no vma [ 3266.599835] binder: send failed reply for transaction 6356 to 30541:30542 03:18:05 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:18:05 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:18:05 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x8) sendmmsg(r0, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000180)="4ed888ea3e5882ed2fbdbb1a24fb51dcc5db083979d33aade4cb364d313a9b47e3bdfc371ad350e118b0a80b2d929731ee85976115bed17822ef1751acbdb1e9ba4a29e61fed5b5fd4dad9c0e44bbdc722f51703f18516650dc0f6e9fb4b7e90fa8163a0592accc62638e217dcea238823fb2baa76a6826a", 0x78}, {&(0x7f0000000200)="b1823f8c576557c694bc74ccb693c72a2b0332e3efdd9e54426fbc7fe4ee4d84b3a4ab5af1bd9d363927aa7a63bbe5242a5b42188b1c45ee891e006e1b44f1ff9d8a1cb91a1562f87de16eeef2236b91c4ecd137bdf9e311b02aab1ab4f72227554548e55667e38ace6be69000a85fb4ee38c8c9cb2e70082d03e6ff40bbe5cd11e2b258fa38ab56ac44006e8cff9e7bba0fb1ee26484197230796e2211a8d499ab0c88786004d5f7d67b28c6bd5192a53bd1124b8e4ce7eb627950ec4128faca65b78837e4dd8e263af9a1b03acb6260fa2090076", 0xd5}, {&(0x7f0000000040)="e3d6898160e4e57d853fb1", 0xb}, {&(0x7f0000000300)="fc98e4acac8012b4a40a3f8afc1e17addeb5f43741c0dee8532597cf6dae03979dc866de22464a9d28169cf3e83da1bfbcb92596378e1a8a4cf055957ce5f76d1650c81ace7df5be0f143162feca33b1fc15059cf00536b87b6d28982df78a17a0e7fd091dff7ac994e69872c9aa954c95140c0c3b8348772de5b6f0e512620013d3e1a37a2c3cc88ad4adc2cdae58423a3e43f2a02b364c0bd7d4e0caaa05ede0456a6428817b240391e0996ac767a760fffb1580c526070c5dbf11f54ccb938ff829ab942efae77862a595bc30ac522600efe94f0a239d3b", 0xd9}, {&(0x7f0000000400)="93904178ffaa6e079b718cf35fa52fde24672008bdd94c876450978a857daef10c814e4fb43e493c5876b01da0ffa280918d3363e23611b8e65965deeaf13c79254302d4aa15cfc88723d88f915f5329679e9d882ffede24af9a6839b57ac35aa4d1f8ebe9a3d812f19762f5640cd5a0534408ed8419424e30348bb5b4f9107ce08fc4b5149d6f2f68b62b6e9a934a12bcb61a85424a5ea38c871eed9e4568d8ff210fec1329d080d9f21610a1", 0xad}], 0x5, &(0x7f0000000580)=[{0x38, 0x119, 0x1, "5f1a8a4c3d78591dbe6bf5787465ee6c04e61c70353317f855c64bdb69636ad243c5"}, {0xe0, 0x119, 0x5, "a0dde1690472e89198d1499048b346afa43f22d5c648261d0ecda8ed7b139790ddf56cd57a4fb2835229799e765ebeb2812dae5406db2d72c07188e2371ea0cc5e6a1d4df5f15036053f8c60df33c98fe6d745e01f7a903e673ab06a08188e80c25f9dc444512e7f093eaf4d9edd27d053613d64d74c36683b38bacbade5ec756b93ae783fb2471e60c51ccc5a1bfd4cf7cd7a6293517c4872ea4b860edb1d058669c5eece43e82fbff3830c9bf73ca36a09d4b1f0479f7f943262b7c1bf4eb84ea92880e9d6254603"}], 0x118}, 0x7ff}], 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) [ 3266.633787] binder: 30541:30557 ioctl c0104320 20000040 returned -22 [ 3266.643795] binder: 30541:30566 ioctl 5429 20000000 returned -22 03:18:05 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00'}, 0x45c) [ 3266.746779] binder: undelivered TRANSACTION_COMPLETE 03:18:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f00000002c0)={&(0x7f0000000040), 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0x38, r2, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xed3e}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x53}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000400)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000440)={r3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/conn_reuse_mode\x00', 0x2, 0x0) write$tun(r4, &(0x7f0000000200)={@void, @void, @eth={@broadcast, @local, [], {@canfd={0xd, {{0x0, 0xa56, 0x1, 0x80000000}, 0x24, 0x0, 0x0, 0x0, "1201e75e24e7445149f58c6e27fb453b725b8a026436668b1dedcd305768e1dbd3bfdfcf504bbb78e251d5d77f417c768ecbe345ddef39a8fec607e914c1591a"}}}}}, 0x56) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="016340400000000000000000000800000000000078800ce75700000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:18:05 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:05 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) perf_event_open$cgroup(&(0x7f0000000180)={0x4, 0x70, 0x8, 0x3, 0x3, 0x0, 0x0, 0x401, 0x40, 0x0, 0x80, 0xfffffffffffffff7, 0x0, 0x1, 0xb12, 0x7, 0x81, 0x5, 0xca8f, 0x4, 0x2, 0x2, 0xfffffffffffffffd, 0x2, 0x4, 0x7ff, 0x6, 0x5, 0x100000000, 0x7, 0x2, 0x100000001, 0x7, 0x9, 0x2, 0x7ff, 0x1, 0x6, 0x0, 0x8, 0x6, @perf_config_ext={0x9, 0x100}, 0xc40, 0x3, 0x9, 0x7, 0x8, 0x7, 0x9}, r1, 0xe, 0xffffffffffffff9c, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000080)=""/36, 0x24}, {&(0x7f00000000c0)=""/183, 0xb7}], 0x2, 0x0) 03:18:05 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:18:05 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}, 0x45c) 03:18:05 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = socket$inet(0x2, 0x3, 0x7) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in6=@dev}}, {{@in6}, 0x0, @in=@initdev}}, 0xe8) 03:18:05 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}, 0x45c) 03:18:05 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) [ 3266.895056] binder: 30599:30601 got reply transaction with bad transaction stack, transaction 6361 has target 30599:30601 [ 3266.931144] binder_transaction: 18 callbacks suppressed [ 3266.931160] binder: 30599:30601 transaction failed 29201/-71, size 0-0 line 2816 [ 3266.963887] binder: release 30599:30601 transaction 6361 in, still active [ 3266.993678] binder_alloc: 30599: binder_alloc_buf, no vma 03:18:05 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:18:05 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}, 0x45c) 03:18:05 executing program 4: r0 = socket$inet6(0xa, 0x0, 0x0) listen(r0, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000000)='./file0\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) ftruncate(r1, 0x208200) r2 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x602200, 0x4, 0x4002011, r2, 0x0) [ 3267.016512] binder: send failed reply for transaction 6361 to 30599:30601 [ 3267.039543] binder: 30599:30609 transaction failed 29189/-3, size 0-0 line 3035 03:18:05 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:05 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000000780)=[{&(0x7f0000000380)=""/167, 0xa7}], 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ipv6_route\x00') setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, 0x0, &(0x7f0000000100)) preadv(r0, &(0x7f0000000480), 0x1000000000000064, 0x10000000) 03:18:05 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) [ 3267.187025] binder: undelivered TRANSACTION_COMPLETE 03:18:05 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:18:05 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}, 0x45c) 03:18:05 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:05 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000000780)=[{&(0x7f0000000380)=""/167, 0xa7}], 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ipv6_route\x00') setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, 0x0, &(0x7f0000000100)) preadv(r0, &(0x7f0000000480), 0x1000000000000064, 0x10000000) 03:18:05 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:18:05 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) 03:18:05 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\b\x00'}, 0x45c) 03:18:06 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:06 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}, 0x45c) 03:18:06 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00'}, 0x45c) 03:18:06 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') preadv(r0, &(0x7f0000003400)=[{&(0x7f0000000080)=""/194, 0xc2}], 0x1, 0x0) 03:18:06 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:06 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) 03:18:06 executing program 1: preadv(0xffffffffffffffff, &(0x7f0000000780)=[{&(0x7f0000000380)=""/167, 0xa7}], 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ipv6_route\x00') setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, 0x0, &(0x7f0000000100)) preadv(r0, &(0x7f0000000480), 0x1000000000000064, 0x10000000) 03:18:06 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:06 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f\x9a\x00'}, 0x45c) 03:18:06 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\xff\x00'}, 0x45c) 03:18:06 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00'}, 0x45c) 03:18:06 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:06 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) r1 = dup(r0) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, 0x0, 0x0) fstat(0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x0) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x26, &(0x7f0000000040)={@remote, @dev, @dev={0xac, 0x14, 0x14, 0x19}}, 0xc) 03:18:06 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername(0xffffffffffffffff, 0x0, 0x0) r2 = dup2(r0, r1) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa) getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) read$eventfd(r2, &(0x7f0000000400), 0x8) pipe2$9p(0x0, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) 03:18:06 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf4\x00'}, 0x45c) 03:18:06 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) lgetxattr(&(0x7f0000000040)='./bus\x00', &(0x7f00000000c0)=@known='user.syz\x00', &(0x7f0000000100)=""/94, 0x5e) 03:18:06 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:18:06 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00'}, 0x45c) 03:18:06 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:06 executing program 1: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x8000000004e20}, 0x1c) socket$inet6(0xa, 0x6, 0x0) accept4(r0, 0x0, 0x0, 0x0) r1 = memfd_create(&(0x7f0000000040)='\xe87y\xd8\x0e\xfaE\xbb\x7fH\xbe\xbc\x95\x87\v\xd0\xcd9\xbd(0\xeeG\xaf\xe7\xb3?\xc7x\xbd\xe2R\xc5\r.', 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) chdir(0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) ftruncate(r2, 0x208200) setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0xffffffffffffffd5) r3 = open(&(0x7f0000000780)='./bus\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x602200, 0x4, 0x4002011, r3, 0x0) write$sndseq(r1, &(0x7f0000000000)=[{0x21, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xffffff76) 03:18:06 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xf5\x00'}, 0x45c) 03:18:06 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0x45c) 03:18:06 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@ipv6_newaddr={0x40, 0x14, 0x109, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffff1bb}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}}, 0x0) 03:18:06 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) fallocate(r1, 0x0, 0x0, 0x10001) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00'}, 0x45c) 03:18:06 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000001180)='threaded\x00', 0xfc9a) sendfile(r1, r2, 0x0, 0x1ac05) write$uinput_user_dev(r3, &(0x7f0000001600)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00'}, 0x45c) [ 3268.668905] [ 3268.670561] ======================================================