08, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:54 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:54 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 1 printk messages dropped ** [ 922.758218] binder: 6592:6595 got transaction to invalid handle 13:20:54 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 922.800668] binder: 6601:6605 got transaction to invalid handle 13:20:54 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:54 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:54 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:54 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:54 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:54 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 2 printk messages dropped ** [ 922.860388] binder: 6620:6627 transaction failed 29201/-22, size 80-24 line 3013 13:20:54 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:54 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:54 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:54 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:54 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:54 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 922.973903] binder: 6648:6657 got transaction to invalid handle [ 922.975504] binder: 6648:6657 transaction failed 29201/-22, size 80-24 line 3013 13:20:54 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:54 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:54 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:54 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:54 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 923.028454] binder: 6666:6675 transaction failed 29201/-22, size 80-24 line 3013 13:20:54 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:54 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:54 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:54 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:54 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 923.093582] binder: 6686:6691 transaction failed 29201/-22, size 80-24 line 3013 13:20:54 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:54 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:54 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:54 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:54 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:54 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 923.149672] binder: 6700:6709 transaction failed 29201/-22, size 80-24 line 3013 13:20:54 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:54 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:54 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:54 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:54 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 1 printk messages dropped ** [ 923.192099] binder: 6717:6720 transaction failed 29201/-22, size 80-24 line 3013 13:20:54 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:54 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:54 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:54 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:54 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 923.236428] binder: 6731:6735 transaction failed 29201/-22, size 80-24 line 3013 13:20:54 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:54 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:54 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:54 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:54 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:54 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:54 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 923.289689] binder: 6740:6749 got transaction to invalid handle [ 923.289896] binder: 6740:6749 transaction failed 29201/-22, size 80-24 line 3013 13:20:54 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:54 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:54 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:54 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:54 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:54 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:54 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 923.346717] binder: 6758:6760 got transaction to invalid handle 13:20:54 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:54 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:54 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:54 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:54 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 923.346726] binder: 6758:6760 transaction failed 29201/-22, size 80-24 line 3013 13:20:54 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:54 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:55 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 2 printk messages dropped ** [ 923.450410] binder: 6786:6791 got transaction to invalid handle 13:20:55 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:55 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:55 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 923.509016] binder: 6801:6809 got transaction to invalid handle ** 1 printk messages dropped ** [ 923.564519] binder: 6821:6824 got transaction to invalid handle 13:20:55 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:55 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 1 printk messages dropped ** [ 923.656072] binder: 6835:6850 got transaction to invalid handle 13:20:55 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:55 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:55 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 923.783792] binder: 6864:6880 got transaction to invalid handle 13:20:55 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:55 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:55 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 923.864425] binder: 6902:6909 got transaction to invalid handle 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 923.864435] binder: 6902:6909 transaction failed 29201/-22, size 80-24 line 3013 13:20:55 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:55 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:55 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 923.941162] binder: 6917:6929 got transaction to invalid handle [ 923.941172] binder: 6917:6929 transaction failed 29201/-22, size 80-24 line 3013 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:55 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:55 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 923.985292] binder: 6940:6945 got transaction to invalid handle [ 923.985304] binder: 6940:6945 transaction failed 29201/-22, size 80-24 line 3013 13:20:55 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:55 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:55 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 924.062135] binder: 6953:6964 got transaction to invalid handle [ 924.062145] binder: 6953:6964 transaction failed 29201/-22, size 80-24 line 3013 13:20:55 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 924.176207] binder: 6984:6992 got transaction to invalid handle ** 2 printk messages dropped ** [ 924.272214] binder: 7010:7016 transaction failed 29201/-22, size 80-24 line 3013 13:20:55 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:55 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:55 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 1 printk messages dropped ** [ 924.339939] binder: 7037:7041 transaction failed 29201/-22, size 80-24 line 3013 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:55 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:55 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 924.362872] binder: 7046:7048 transaction failed 29201/-22, size 80-24 line 3013 ** 1 printk messages dropped ** [ 924.416116] binder: 7062:7067 transaction failed 29201/-22, size 80-24 line 3013 13:20:55 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:55 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:55 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 924.494609] binder: 7078:7086 transaction failed 29201/-22, size 80-24 line 3013 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:55 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 3 printk messages dropped ** [ 924.667217] binder: 7129:7138 transaction failed 29201/-22, size 80-24 line 3013 13:20:55 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:55 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:55 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 1 printk messages dropped ** [ 924.781057] binder: 7166:7170 transaction failed 29201/-22, size 80-24 line 3013 13:20:55 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:55 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:55 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:55 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 924.893317] binder: 7187:7200 transaction failed 29201/-22, size 80-24 line 3013 ** 2 printk messages dropped ** [ 925.074198] binder: 7242:7245 got transaction to invalid handle 13:20:56 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:56 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:56 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:56 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 925.128484] binder: 7255:7259 got transaction to invalid handle 13:20:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:56 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:56 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 925.128493] binder: 7255:7259 transaction failed 29201/-22, size 80-24 line 3013 13:20:56 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:56 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:56 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:56 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 925.196803] binder: 7270:7276 got transaction to invalid handle 13:20:56 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:56 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:56 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 1 printk messages dropped ** [ 925.270735] binder: 7296:7300 got transaction to invalid handle 13:20:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:56 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:56 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:56 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) ** 1 printk messages dropped ** [ 925.344145] binder: 7319:7322 got transaction to invalid handle 13:20:56 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:56 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:56 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:56 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) ** 1 printk messages dropped ** [ 925.416846] binder: 7335:7342 got transaction to invalid handle 13:20:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:56 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 925.416854] binder: 7335:7342 transaction failed 29201/-22, size 80-24 line 3013 13:20:56 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:56 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:56 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:56 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 925.461481] binder: 7351:7355 got transaction to invalid handle 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:56 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:56 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:56 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 925.461492] binder: 7351:7355 transaction failed 29201/-22, size 80-24 line 3013 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:56 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:56 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:56 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 925.562968] binder: 7379:7384 got transaction to invalid handle ** 1 printk messages dropped ** [ 925.627865] binder: 7390:7393 got transaction to invalid handle 13:20:56 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:56 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:56 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:56 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 925.651784] binder: 7408:7410 got transaction to invalid handle 13:20:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:56 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:56 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:56 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 925.651795] binder: 7408:7410 transaction failed 29201/-22, size 80-24 line 3013 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 925.716315] binder: 7424:7428 transaction failed 29201/-22, size 80-24 line 3013 13:20:56 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:56 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:56 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:56 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:56 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 925.807288] binder: 7438:7453 transaction failed 29201/-22, size 80-24 line 3013 [ 925.916085] binder: 7473:7483 got transaction to invalid handle 13:20:56 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:56 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:56 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 925.916093] binder: 7473:7483 transaction failed 29201/-22, size 80-24 line 3013 13:20:56 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:56 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:56 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:56 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 925.975492] binder: 7494:7504 got transaction to invalid handle [ 925.975500] binder: 7494:7504 transaction failed 29201/-22, size 80-24 line 3013 13:20:56 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:56 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:56 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 926.041866] binder: 7518:7521 got transaction to invalid handle 13:20:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 926.041875] binder: 7518:7521 transaction failed 29201/-22, size 80-24 line 3013 13:20:57 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:57 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:57 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:57 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:57 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 1 printk messages dropped ** [ 926.122796] binder: 7536:7540 transaction failed 29201/-22, size 80-24 line 3013 13:20:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:57 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:57 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:57 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 1 printk messages dropped ** [ 926.199928] binder: 7565:7569 transaction failed 29201/-22, size 80-24 line 3013 13:20:57 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:57 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:57 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 926.291818] binder: 7589:7599 transaction failed 29201/-22, size 80-24 line 3013 13:20:57 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:57 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:57 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:57 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) ** 1 printk messages dropped ** [ 926.349493] binder: 7611:7612 transaction failed 29201/-22, size 80-24 line 3013 13:20:57 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:57 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:57 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 2 printk messages dropped ** [ 926.467677] binder: 7644:7650 got transaction to invalid handle 13:20:57 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:57 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:57 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:57 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:57 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 1 printk messages dropped ** [ 926.525561] binder: 7657:7661 got transaction to invalid handle ** 1 printk messages dropped ** [ 926.565041] binder: 7672:7681 got transaction to invalid handle 13:20:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:57 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:57 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:57 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:57 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 926.652338] binder: 7690:7696 got transaction to invalid handle [ 926.652346] binder: 7690:7696 transaction failed 29201/-22, size 80-24 line 3013 13:20:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:57 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:57 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:57 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:57 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 926.741140] binder: 7710:7719 got transaction to invalid handle [ 926.741150] binder: 7710:7719 transaction failed 29201/-22, size 80-24 line 3013 13:20:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:57 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:57 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:57 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:57 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 926.776039] binder: 7730:7733 got transaction to invalid handle [ 926.776049] binder: 7730:7733 transaction failed 29201/-22, size 80-24 line 3013 13:20:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:57 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:57 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:57 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:57 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 926.829564] binder: 7746:7751 got transaction to invalid handle [ 926.829574] binder: 7746:7751 transaction failed 29201/-22, size 80-24 line 3013 13:20:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:57 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:57 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:57 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 926.890157] binder: 7760:7770 got transaction to invalid handle 13:20:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:57 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:57 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:57 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:57 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 926.890167] binder: 7760:7770 transaction failed 29201/-22, size 80-24 line 3013 13:20:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:57 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:57 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:57 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:57 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:57 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:58 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:58 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 926.958405] binder: 7786:7790 got transaction to invalid handle ** 1 printk messages dropped ** [ 927.051091] binder: 7804:7811 got transaction to invalid handle 13:20:58 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:58 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:58 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 2 printk messages dropped ** [ 927.085720] binder: 7822:7831 transaction failed 29201/-22, size 80-24 line 3013 13:20:58 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:58 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:58 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:58 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:58 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 927.158224] binder: 7843:7850 got transaction to invalid handle 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:58 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:58 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:58 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:58 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 927.158234] binder: 7843:7850 transaction failed 29201/-22, size 80-24 line 3013 [ 927.198448] binder: 7858:7859 got transaction to invalid handle 13:20:58 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:58 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:58 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 927.198458] binder: 7858:7859 transaction failed 29201/-22, size 80-24 line 3013 13:20:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:58 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:58 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:58 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:58 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 3 printk messages dropped ** [ 927.366931] binder: 7899:7902 transaction failed 29201/-22, size 80-24 line 3013 13:20:58 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:58 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:58 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 927.443350] binder: 7922:7932 transaction failed 29201/-22, size 80-24 line 3013 13:20:58 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:58 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:58 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:58 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 927.516624] binder: 7938:7944 transaction failed 29201/-22, size 80-24 line 3013 13:20:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:58 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:58 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:58 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 927.563764] binder: 7957:7967 transaction failed 29201/-22, size 80-24 line 3013 13:20:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:58 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:58 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:58 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:58 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:58 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:58 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 1 printk messages dropped ** [ 927.600904] binder: 7973:7975 transaction failed 29201/-22, size 80-24 line 3013 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:58 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:58 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:58 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 2 printk messages dropped ** [ 927.806004] binder: 8022:8031 got transaction to invalid handle 13:20:58 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:58 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:58 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:58 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:58 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 3 printk messages dropped ** [ 927.925776] binder: 8073:8074 got transaction to invalid handle 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:58 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:58 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:58 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:58 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 927.925785] binder: 8073:8074 transaction failed 29201/-22, size 80-24 line 3013 13:20:58 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:58 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:58 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 927.971517] binder: 8088:8100 got transaction to invalid handle 13:20:58 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 928.095803] binder: 8118:8123 got transaction to invalid handle 13:20:59 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:59 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:59 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:59 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 928.142711] binder: 8132:8138 got transaction to invalid handle 13:20:59 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:59 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:59 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:59 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 928.207132] binder: 8152:8156 got transaction to invalid handle 13:20:59 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:59 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:59 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:59 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 928.255771] binder: 8166:8171 got transaction to invalid handle 13:20:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:59 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:59 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 928.255780] binder: 8166:8171 transaction failed 29201/-22, size 80-24 line 3013 [ 928.323323] binder: 8177:8185 got transaction to invalid handle 13:20:59 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 928.323334] binder: 8177:8185 transaction failed 29201/-22, size 80-24 line 3013 13:20:59 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:59 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:59 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:59 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 928.389735] binder: 8200:8209 got transaction to invalid handle [ 928.389743] binder: 8200:8209 transaction failed 29201/-22, size 80-24 line 3013 13:20:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:59 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:59 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:59 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 928.484275] binder: 8222:8226 got transaction to invalid handle [ 928.484284] binder: 8222:8226 transaction failed 29201/-22, size 80-24 line 3013 13:20:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:59 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:59 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:59 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:59 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:59 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 928.575307] binder: 8245:8258 got transaction to invalid handle [ 928.575316] binder: 8245:8258 transaction failed 29201/-22, size 80-24 line 3013 13:20:59 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:59 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:59 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:59 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 928.620983] binder: 8269:8272 transaction failed 29201/-22, size 80-24 line 3013 13:20:59 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:20:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:59 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:59 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:59 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 928.668282] binder: 8285:8291 transaction failed 29201/-22, size 80-24 line 3013 13:20:59 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:59 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:59 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) ** 1 printk messages dropped ** [ 928.719930] binder: 8293:8299 transaction failed 29201/-22, size 80-24 line 3013 13:20:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:59 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:59 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 928.804483] binder: 8318:8323 transaction failed 29201/-22, size 80-24 line 3013 [ 928.865397] binder: 8329:8334 got transaction to invalid handle [ 928.865406] binder: 8329:8334 transaction failed 29201/-22, size 80-24 line 3013 [ 928.909177] binder: 8343:8346 got transaction to invalid handle 13:20:59 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:59 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:59 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 928.909185] binder: 8343:8346 transaction failed 29201/-22, size 80-24 line 3013 [ 928.949473] binder: 8359:8364 got transaction to invalid handle [ 928.949483] binder: 8359:8364 transaction failed 29201/-22, size 80-24 line 3013 [ 929.050286] binder: 8382:8389 got transaction to invalid handle [ 929.050293] binder: 8382:8389 transaction failed 29201/-22, size 80-24 line 3013 [ 929.111566] binder: 8402:8404 got transaction to invalid handle 13:20:59 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:20:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:20:59 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:20:59 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:20:59 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 929.111577] binder: 8402:8404 transaction failed 29201/-22, size 80-24 line 3013 13:20:59 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:20:59 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:00 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:00 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 929.203605] binder: 8423:8424 got transaction to invalid handle 13:21:00 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:00 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:00 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:00 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:00 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 929.203615] binder: 8423:8424 transaction failed 29201/-22, size 80-24 line 3013 13:21:00 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:00 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:00 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:00 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:00 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:00 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:00 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 929.270664] binder: 8444:8447 got transaction to invalid handle [ 929.270674] binder: 8444:8447 transaction failed 29201/-22, size 80-24 line 3013 13:21:00 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:00 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:00 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 929.359923] binder: 8463:8468 got transaction to invalid handle 13:21:00 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:00 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:00 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:00 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:00 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:00 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 929.359932] binder: 8463:8468 transaction failed 29201/-22, size 80-24 line 3013 [ 929.550592] binder: 8494:8507 got transaction to invalid handle 13:21:00 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:00 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 929.550601] binder: 8494:8507 transaction failed 29201/-22, size 80-24 line 3013 13:21:00 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:00 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:00 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:00 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 929.624234] binder: 8528:8536 got transaction to invalid handle 13:21:00 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:00 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:00 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:00 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:00 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 929.624242] binder: 8528:8536 transaction failed 29201/-22, size 80-24 line 3013 [ 929.696906] binder: 8556:8564 got transaction to invalid handle 13:21:00 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:00 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:00 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:00 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 929.696915] binder: 8556:8564 transaction failed 29201/-22, size 80-24 line 3013 [ 929.755437] binder: 8580:8586 got transaction to invalid handle 13:21:00 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:00 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:00 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:00 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:00 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:00 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:00 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 929.808296] binder: 8592:8595 got transaction to invalid handle [ 929.808305] binder: 8592:8595 transaction failed 29201/-22, size 80-24 line 3013 13:21:00 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:00 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 929.881262] binder: 8612:8618 got transaction to invalid handle [ 929.881271] binder: 8612:8618 transaction failed 29201/-22, size 80-24 line 3013 13:21:00 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:00 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:00 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:00 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:00 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:00 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 929.942350] binder: 8632:8634 transaction failed 29201/-22, size 80-24 line 3013 [ 930.017709] binder: 8641:8647 got transaction to invalid handle 13:21:00 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:00 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:00 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:00 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 930.017719] binder: 8641:8647 transaction failed 29201/-22, size 80-24 line 3013 [ 930.051396] binder: 8665:8668 got transaction to invalid handle 13:21:00 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:00 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:00 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:00 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:00 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:00 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 930.051405] binder: 8665:8668 transaction failed 29201/-22, size 80-24 line 3013 [ 930.119030] binder: 8680:8685 got transaction to invalid handle [ 930.119039] binder: 8680:8685 transaction failed 29201/-22, size 80-24 line 3013 [ 930.193145] binder: 8701:8709 got transaction to invalid handle 13:21:00 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:01 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:01 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 930.193153] binder: 8701:8709 transaction failed 29201/-22, size 80-24 line 3013 [ 930.244054] binder: 8717:8722 got transaction to invalid handle [ 930.244063] binder: 8717:8722 transaction failed 29201/-22, size 80-24 line 3013 13:21:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:01 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:01 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 930.340021] binder: 8740:8747 got transaction to invalid handle [ 930.340030] binder: 8740:8747 transaction failed 29201/-22, size 80-24 line 3013 13:21:01 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:01 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 930.451873] binder: 8765:8773 got transaction to invalid handle 13:21:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:01 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:01 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:01 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 930.451884] binder: 8765:8773 transaction failed 29201/-22, size 80-24 line 3013 [ 930.546688] binder: 8797:8810 got transaction to invalid handle 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:01 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:01 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:01 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:01 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 930.546697] binder: 8797:8810 transaction failed 29201/-22, size 80-24 line 3013 13:21:01 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:01 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:01 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 930.631659] binder: 8825:8835 got transaction to invalid handle [ 930.631669] binder: 8825:8835 transaction failed 29201/-22, size 80-24 line 3013 13:21:01 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:01 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:01 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:01 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:01 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 930.700064] binder: 8852:8864 got transaction to invalid handle 13:21:01 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:01 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:01 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:01 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 930.700074] binder: 8852:8864 transaction failed 29201/-22, size 80-24 line 3013 13:21:01 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:01 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 930.802175] binder: 8872:8881 got transaction to invalid handle 13:21:01 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:01 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:01 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:01 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 930.802183] binder: 8872:8881 transaction failed 29201/-22, size 80-24 line 3013 13:21:01 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:01 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 930.903478] binder: 8898:8904 got transaction to invalid handle 13:21:01 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:01 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:01 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 930.965301] binder: 8913:8924 got transaction to invalid handle 13:21:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:01 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:01 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:01 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:01 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 931.060708] binder: 8939:8948 got transaction to invalid handle 13:21:01 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 931.060717] binder: 8939:8948 transaction failed 29201/-22, size 80-24 line 3013 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:01 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:01 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:01 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 931.126820] binder: 8960:8968 got transaction to invalid handle 13:21:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:01 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 1 printk messages dropped ** [ 931.210394] binder: 8983:8988 got transaction to invalid handle [ 931.210403] binder: 8983:8988 transaction failed 29201/-22, size 80-24 line 3013 13:21:01 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:01 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:01 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:01 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:01 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 931.267027] binder: 8999:9003 got transaction to invalid handle [ 931.267035] binder: 8999:9003 transaction failed 29201/-22, size 80-24 line 3013 13:21:01 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:01 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:01 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:02 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 931.336239] binder: 9023:9028 got transaction to invalid handle [ 931.336248] binder: 9023:9028 transaction failed 29201/-22, size 80-24 line 3013 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:02 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:02 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:02 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:02 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 931.391700] binder: 9035:9040 got transaction to invalid handle [ 931.391715] binder: 9035:9040 transaction failed 29201/-22, size 80-24 line 3013 [ 931.499419] binder: 9059:9067 got transaction to invalid handle [ 931.499428] binder: 9059:9067 transaction failed 29201/-22, size 80-24 line 3013 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:02 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:02 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:02 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 931.582121] binder: 9089:9097 got transaction to invalid handle [ 931.582129] binder: 9089:9097 transaction failed 29201/-22, size 80-24 line 3013 13:21:02 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:02 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:02 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:02 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 931.631204] binder: 9105:9111 got transaction to invalid handle [ 931.631213] binder: 9105:9111 transaction failed 29201/-22, size 80-24 line 3013 13:21:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:02 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:02 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:02 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:02 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 931.719395] binder: 9125:9134 transaction failed 29201/-22, size 80-24 line 3013 13:21:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:02 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:02 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:02 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:02 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 931.802695] binder: 9146:9161 got transaction to invalid handle 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:02 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:02 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:02 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 931.802703] binder: 9146:9161 transaction failed 29201/-22, size 80-24 line 3013 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:02 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:02 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:02 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 931.890898] binder: 9175:9182 transaction failed 29201/-22, size 80-24 line 3013 13:21:02 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:02 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:02 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:02 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:02 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:02 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:02 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) ** 1 printk messages dropped ** [ 931.941526] binder: 9198:9205 transaction failed 29201/-22, size 80-24 line 3013 ** 2 printk messages dropped ** [ 932.082554] binder: 9237:9246 got transaction to invalid handle 13:21:02 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:02 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:02 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:02 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 1 printk messages dropped ** [ 932.119758] binder: 9252:9258 got transaction to invalid handle 13:21:02 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:02 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:02 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 932.169416] binder: 9269:9278 got transaction to invalid handle 13:21:02 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:02 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 932.169425] binder: 9269:9278 transaction failed 29201/-22, size 80-24 line 3013 13:21:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:02 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:02 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:02 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:02 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:02 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:02 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 2 printk messages dropped ** [ 932.348717] binder: 9315:9320 got transaction to invalid handle 13:21:02 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:02 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:02 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:02 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 1 printk messages dropped ** [ 932.434940] binder: 9335:9343 got transaction to invalid handle 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:03 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:03 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 1 printk messages dropped ** [ 932.530501] binder: 9358:9374 got transaction to invalid handle ** 1 printk messages dropped ** [ 932.598741] binder: 9389:9401 got transaction to invalid handle 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:03 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:03 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 1 printk messages dropped ** [ 932.653428] binder: 9405:9413 got transaction to invalid handle 13:21:03 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:03 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:03 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:03 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 932.791274] binder: 9433:9455 got transaction to invalid handle 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:03 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 2 printk messages dropped ** [ 932.857803] binder: 9464:9471 transaction failed 29201/-22, size 80-24 line 3013 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:03 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:03 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:03 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 3 printk messages dropped ** [ 932.969782] binder: 9507:9510 transaction failed 29201/-22, size 80-24 line 3013 13:21:03 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:03 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:03 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 933.027717] binder: 9523:9527 transaction failed 29201/-22, size 80-24 line 3013 13:21:03 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:03 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:03 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:03 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 3 printk messages dropped ** [ 933.172070] binder: 9565:9567 transaction failed 29201/-22, size 80-24 line 3013 13:21:03 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:03 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:03 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) ** 3 printk messages dropped ** [ 933.345839] binder: 9600:9604 transaction failed 29201/-22, size 80-24 line 3013 13:21:03 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 933.414025] binder: 9630:9634 transaction failed 29201/-22, size 80-24 line 3013 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 2 printk messages dropped ** [ 933.527744] binder: 9655:9656 got transaction to invalid handle [ 933.527753] binder: 9655:9656 transaction failed 29201/-22, size 80-24 line 3013 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:03 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 933.589547] binder: 9677:9681 got transaction to invalid handle [ 933.589556] binder: 9677:9681 transaction failed 29201/-22, size 80-24 line 3013 13:21:03 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:03 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 933.630980] binder: 9695:9699 got transaction to invalid handle ** 1 printk messages dropped ** [ 933.677862] binder: 9708:9715 got transaction to invalid handle 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:03 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:03 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:03 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:03 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:03 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:03 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 1 printk messages dropped ** [ 933.744023] binder: 9727:9732 got transaction to invalid handle ** 1 printk messages dropped ** [ 933.784454] binder: 9742:9747 got transaction to invalid handle 13:21:03 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:04 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:04 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 1 printk messages dropped ** [ 933.838765] binder: 9757:9759 got transaction to invalid handle 13:21:04 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:04 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:04 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:04 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:04 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 933.883107] binder: 9769:9776 got transaction to invalid handle 13:21:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:04 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:04 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 933.883115] binder: 9769:9776 transaction failed 29201/-22, size 80-24 line 3013 13:21:04 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:04 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:04 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:04 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 933.949451] binder: 9784:9791 got transaction to invalid handle [ 933.949459] binder: 9784:9791 transaction failed 29201/-22, size 80-24 line 3013 13:21:04 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:04 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:04 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 933.992882] binder: 9802:9803 got transaction to invalid handle [ 933.992891] binder: 9802:9803 transaction failed 29201/-22, size 80-24 line 3013 13:21:04 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:04 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:04 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:04 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 1 printk messages dropped ** [ 934.040284] binder: 9817:9821 transaction failed 29201/-22, size 80-24 line 3013 13:21:04 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:04 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:04 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 1 printk messages dropped ** [ 934.093278] binder: 9832:9836 transaction failed 29201/-22, size 80-24 line 3013 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:04 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:04 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:04 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:04 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:04 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 934.183201] binder: 9856:9860 transaction failed 29201/-22, size 80-24 line 3013 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:04 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:04 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 934.297947] binder: 9875:9886 transaction failed 29201/-22, size 80-24 line 3013 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:04 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:04 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:04 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:04 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 1 printk messages dropped ** [ 934.428344] binder: 9908:9917 transaction failed 29201/-22, size 80-24 line 3013 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:04 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:04 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 3 printk messages dropped ** [ 934.601811] binder: 9954:9956 transaction failed 29201/-22, size 80-24 line 3013 13:21:04 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:04 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 934.671088] binder: 9974:9980 transaction failed 29201/-22, size 80-24 line 3013 13:21:04 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:04 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:04 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:04 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:04 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 934.745968] binder: 9996:9999 transaction failed 29201/-22, size 80-24 line 3013 13:21:04 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:04 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:04 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 2 printk messages dropped ** [ 934.888631] binder: 10034:10041 got transaction to invalid handle 13:21:04 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:04 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:04 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:04 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:04 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 3 printk messages dropped ** [ 935.060181] binder: 10075:10086 got transaction to invalid handle [ 935.060190] binder: 10075:10086 transaction failed 29201/-22, size 80-24 line 3013 13:21:04 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:05 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 935.107664] binder: 10109:10113 got transaction to invalid handle [ 935.107673] binder: 10109:10113 transaction failed 29201/-22, size 80-24 line 3013 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 935.150826] binder: 10118:10123 got transaction to invalid handle 13:21:05 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:05 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:05 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:05 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:05 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 935.150834] binder: 10118:10123 transaction failed 29201/-22, size 80-24 line 3013 [ 935.222974] binder: 10135:10139 got transaction to invalid handle 13:21:05 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:05 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:05 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 935.222984] binder: 10135:10139 transaction failed 29201/-22, size 80-24 line 3013 13:21:05 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:05 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:05 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:05 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 935.276126] binder: 10150:10155 got transaction to invalid handle [ 935.276136] binder: 10150:10155 transaction failed 29201/-22, size 80-24 line 3013 13:21:05 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:05 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 935.349202] binder: 10179:10180 got transaction to invalid handle 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:05 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:05 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:05 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:05 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 935.387180] binder: 10188:10191 got transaction to invalid handle [ 935.387191] binder: 10188:10191 transaction failed 29201/-22, size 80-24 line 3013 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:05 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:05 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:05 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 935.429037] binder: 10196:10202 got transaction to invalid handle [ 935.429045] binder: 10196:10202 transaction failed 29201/-22, size 80-24 line 3013 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 935.476482] binder: 10210:10218 got transaction to invalid handle [ 935.476491] binder: 10210:10218 transaction failed 29201/-22, size 80-24 line 3013 [ 935.528206] binder: 10226:10235 got transaction to invalid handle 13:21:05 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:05 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:05 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:05 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:05 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:05 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 935.528217] binder: 10226:10235 transaction failed 29201/-22, size 80-24 line 3013 [ 935.588536] binder: 10242:10252 got transaction to invalid handle 13:21:05 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:05 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 935.588544] binder: 10242:10252 transaction failed 29201/-22, size 80-24 line 3013 [ 935.678623] binder: 10262:10275 got transaction to invalid handle 13:21:05 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:05 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:05 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:05 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 935.678632] binder: 10262:10275 transaction failed 29201/-22, size 80-24 line 3013 13:21:05 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:05 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:05 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:05 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:05 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 935.731808] binder: 10291:10294 got transaction to invalid handle [ 935.731817] binder: 10291:10294 transaction failed 29201/-22, size 80-24 line 3013 13:21:05 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:05 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:05 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 935.801983] binder: 10306:10314 got transaction to invalid handle 13:21:05 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:05 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 935.889905] binder: 10320:10337 got transaction to invalid handle 13:21:05 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:05 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:05 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 935.889914] binder: 10320:10337 transaction failed 29201/-22, size 80-24 line 3013 13:21:05 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:05 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:05 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:05 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:05 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:06 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 935.944254] binder: 10345:10349 got transaction to invalid handle 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:06 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 935.998058] binder: 10367:10374 got transaction to invalid handle 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:06 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:06 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:06 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 1 printk messages dropped ** [ 936.070620] binder: 10388:10394 got transaction to invalid handle 13:21:06 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:06 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:06 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 3 printk messages dropped ** [ 936.220909] binder: 10422:10436 got transaction to invalid handle 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:06 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:06 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:06 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 936.286036] binder: 10448:10452 got transaction to invalid handle [ 936.286045] binder: 10448:10452 transaction failed 29201/-22, size 80-24 line 3013 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:06 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:06 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 936.363236] binder: 10468:10473 got transaction to invalid handle 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:06 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:06 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 936.363245] binder: 10468:10473 transaction failed 29201/-22, size 80-24 line 3013 13:21:06 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:06 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:06 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 936.451923] binder: 10488:10499 got transaction to invalid handle 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 936.451932] binder: 10488:10499 transaction failed 29201/-22, size 80-24 line 3013 13:21:06 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:06 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 936.515541] binder: 10509:10515 got transaction to invalid handle 13:21:06 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 936.515552] binder: 10509:10515 transaction failed 29201/-22, size 80-24 line 3013 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:06 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:06 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:06 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:06 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 936.607194] binder: 10530:10539 got transaction to invalid handle [ 936.607203] binder: 10530:10539 transaction failed 29201/-22, size 80-24 line 3013 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:06 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:06 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:06 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:06 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:06 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 936.641991] binder: 10549:10555 got transaction to invalid handle ** 1 printk messages dropped ** [ 936.705916] binder: 10564:10569 got transaction to invalid handle 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:06 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:06 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 936.781180] binder: 10582:10596 got transaction to invalid handle 13:21:06 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 936.781189] binder: 10582:10596 transaction failed 29201/-22, size 80-24 line 3013 13:21:06 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:06 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:06 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:06 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:06 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 936.872388] binder: 10614:10615 got transaction to invalid handle 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:07 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:07 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:07 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 1 printk messages dropped ** [ 936.949082] binder: 10635:10644 got transaction to invalid handle 13:21:07 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:07 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:07 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:07 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:07 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 1 printk messages dropped ** [ 937.014413] binder: 10655:10667 got transaction to invalid handle ** 1 printk messages dropped ** [ 937.095566] binder: 10676:10692 got transaction to invalid handle 13:21:07 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:07 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 937.138009] binder: 10701:10709 got transaction to invalid handle ** 1 printk messages dropped ** [ 937.242534] binder: 10720:10733 got transaction to invalid handle 13:21:07 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:07 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:07 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:07 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:07 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:07 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:07 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 1 printk messages dropped ** [ 937.322452] binder: 10750:10757 got transaction to invalid handle ** 1 printk messages dropped ** [ 937.410842] binder: 10785:10794 got transaction to invalid handle 13:21:07 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:07 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:07 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:07 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:07 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 937.498076] binder: 10807:10811 got transaction to invalid handle [ 937.498087] binder: 10807:10811 transaction failed 29201/-22, size 80-24 line 3013 [ 937.551188] binder: 10834:10837 got transaction to invalid handle [ 937.551196] binder: 10834:10837 transaction failed 29201/-22, size 80-24 line 3013 13:21:07 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:07 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 937.606896] binder: 10849:10857 got transaction to invalid handle 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:07 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:07 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:07 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:07 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:07 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 937.606906] binder: 10849:10857 transaction failed 29201/-22, size 80-24 line 3013 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 937.702859] binder: 10881:10888 got transaction to invalid handle 13:21:07 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:07 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:07 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:07 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 937.702870] binder: 10881:10888 transaction failed 29201/-22, size 80-24 line 3013 13:21:07 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:07 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:07 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 937.744171] binder: 10895:10898 got transaction to invalid handle [ 937.744180] binder: 10895:10898 transaction failed 29201/-22, size 80-24 line 3013 [ 937.828520] binder: 10913:10931 got transaction to invalid handle [ 937.828529] binder: 10913:10931 transaction failed 29201/-22, size 80-24 line 3013 13:21:07 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:07 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:07 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 937.934355] binder: 10937:10964 got transaction to invalid handle [ 937.934364] binder: 10937:10964 transaction failed 29201/-22, size 80-24 line 3013 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:07 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:07 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:07 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 938.032486] binder: 10977:10997 got transaction to invalid handle [ 938.032495] binder: 10977:10997 transaction failed 29201/-22, size 80-24 line 3013 13:21:07 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 938.099450] binder: 11013:11018 got transaction to invalid handle 13:21:07 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:07 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:07 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:07 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:07 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 938.099459] binder: 11013:11018 transaction failed 29201/-22, size 80-24 line 3013 [ 938.179796] binder: 11031:11038 got transaction to invalid handle 13:21:07 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:07 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:08 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:08 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 938.179806] binder: 11031:11038 transaction failed 29201/-22, size 80-24 line 3013 [ 938.257697] binder: 11058:11063 got transaction to invalid handle [ 938.257707] binder: 11058:11063 transaction failed 29201/-22, size 80-24 line 3013 13:21:08 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:08 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:08 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:08 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 938.315913] binder: 11075:11081 got transaction to invalid handle [ 938.315923] binder: 11075:11081 transaction failed 29201/-22, size 80-24 line 3013 [ 938.376416] binder: 11091:11100 got transaction to invalid handle 13:21:08 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:08 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:08 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:08 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:08 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:08 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 938.376426] binder: 11091:11100 transaction failed 29201/-22, size 80-24 line 3013 [ 938.449297] binder: 11117:11123 got transaction to invalid handle [ 938.449306] binder: 11117:11123 transaction failed 29201/-22, size 80-24 line 3013 13:21:08 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:08 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:08 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:08 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:08 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 938.514998] binder: 11135:11142 got transaction to invalid handle [ 938.515005] binder: 11135:11142 transaction failed 29201/-22, size 80-24 line 3013 [ 938.543153] binder: 11158:11159 got transaction to invalid handle 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:08 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:08 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 938.543162] binder: 11158:11159 transaction failed 29201/-22, size 80-24 line 3013 13:21:08 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 938.597851] binder: 11164:11179 got transaction to invalid handle 13:21:08 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:08 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:08 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:08 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:08 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:08 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 938.597859] binder: 11164:11179 transaction failed 29201/-22, size 80-24 line 3013 [ 938.657495] binder: 11188:11197 got transaction to invalid handle 13:21:08 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 938.657505] binder: 11188:11197 transaction failed 29201/-22, size 80-24 line 3013 [ 938.693791] binder: 11205:11209 got transaction to invalid handle [ 938.693801] binder: 11205:11209 transaction failed 29201/-22, size 80-24 line 3013 13:21:08 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:08 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:08 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:08 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 938.771020] binder: 11228:11243 got transaction to invalid handle [ 938.771029] binder: 11228:11243 transaction failed 29201/-22, size 80-24 line 3013 13:21:08 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:08 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:08 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:08 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:08 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:08 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 938.883712] binder: 11257:11269 got transaction to invalid handle [ 938.883721] binder: 11257:11269 transaction failed 29201/-22, size 80-24 line 3013 13:21:08 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:08 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:08 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:08 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:08 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 938.962563] binder: 11294:11302 got transaction to invalid handle [ 938.962573] binder: 11294:11302 transaction failed 29201/-22, size 80-24 line 3013 13:21:08 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:08 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:08 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:08 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 939.051659] binder: 11325:11329 got transaction to invalid handle [ 939.051668] binder: 11325:11329 transaction failed 29201/-22, size 80-24 line 3013 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:08 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:08 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:08 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:08 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:08 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:08 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 939.129478] binder: 11350:11359 got transaction to invalid handle 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:09 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 939.129486] binder: 11350:11359 transaction failed 29201/-22, size 80-24 line 3013 13:21:09 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:09 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:09 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:09 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 939.196272] binder: 11375:11381 got transaction to invalid handle [ 939.196283] binder: 11375:11381 transaction failed 29201/-22, size 80-24 line 3013 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:09 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:09 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 939.251181] binder: 11401:11404 got transaction to invalid handle 13:21:09 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 1 printk messages dropped ** [ 939.342048] binder: 11423:11431 got transaction to invalid handle 13:21:09 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:09 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:09 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 939.392600] binder: 11450:11454 got transaction to invalid handle 13:21:09 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:09 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:09 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 939.392610] binder: 11450:11454 transaction failed 29201/-22, size 80-24 line 3013 13:21:09 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:09 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 2 printk messages dropped ** [ 939.530565] binder: 11490:11492 got transaction to invalid handle 13:21:09 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:09 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:09 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:09 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 939.530573] binder: 11490:11492 transaction failed 29201/-22, size 80-24 line 3013 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:09 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 939.639062] binder: 11518:11529 got transaction to invalid handle [ 939.639072] binder: 11518:11529 transaction failed 29201/-22, size 80-24 line 3013 [ 939.733095] binder: 11551:11559 got transaction to invalid handle 13:21:09 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:09 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:09 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:09 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 939.733126] binder: 11551:11559 transaction failed 29201/-22, size 80-24 line 3013 13:21:09 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:09 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:09 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 939.777181] binder: 11572:11578 got transaction to invalid handle [ 939.777191] binder: 11572:11578 transaction failed 29201/-22, size 80-24 line 3013 [ 939.846989] binder: 11591:11596 got transaction to invalid handle [ 939.846997] binder: 11591:11596 transaction failed 29201/-22, size 80-24 line 3013 13:21:09 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:09 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:09 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 939.940653] binder: 11617:11620 got transaction to invalid handle 13:21:09 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:09 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 939.940661] binder: 11617:11620 transaction failed 29201/-22, size 80-24 line 3013 13:21:09 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:09 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:09 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 940.022001] binder: 11638:11645 got transaction to invalid handle 13:21:09 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:09 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 940.056902] binder: 11648:11653 got transaction to invalid handle 13:21:09 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:09 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:09 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:09 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 940.056912] binder: 11648:11653 transaction failed 29201/-22, size 80-24 line 3013 13:21:09 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:09 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:09 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 940.115113] binder: 11666:11668 got transaction to invalid handle 13:21:09 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:09 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 940.165289] binder: 11680:11684 got transaction to invalid handle 13:21:10 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:10 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:10 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:10 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:10 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 1 printk messages dropped ** [ 940.230139] binder: 11694:11704 got transaction to invalid handle 13:21:10 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 940.230151] binder: 11694:11704 transaction failed 29201/-22, size 80-24 line 3013 13:21:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:10 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:10 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:10 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 940.351961] binder: 11736:11740 got transaction to invalid handle 13:21:10 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:10 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:10 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:10 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 940.351969] binder: 11736:11740 transaction failed 29201/-22, size 80-24 line 3013 [ 940.428354] binder: 11754:11768 got transaction to invalid handle [ 940.428364] binder: 11754:11768 transaction failed 29201/-22, size 80-24 line 3013 13:21:10 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:10 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:10 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 940.518819] binder: 11780:11789 got transaction to invalid handle [ 940.518827] binder: 11780:11789 transaction failed 29201/-22, size 80-24 line 3013 13:21:10 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:10 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:10 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:10 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:10 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 940.585657] binder: 11808:11812 got transaction to invalid handle [ 940.585667] binder: 11808:11812 transaction failed 29201/-22, size 80-24 line 3013 13:21:10 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:10 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:10 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 940.645384] binder: 11824:11828 got transaction to invalid handle [ 940.645393] binder: 11824:11828 transaction failed 29201/-22, size 80-24 line 3013 13:21:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:10 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:10 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:10 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:10 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 940.696335] binder: 11838:11844 got transaction to invalid handle 13:21:10 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:10 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 940.696349] binder: 11838:11844 transaction failed 29201/-22, size 80-24 line 3013 13:21:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:10 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:10 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:10 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 940.729981] binder: 11856:11858 got transaction to invalid handle [ 940.729990] binder: 11856:11858 transaction failed 29201/-22, size 80-24 line 3013 [ 940.828498] binder: 11882:11892 got transaction to invalid handle 13:21:10 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:10 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:10 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:10 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:10 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 940.828508] binder: 11882:11892 transaction failed 29201/-22, size 80-24 line 3013 13:21:10 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:10 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:10 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 940.887690] binder: 11908:11917 got transaction to invalid handle [ 940.888526] binder: 11908:11917 transaction failed 29201/-22, size 80-24 line 3013 13:21:10 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:10 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:10 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 940.945256] binder: 11922:11925 got transaction to invalid handle ** 1 printk messages dropped ** [ 941.038354] binder: 11952:11958 got transaction to invalid handle 13:21:10 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:10 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:10 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 941.125556] binder: 11970:11979 got transaction to invalid handle ** 1 printk messages dropped ** [ 941.185756] binder: 11994:12000 got transaction to invalid handle 13:21:10 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:10 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:10 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:10 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:10 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 941.266041] binder: 12005:12025 got transaction to invalid handle [ 941.266050] binder: 12005:12025 transaction failed 29201/-22, size 80-24 line 3013 [ 941.334152] binder: 12037:12040 got transaction to invalid handle 13:21:11 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 941.334162] binder: 12037:12040 transaction failed 29201/-22, size 80-24 line 3013 [ 941.387914] binder: 12056:12061 got transaction to invalid handle [ 941.387922] binder: 12056:12061 transaction failed 29201/-22, size 80-24 line 3013 [ 941.446931] binder: 12073:12081 got transaction to invalid handle 13:21:11 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:11 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:11 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 941.446941] binder: 12073:12081 transaction failed 29201/-22, size 80-24 line 3013 13:21:11 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:11 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:11 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:11 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 941.514309] binder: 12095:12100 got transaction to invalid handle [ 941.514319] binder: 12095:12100 transaction failed 29201/-22, size 80-24 line 3013 13:21:11 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:11 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:11 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:11 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:11 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 941.580606] binder: 12108:12125 got transaction to invalid handle [ 941.580615] binder: 12108:12125 transaction failed 29201/-22, size 80-24 line 3013 13:21:11 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:11 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:11 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:11 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:11 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:11 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 941.649622] binder: 12143:12148 got transaction to invalid handle 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:11 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:11 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:11 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:11 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 941.649631] binder: 12143:12148 transaction failed 29201/-22, size 80-24 line 3013 13:21:11 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:11 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:11 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 941.757497] binder: 12161:12165 got transaction to invalid handle 13:21:11 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:11 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:11 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:11 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:11 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 941.757506] binder: 12161:12165 transaction failed 29201/-22, size 80-24 line 3013 [ 941.796738] binder: 12191:12197 got transaction to invalid handle 13:21:11 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:11 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:11 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 941.796748] binder: 12191:12197 transaction failed 29201/-22, size 80-24 line 3013 13:21:11 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 941.867427] binder: 12217:12221 got transaction to invalid handle 13:21:11 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:11 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:11 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:11 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:11 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 941.867437] binder: 12217:12221 transaction failed 29201/-22, size 80-24 line 3013 13:21:11 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:11 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:11 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 941.934417] binder: 12229:12233 got transaction to invalid handle [ 941.934425] binder: 12229:12233 transaction failed 29201/-22, size 80-24 line 3013 13:21:11 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:11 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:11 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:11 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 942.014638] binder: 12243:12245 got transaction to invalid handle [ 942.014648] binder: 12243:12245 transaction failed 29201/-22, size 80-24 line 3013 13:21:11 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:11 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:11 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:11 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:11 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:11 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:11 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 942.112317] binder: 12259:12270 got transaction to invalid handle [ 942.112324] binder: 12259:12270 transaction failed 29201/-22, size 80-24 line 3013 13:21:11 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:11 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 942.215335] binder: 12290:12301 got transaction to invalid handle [ 942.215344] binder: 12290:12301 transaction failed 29201/-22, size 80-24 line 3013 13:21:11 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:11 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:11 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:11 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:11 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 942.310028] binder: 12327:12333 got transaction to invalid handle [ 942.310036] binder: 12327:12333 transaction failed 29201/-22, size 80-24 line 3013 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:12 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 942.371235] binder: 12351:12358 got transaction to invalid handle [ 942.371244] binder: 12351:12358 transaction failed 29201/-22, size 80-24 line 3013 13:21:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:12 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 942.451119] binder: 12376:12384 got transaction to invalid handle ** 1 printk messages dropped ** [ 942.494334] binder: 12388:12395 got transaction to invalid handle 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:12 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:12 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:12 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 942.529081] binder: 12402:12403 got transaction to invalid handle 13:21:12 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:12 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 3 printk messages dropped ** [ 942.702432] binder: 12447:12461 got transaction to invalid handle 13:21:12 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:12 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 942.756608] binder: 12472:12477 got transaction to invalid handle 13:21:12 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:12 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 3 printk messages dropped ** [ 942.886378] binder: 12507:12514 got transaction to invalid handle 13:21:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:12 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 942.950569] binder: 12529:12539 got transaction to invalid handle 13:21:12 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 942.950579] binder: 12529:12539 transaction failed 29201/-22, size 80-24 line 3013 13:21:12 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:12 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:12 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 943.036428] binder: 12548:12551 got transaction to invalid handle [ 943.036438] binder: 12548:12551 transaction failed 29201/-22, size 80-24 line 3013 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 943.153140] binder: 12586:12606 got transaction to invalid handle [ 943.153149] binder: 12586:12606 transaction failed 29201/-22, size 80-24 line 3013 13:21:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:12 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 943.237362] binder: 12619:12623 got transaction to invalid handle [ 943.237373] binder: 12619:12623 transaction failed 29201/-22, size 80-24 line 3013 13:21:12 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 943.291426] binder: 12652:12656 got transaction to invalid handle [ 943.291434] binder: 12652:12656 transaction failed 29201/-22, size 80-24 line 3013 13:21:12 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:12 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:12 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:12 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:12 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:12 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:12 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 943.326166] binder: 12662:12668 got transaction to invalid handle [ 943.326175] binder: 12662:12668 transaction failed 29201/-22, size 80-24 line 3013 13:21:12 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:13 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:13 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:13 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:13 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 943.374631] binder: 12675:12677 got transaction to invalid handle 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:13 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:13 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 943.374640] binder: 12675:12677 transaction failed 29201/-22, size 80-24 line 3013 13:21:13 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:13 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:13 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 2 printk messages dropped ** [ 943.505451] binder: 12710:12713 got transaction to invalid handle 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:13 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:13 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:13 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 943.556290] binder: 12731:12733 got transaction to invalid handle 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:13 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:13 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:13 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:13 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 3 printk messages dropped ** [ 943.701789] binder: 12779:12784 got transaction to invalid handle 13:21:13 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:13 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:13 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 943.701797] binder: 12779:12784 transaction failed 29201/-22, size 80-24 line 3013 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:13 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:13 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:13 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:13 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 2 printk messages dropped ** [ 943.820872] binder: 12817:12820 got transaction to invalid handle [ 943.820883] binder: 12817:12820 transaction failed 29201/-22, size 80-24 line 3013 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:13 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:13 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:13 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 943.933284] binder: 12849:12859 got transaction to invalid handle [ 943.933296] binder: 12849:12859 transaction failed 29201/-22, size 80-24 line 3013 13:21:13 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:13 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:13 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:13 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 944.032383] binder: 12872:12882 got transaction to invalid handle 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:13 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 944.062544] binder: 12902:12907 got transaction to invalid handle 13:21:13 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:13 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:13 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:13 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 944.062551] binder: 12902:12907 transaction failed 29201/-22, size 80-24 line 3013 13:21:13 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 944.103766] binder: 12916:12919 got transaction to invalid handle 13:21:13 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:13 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:13 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:13 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 944.103774] binder: 12916:12919 transaction failed 29201/-22, size 80-24 line 3013 13:21:13 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:13 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:13 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:13 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) [ 944.162344] binder: 12926:12932 got transaction to invalid handle ** 1 printk messages dropped ** [ 944.227093] binder: 12955:12960 got transaction to invalid handle 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:13 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:13 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:13 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:13 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:13 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:13 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 1 printk messages dropped ** [ 944.316847] binder: 12980:12987 got transaction to invalid handle 13:21:13 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:14 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:14 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) ** 1 printk messages dropped ** [ 944.349398] binder: 12997:12998 got transaction to invalid handle 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:14 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:14 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:14 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 944.443273] binder: 13012:13024 got transaction to invalid handle 13:21:14 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:14 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:14 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:14 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:14 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 3 printk messages dropped ** [ 944.560832] binder: 13056:13063 got transaction to invalid handle 13:21:14 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:14 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:14 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 944.608458] binder: 13073:13075 got transaction to invalid handle 13:21:14 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:14 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:14 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:14 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:14 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) ** 1 printk messages dropped ** [ 944.669964] binder: 13093:13098 got transaction to invalid handle 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:14 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:14 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:14 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:14 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:14 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 3 printk messages dropped ** [ 944.811101] binder: 13130:13137 got transaction to invalid handle 13:21:14 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:14 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:14 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:14 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:14 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 3 printk messages dropped ** [ 944.963218] binder: 13177:13186 got transaction to invalid handle 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:14 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:14 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:14 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:14 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) ** 1 printk messages dropped ** [ 945.025851] binder: 13198:13210 got transaction to invalid handle 13:21:14 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:14 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:14 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:14 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:14 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 945.025860] binder: 13198:13210 transaction failed 29201/-22, size 80-24 line 3013 13:21:14 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:14 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:14 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 945.102325] binder: 13223:13236 got transaction to invalid handle [ 945.102334] binder: 13223:13236 transaction failed 29201/-22, size 80-24 line 3013 13:21:14 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:14 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 945.155028] binder: 13247:13251 got transaction to invalid handle 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:14 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:14 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:14 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:14 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 1 printk messages dropped ** [ 945.227068] binder: 13261:13274 got transaction to invalid handle 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:14 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:14 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:14 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:14 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 945.227077] binder: 13261:13274 transaction failed 29201/-22, size 80-24 line 3013 13:21:14 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:14 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:15 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:15 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 945.318173] binder: 13286:13299 got transaction to invalid handle 13:21:15 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:15 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:15 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:15 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:15 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:15 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) [ 945.318182] binder: 13286:13299 transaction failed 29201/-22, size 80-24 line 3013 [ 945.382375] binder: 13316:13321 got transaction to invalid handle 13:21:15 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:15 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:15 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:15 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:15 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) [ 945.382384] binder: 13316:13321 transaction failed 29201/-22, size 80-24 line 3013 13:21:15 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:15 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:15 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:15 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:15 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:15 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:15 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:15 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) [ 945.444895] binder: 13340:13349 got transaction to invalid handle ** 1 printk messages dropped ** [ 945.511384] binder: 13356:13363 got transaction to invalid handle 13:21:15 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:15 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:15 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) 13:21:15 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:15 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:15 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) ** 1 printk messages dropped ** [ 945.582090] binder: 13382:13386 got transaction to invalid handle 13:21:15 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000ee00973a002701010000d49ed706000000000028c9edff7cdf000001010000007a6ce08b439293d0a80800000000a3fb60018d"], 0x1}}, 0x0) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 13:21:15 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x1b) socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x800007, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x5f, 0x0) r3 = socket$inet(0x2, 0x4000000000000801, 0x0) clock_gettime(0x0, 0x0) ioctl$IOC_PR_RESERVE(0xffffffffffffffff, 0x401070c9, &(0x7f00000000c0)={0x6}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007ff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r3, 0x0, 0x2d9, 0x0, 0x0, 0x24d) clock_gettime(0x0, &(0x7f0000001240)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000000240), 0x45483d5a560d7693, 0x0, &(0x7f0000002a80)={0x0, r4+30000000}) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000180)) io_setup(0x0, 0x0) 13:21:15 executing program 3: syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f0000000140)={0x3, 0x7}) 13:21:15 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(0xffffffffffffffff) r2 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x7c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x0, 0x1}, @fda={0x66646185, 0xa, 0x0, 0x3d}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x2}, @decrefs={0x40046307, 0x2}, @exit_looper, @exit_looper, @free_buffer, @register_looper], 0x3d, 0x0, &(0x7f0000000180)="9ae072cfad680d370b2dfac69b593b22b2e9c89c29f9312cd73bcd3df64b0dbe3df887a956de91940b575435376631c4e69c83e2de85f7fd751487fdd7"}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) 13:21:15 executing program 5: socket$inet(0x10, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="2f0000001c000367ffffff000d00000002000000010000003f0006c91300010023000000000000005867000000050b", 0x2f}], 0x1}, 0x0) 13:21:15 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) ** 1 printk messages dropped ** [ 945.635213] binder: 13404:13410 got transaction to invalid handle ** 1 printk messages dropped ** [ 945.703108] binder: 13428:13435 got transaction to invalid handle ** 134 printk messages dropped ** [ 950.317591] binder: 14893:14916 transaction failed 29201/-22, size 80-24 line 3013 [ 950.381169] binder: 14928:14938 got transaction to invalid handle [ 950.381178] binder: 14928:14938 transaction failed 29201/-22, size 80-24 line 3013 [ 950.444493] binder: 14951:14961 got transaction to invalid handle [ 950.444503] binder: 14951:14961 transaction failed 29201/-22, size 80-24 line 3013 [ 950.478205] binder: 14967:14973 got transaction to invalid handle [ 950.478214] binder: 14967:14973 transaction failed 29201/-22, size 80-24 line 3013 [ 950.514713] binder: 14978:14984 got transaction to invalid handle [ 950.514720] binder: 14978:14984 transaction failed 29201/-22, size 80-24 line 3013 [ 950.588649] binder: 15002:15005 got transaction to invalid handle [ 950.588659] binder: 15002:15005 transaction failed 29201/-22, size 80-24 line 3013 [ 950.654359] binder: 15020:15028 got transaction to invalid handle [ 950.654368] binder: 15020:15028 transaction failed 29201/-22, size 80-24 line 3013 [ 950.752707] binder: 15051:15056 got transaction to invalid handle [ 950.752716] binder: 15051:15056 transaction failed 29201/-22, size 80-24 line 3013 [ 950.821386] binder: 15076:15086 got transaction to invalid handle [ 950.821413] binder: 15076:15086 transaction failed 29201/-22, size 80-24 line 3013 [ 951.015780] binder: 15096:15131 got transaction to invalid handle [ 951.015789] binder: 15096:15131 transaction failed 29201/-22, size 80-24 line 3013 [ 951.098035] binder: 15152:15170 got transaction to invalid handle [ 951.098047] binder: 15152:15170 transaction failed 29201/-22, size 80-24 line 3013 [ 951.158714] binder: 15186:15190 got transaction to invalid handle [ 951.158724] binder: 15186:15190 transaction failed 29201/-22, size 80-24 line 3013 [ 951.228882] binder: 15206:15209 got transaction to invalid handle [ 951.228891] binder: 15206:15209 transaction failed 29201/-22, size 80-24 line 3013 [ 951.310758] binder: 15227:15236 got transaction to invalid handle [ 951.310766] binder: 15227:15236 transaction failed 29201/-22, size 80-24 line 3013 [ 951.374369] binder: 15249:15256 got transaction to invalid handle [ 951.374380] binder: 15249:15256 transaction failed 29201/-22, size 80-24 line 3013 [ 951.458986] binder: 15271:15276 got transaction to invalid handle [ 951.458996] binder: 15271:15276 transaction failed 29201/-22, size 80-24 line 3013 [ 951.530273] binder: 15295:15299 got transaction to invalid handle [ 951.530282] binder: 15295:15299 transaction failed 29201/-22, size 80-24 line 3013 [ 951.595826] binder: 15312:15314 got transaction to invalid handle [ 951.595834] binder: 15312:15314 transaction failed 29201/-22, size 80-24 line 3013 [ 951.662127] binder: 15339:15343 got transaction to invalid handle [ 951.662135] binder: 15339:15343 transaction failed 29201/-22, size 80-24 line 3013 [ 951.739615] binder: 15354:15362 got transaction to invalid handle [ 951.739625] binder: 15354:15362 transaction failed 29201/-22, size 80-24 line 3013 [ 951.831624] binder: 15382:15383 got transaction to invalid handle [ 951.831633] binder: 15382:15383 transaction failed 29201/-22, size 80-24 line 3013 [ 951.897610] binder: 15406:15417 got transaction to invalid handle [ 951.897618] binder: 15406:15417 transaction failed 29201/-22, size 80-24 line 3013 [ 952.047578] binder: 15447:15460 got transaction to invalid handle [ 952.047585] binder: 15447:15460 transaction failed 29201/-22, size 80-24 line 3013 [ 952.121889] binder: 15473:15475 got transaction to invalid handle [ 952.121898] binder: 15473:15475 transaction failed 29201/-22, size 80-24 line 3013 [ 952.179922] binder: 15496:15506 got transaction to invalid handle [ 952.179930] binder: 15496:15506 transaction failed 29201/-22, size 80-24 line 3013 [ 952.244943] binder: 15511:15521 got transaction to invalid handle [ 952.244952] binder: 15511:15521 transaction failed 29201/-22, size 80-24 line 3013 [ 952.335523] binder: 15544:15552 got transaction to invalid handle [ 952.335533] binder: 15544:15552 transaction failed 29201/-22, size 80-24 line 3013 [ 952.399713] binder: 15568:15571 got transaction to invalid handle [ 952.399722] binder: 15568:15571 transaction failed 29201/-22, size 80-24 line 3013 [ 952.467981] binder: 15590:15602 got transaction to invalid handle [ 952.467990] binder: 15590:15602 transaction failed 29201/-22, size 80-24 line 3013 [ 952.596108] binder: 15620:15628 got transaction to invalid handle [ 952.596117] binder: 15620:15628 transaction failed 29201/-22, size 80-24 line 3013 [ 952.695101] binder: 15668:15672 got transaction to invalid handle [ 952.695110] binder: 15668:15672 transaction failed 29201/-22, size 80-24 line 3013 [ 952.757599] binder: 15682:15693 got transaction to invalid handle [ 952.757608] binder: 15682:15693 transaction failed 29201/-22, size 80-24 line 3013 [ 952.820016] binder: 15705:15707 got transaction to invalid handle [ 952.820028] binder: 15705:15707 transaction failed 29201/-22, size 80-24 line 3013 [ 952.935645] binder: 15732:15737 got transaction to invalid handle [ 952.935654] binder: 15732:15737 transaction failed 29201/-22, size 80-24 line 3013 [ 953.124128] binder: 15770:15784 got transaction to invalid handle [ 953.124138] binder: 15770:15784 transaction failed 29201/-22, size 80-24 line 3013 [ 953.178618] binder: 15794:15798 got transaction to invalid handle [ 953.178627] binder: 15794:15798 transaction failed 29201/-22, size 80-24 line 3013 [ 953.255053] binder: 15817:15820 got transaction to invalid handle [ 953.255062] binder: 15817:15820 transaction failed 29201/-22, size 80-24 line 3013 [ 953.287402] binder: 15837:15839 got transaction to invalid handle [ 953.287410] binder: 15837:15839 transaction failed 29201/-22, size 80-24 line 3013 [ 953.350398] binder: 15847:15856 got transaction to invalid handle [ 953.350406] binder: 15847:15856 transaction failed 29201/-22, size 80-24 line 3013 [ 953.455751] binder: 15871:15874 got transaction to invalid handle [ 953.455760] binder: 15871:15874 transaction failed 29201/-22, size 80-24 line 3013 [ 953.534673] binder: 15900:15908 got transaction to invalid handle [ 953.534684] binder: 15900:15908 transaction failed 29201/-22, size 80-24 line 3013 [ 953.583743] binder: 15920:15922 got transaction to invalid handle [ 953.583752] binder: 15920:15922 transaction failed 29201/-22, size 80-24 line 3013 [ 953.656900] binder: 15933:15943 got transaction to invalid handle [ 953.656909] binder: 15933:15943 transaction failed 29201/-22, size 80-24 line 3013 [ 953.727400] binder: 15952:15960 got transaction to invalid handle [ 953.727409] binder: 15952:15960 transaction failed 29201/-22, size 80-24 line 3013 [ 953.797331] binder: 15984:15987 got transaction to invalid handle [ 953.797340] binder: 15984:15987 transaction failed 29201/-22, size 80-24 line 3013 [ 953.877699] binder: 15998:16000 got transaction to invalid handle [ 953.877710] binder: 15998:16000 transaction failed 29201/-22, size 80-24 line 3013 [ 953.961372] binder: 16022:16024 got transaction to invalid handle [ 953.961382] binder: 16022:16024 transaction failed 29201/-22, size 80-24 line 3013 [ 954.004852] binder: 16039:16048 got transaction to invalid handle [ 954.004861] binder: 16039:16048 transaction failed 29201/-22, size 80-24 line 3013 [ 954.050060] binder: 16054:16059 got transaction to invalid handle [ 954.050069] binder: 16054:16059 transaction failed 29201/-22, size 80-24 line 3013 [ 954.117504] binder: 16069:16077 got transaction to invalid handle [ 954.117512] binder: 16069:16077 transaction failed 29201/-22, size 80-24 line 3013 [ 954.168801] binder: 16090:16097 got transaction to invalid handle [ 954.168810] binder: 16090:16097 transaction failed 29201/-22, size 80-24 line 3013 [ 954.238351] binder: 16108:16112 got transaction to invalid handle [ 954.238362] binder: 16108:16112 transaction failed 29201/-22, size 80-24 line 3013 [ 954.330867] binder: 16139:16144 got transaction to invalid handle [ 954.330879] binder: 16139:16144 transaction failed 29201/-22, size 80-24 line 3013 [ 954.385119] binder: 16154:16157 got transaction to invalid handle [ 954.385127] binder: 16154:16157 transaction failed 29201/-22, size 80-24 line 3013 [ 954.417894] binder: 16172:16175 got transaction to invalid handle [ 954.417902] binder: 16172:16175 transaction failed 29201/-22, size 80-24 line 3013 [ 954.492218] binder: 16187:16191 got transaction to invalid handle [ 954.492228] binder: 16187:16191 transaction failed 29201/-22, size 80-24 line 3013 [ 954.540412] binder: 16208:16212 got transaction to invalid handle [ 954.540421] binder: 16208:16212 transaction failed 29201/-22, size 80-24 line 3013 [ 954.590002] binder: 16218:16226 got transaction to invalid handle [ 954.590015] binder: 16218:16226 transaction failed 29201/-22, size 80-24 line 3013 [ 954.640329] binder: 16239:16242 got transaction to invalid handle [ 954.640338] binder: 16239:16242 transaction failed 29201/-22, size 80-24 line 3013 [ 954.719034] binder: 16255:16264 got transaction to invalid handle [ 954.719043] binder: 16255:16264 transaction failed 29201/-22, size 80-24 line 3013 [ 954.803541] binder: 16273:16275 got transaction to invalid handle [ 954.803549] binder: 16273:16275 transaction failed 29201/-22, size 80-24 line 3013 [ 954.865035] binder: 16309:16316 got transaction to invalid handle [ 954.865043] binder: 16309:16316 transaction failed 29201/-22, size 80-24 line 3013 [ 954.908487] binder: 16324:16333 got transaction to invalid handle [ 954.908496] binder: 16324:16333 transaction failed 29201/-22, size 80-24 line 3013 [ 954.978910] binder: 16344:16352 got transaction to invalid handle [ 954.978919] binder: 16344:16352 transaction failed 29201/-22, size 80-24 line 3013 [ 955.033821] binder: 16367:16371 got transaction to invalid handle [ 955.033830] binder: 16367:16371 transaction failed 29201/-22, size 80-24 line 3013 [ 955.092871] binder: 16383:16390 got transaction to invalid handle [ 955.092879] binder: 16383:16390 transaction failed 29201/-22, size 80-24 line 3013 [ 955.157846] binder: 16407:16415 got transaction to invalid handle [ 955.157855] binder: 16407:16415 transaction failed 29201/-22, size 80-24 line 3013 [ 955.238496] binder: 16439:16443 got transaction to invalid handle [ 955.238505] binder: 16439:16443 transaction failed 29201/-22, size 80-24 line 3013 [ 955.293443] binder: 16458:16464 got transaction to invalid handle [ 955.293453] binder: 16458:16464 transaction failed 29201/-22, size 80-24 line 3013 [ 955.385157] binder: 16481:16490 got transaction to invalid handle [ 955.385167] binder: 16481:16490 transaction failed 29201/-22, size 80-24 line 3013 [ 955.460852] binder: 16505:16512 got transaction to invalid handle [ 955.460863] binder: 16505:16512 transaction failed 29201/-22, size 80-24 line 3013 [ 955.511237] binder: 16523:16530 got transaction to invalid handle [ 955.511248] binder: 16523:16530 transaction failed 29201/-22, size 80-24 line 3013 [ 955.622279] binder: 16545:16563 got transaction to invalid handle [ 955.622288] binder: 16545:16563 transaction failed 29201/-22, size 80-24 line 3013 [ 955.661545] binder: 16578:16582 got transaction to invalid handle [ 955.661554] binder: 16578:16582 transaction failed 29201/-22, size 80-24 line 3013 [ 955.761533] binder: 16600:16604 got transaction to invalid handle [ 955.761543] binder: 16600:16604 transaction failed 29201/-22, size 80-24 line 3013 [ 955.828803] binder: 16625:16632 got transaction to invalid handle [ 955.828813] binder: 16625:16632 transaction failed 29201/-22, size 80-24 line 3013 [ 955.925753] binder: 16653:16659 got transaction to invalid handle [ 955.925763] binder: 16653:16659 transaction failed 29201/-22, size 80-24 line 3013 [ 955.966770] binder: 16666:16674 got transaction to invalid handle [ 955.966780] binder: 16666:16674 transaction failed 29201/-22, size 80-24 line 3013 [ 955.997540] binder: 16681:16687 got transaction to invalid handle [ 955.997549] binder: 16681:16687 transaction failed 29201/-22, size 80-24 line 3013 [ 956.070510] binder: 16698:16706 got transaction to invalid handle [ 956.070521] binder: 16698:16706 transaction failed 29201/-22, size 80-24 line 3013 [ 956.185079] binder: 16730:16742 got transaction to invalid handle [ 956.185086] binder: 16730:16742 transaction failed 29201/-22, size 80-24 line 3013 [ 956.233323] binder: 16754:16760 got transaction to invalid handle [ 956.233332] binder: 16754:16760 transaction failed 29201/-22, size 80-24 line 3013 [ 956.289562] binder: 16767:16782 got transaction to invalid handle [ 956.289573] binder: 16767:16782 transaction failed 29201/-22, size 80-24 line 3013 [ 956.376379] binder: 16793:16802 got transaction to invalid handle [ 956.376389] binder: 16793:16802 transaction failed 29201/-22, size 80-24 line 3013 [ 956.444447] binder: 16823:16831 got transaction to invalid handle [ 956.444456] binder: 16823:16831 transaction failed 29201/-22, size 80-24 line 3013 [ 956.547834] binder: 16844:16849 got transaction to invalid handle [ 956.547843] binder: 16844:16849 transaction failed 29201/-22, size 80-24 line 3013 [ 956.654628] binder: 16864:16873 got transaction to invalid handle [ 956.654636] binder: 16864:16873 transaction failed 29201/-22, size 80-24 line 3013 [ 956.708385] binder: 16888:16893 got transaction to invalid handle [ 956.708394] binder: 16888:16893 transaction failed 29201/-22, size 80-24 line 3013 [ 956.760212] binder: 16907:16911 got transaction to invalid handle [ 956.760222] binder: 16907:16911 transaction failed 29201/-22, size 80-24 line 3013 [ 956.812023] binder: 16921:16929 got transaction to invalid handle [ 956.812033] binder: 16921:16929 transaction failed 29201/-22, size 80-24 line 3013 [ 956.880219] binder: 16940:16948 got transaction to invalid handle [ 956.880228] binder: 16940:16948 transaction failed 29201/-22, size 80-24 line 3013 [ 956.975269] binder: 16965:16976 got transaction to invalid handle [ 956.975278] binder: 16965:16976 transaction failed 29201/-22, size 80-24 line 3013 [ 957.073667] binder: 16988:17002 got transaction to invalid handle [ 957.073675] binder: 16988:17002 transaction failed 29201/-22, size 80-24 line 3013 [ 957.138999] binder: 17020:17028 got transaction to invalid handle [ 957.139008] binder: 17020:17028 transaction failed 29201/-22, size 80-24 line 3013 [ 957.196012] binder: 17035:17040 got transaction to invalid handle [ 957.196022] binder: 17035:17040 transaction failed 29201/-22, size 80-24 line 3013 [ 957.240477] binder: 17048:17054 got transaction to invalid handle [ 957.240486] binder: 17048:17054 transaction failed 29201/-22, size 80-24 line 3013 [ 957.313220] binder: 17067:17072 got transaction to invalid handle [ 957.313229] binder: 17067:17072 transaction failed 29201/-22, size 80-24 line 3013 [ 957.390597] binder: 17088:17092 got transaction to invalid handle [ 957.390606] binder: 17088:17092 transaction failed 29201/-22, size 80-24 line 3013 [ 957.448935] binder: 17103:17118 got transaction to invalid handle [ 957.448945] binder: 17103:17118 transaction failed 29201/-22, size 80-24 line 3013 [ 957.536460] binder: 17135:17148 got transaction to invalid handle [ 957.536469] binder: 17135:17148 transaction failed 29201/-22, size 80-24 line 3013 [ 957.630927] binder: 17163:17173 got transaction to invalid handle [ 957.630935] binder: 17163:17173 transaction failed 29201/-22, size 80-24 line 3013 [ 957.703129] binder: 17191:17198 got transaction to invalid handle [ 957.703139] binder: 17191:17198 transaction failed 29201/-22, size 80-24 line 3013 [ 957.767011] binder: 17205:17210 got transaction to invalid handle [ 957.767019] binder: 17205:17210 transaction failed 29201/-22, size 80-24 line 3013 [ 957.904383] binder: 17238:17253 got transaction to invalid handle [ 957.904392] binder: 17238:17253 transaction failed 29201/-22, size 80-24 line 3013 [ 957.986711] binder: 17270:17280 got transaction to invalid handle [ 957.986719] binder: 17270:17280 transaction failed 29201/-22, size 80-24 line 3013 [ 958.076997] binder: 17296:17310 got transaction to invalid handle [ 958.077008] binder: 17296:17310 transaction failed 29201/-22, size 80-24 line 3013 [ 958.114764] binder: 17316:17320 got transaction to invalid handle [ 958.114773] binder: 17316:17320 transaction failed 29201/-22, size 80-24 line 3013 [ 958.174366] binder: 17332:17342 got transaction to invalid handle [ 958.174376] binder: 17332:17342 transaction failed 29201/-22, size 80-24 line 3013 [ 958.238436] binder: 17355:17359 got transaction to invalid handle [ 958.238445] binder: 17355:17359 transaction failed 29201/-22, size 80-24 line 3013 [ 958.324513] binder: 17381:17393 got transaction to invalid handle [ 958.324522] binder: 17381:17393 transaction failed 29201/-22, size 80-24 line 3013 [ 958.392390] binder: 17404:17409 got transaction to invalid handle [ 958.392398] binder: 17404:17409 transaction failed 29201/-22, size 80-24 line 3013 [ 958.447847] binder: 17429:17433 got transaction to invalid handle [ 958.447855] binder: 17429:17433 transaction failed 29201/-22, size 80-24 line 3013 [ 958.506866] binder: 17437:17452 got transaction to invalid handle [ 958.506874] binder: 17437:17452 transaction failed 29201/-22, size 80-24 line 3013 [ 958.536838] binder: 17457:17463 got transaction to invalid handle [ 958.536847] binder: 17457:17463 transaction failed 29201/-22, size 80-24 line 3013 [ 958.636505] binder: 17480:17500 got transaction to invalid handle [ 958.636515] binder: 17480:17500 transaction failed 29201/-22, size 80-24 line 3013 [ 958.716146] binder: 17513:17522 got transaction to invalid handle [ 958.716155] binder: 17513:17522 transaction failed 29201/-22, size 80-24 line 3013 [ 958.799418] binder: 17537:17548 got transaction to invalid handle [ 958.799427] binder: 17537:17548 transaction failed 29201/-22, size 80-24 line 3013 [ 958.878887] binder: 17566:17575 got transaction to invalid handle [ 958.878897] binder: 17566:17575 transaction failed 29201/-22, size 80-24 line 3013 [ 958.946228] binder: 17586:17589 got transaction to invalid handle [ 958.946236] binder: 17586:17589 transaction failed 29201/-22, size 80-24 line 3013 [ 958.995713] binder: 17605:17609 got transaction to invalid handle [ 958.995722] binder: 17605:17609 transaction failed 29201/-22, size 80-24 line 3013 [ 959.102796] binder: 17626:17634 got transaction to invalid handle [ 959.102805] binder: 17626:17634 transaction failed 29201/-22, size 80-24 line 3013 [ 959.184544] binder: 17657:17662 got transaction to invalid handle [ 959.184553] binder: 17657:17662 transaction failed 29201/-22, size 80-24 line 3013 [ 959.302925] binder: 17673:17694 got transaction to invalid handle [ 959.302935] binder: 17673:17694 transaction failed 29201/-22, size 80-24 line 3013 [ 959.376761] binder: 17714:17719 got transaction to invalid handle [ 959.376770] binder: 17714:17719 transaction failed 29201/-22, size 80-24 line 3013 [ 959.486118] binder: 17740:17745 got transaction to invalid handle [ 959.486127] binder: 17740:17745 transaction failed 29201/-22, size 80-24 line 3013 [ 959.562458] binder: 17766:17774 got transaction to invalid handle [ 959.562467] binder: 17766:17774 transaction failed 29201/-22, size 80-24 line 3013 [ 959.604771] binder: 17787:17794 got transaction to invalid handle [ 959.604780] binder: 17787:17794 transaction failed 29201/-22, size 80-24 line 3013 [ 959.699970] binder: 17810:17821 got transaction to invalid handle [ 959.699979] binder: 17810:17821 transaction failed 29201/-22, size 80-24 line 3013 [ 959.781872] binder: 17840:17844 got transaction to invalid handle [ 959.781883] binder: 17840:17844 transaction failed 29201/-22, size 80-24 line 3013 [ 959.880202] binder: 17866:17868 got transaction to invalid handle [ 959.880210] binder: 17866:17868 transaction failed 29201/-22, size 80-24 line 3013 [ 959.944141] binder: 17891:17897 got transaction to invalid handle [ 959.944151] binder: 17891:17897 transaction failed 29201/-22, size 80-24 line 3013 [ 960.023627] binder: 17909:17915 got transaction to invalid handle [ 960.023635] binder: 17909:17915 transaction failed 29201/-22, size 80-24 line 3013 [ 960.094293] binder: 17923:17930 got transaction to invalid handle [ 960.094301] binder: 17923:17930 transaction failed 29201/-22, size 80-24 line 3013 [ 960.133114] binder: 17946:17948 got transaction to invalid handle [ 960.133123] binder: 17946:17948 transaction failed 29201/-22, size 80-24 line 3013 [ 960.195693] binder: 17961:17963 got transaction to invalid handle [ 960.195701] binder: 17961:17963 transaction failed 29201/-22, size 80-24 line 3013 [ 960.283670] binder: 17986:17996 got transaction to invalid handle [ 960.283680] binder: 17986:17996 transaction failed 29201/-22, size 80-24 line 3013 [ 960.341205] binder: 18007:18008 got transaction to invalid handle [ 960.341215] binder: 18007:18008 transaction failed 29201/-22, size 80-24 line 3013 [ 960.469559] binder: 18020:18042 got transaction to invalid handle [ 960.469571] binder: 18020:18042 transaction failed 29201/-22, size 80-24 line 3013 [ 960.533193] binder: 18053:18062 got transaction to invalid handle [ 960.533203] binder: 18053:18062 transaction failed 29201/-22, size 80-24 line 3013 [ 960.593698] binder: 18075:18077 got transaction to invalid handle [ 960.593706] binder: 18075:18077 transaction failed 29201/-22, size 80-24 line 3013 [ 960.649459] binder: 18090:18097 got transaction to invalid handle [ 960.649468] binder: 18090:18097 transaction failed 29201/-22, size 80-24 line 3013 [ 960.707626] binder: 18106:18115 got transaction to invalid handle [ 960.707634] binder: 18106:18115 transaction failed 29201/-22, size 80-24 line 3013 [ 960.762117] binder: 18123:18129 got transaction to invalid handle [ 960.762131] binder: 18123:18129 transaction failed 29201/-22, size 80-24 line 3013 [ 960.878503] binder: 18146:18157 got transaction to invalid handle [ 960.878511] binder: 18146:18157 transaction failed 29201/-22, size 80-24 line 3013 [ 960.942287] binder: 18171:18176 got transaction to invalid handle [ 960.942297] binder: 18171:18176 transaction failed 29201/-22, size 80-24 line 3013 [ 960.994523] binder: 18189:18195 got transaction to invalid handle [ 960.994532] binder: 18189:18195 transaction failed 29201/-22, size 80-24 line 3013 [ 961.098602] binder: 18205:18212 got transaction to invalid handle [ 961.098612] binder: 18205:18212 transaction failed 29201/-22, size 80-24 line 3013 [ 961.202514] binder: 18253:18261 got transaction to invalid handle [ 961.202526] binder: 18253:18261 transaction failed 29201/-22, size 80-24 line 3013 [ 961.263664] binder: 18272:18281 got transaction to invalid handle [ 961.263672] binder: 18272:18281 transaction failed 29201/-22, size 80-24 line 3013 [ 961.356645] binder: 18294:18301 got transaction to invalid handle [ 961.356655] binder: 18294:18301 transaction failed 29201/-22, size 80-24 line 3013 [ 961.402338] binder: 18322:18323 got transaction to invalid handle [ 961.402346] binder: 18322:18323 transaction failed 29201/-22, size 80-24 line 3013 [ 961.490218] binder: 18342:18348 got transaction to invalid handle [ 961.490226] binder: 18342:18348 transaction failed 29201/-22, size 80-24 line 3013 [ 961.543076] binder: 18363:18368 got transaction to invalid handle [ 961.543084] binder: 18363:18368 transaction failed 29201/-22, size 80-24 line 3013 [ 961.625769] binder: 18384:18390 got transaction to invalid handle [ 961.625777] binder: 18384:18390 transaction failed 29201/-22, size 80-24 line 3013 [ 961.671374] binder: 18394:18403 got transaction to invalid handle [ 961.671383] binder: 18394:18403 transaction failed 29201/-22, size 80-24 line 3013 [ 961.793022] binder: 18419:18440 got transaction to invalid handle [ 961.793032] binder: 18419:18440 transaction failed 29201/-22, size 80-24 line 3013 [ 961.899002] binder: 18444:18460 got transaction to invalid handle [ 961.899012] binder: 18444:18460 transaction failed 29201/-22, size 80-24 line 3013 [ 961.956775] binder: 18470:18481 got transaction to invalid handle [ 961.956785] binder: 18470:18481 transaction failed 29201/-22, size 80-24 line 3013 [ 962.028148] binder: 18498:18504 got transaction to invalid handle [ 962.028159] binder: 18498:18504 transaction failed 29201/-22, size 80-24 line 3013 [ 962.173878] binder: 18541:18544 got transaction to invalid handle [ 962.173887] binder: 18541:18544 transaction failed 29201/-22, size 80-24 line 3013 [ 962.216724] binder: 18555:18560 got transaction to invalid handle [ 962.216735] binder: 18555:18560 transaction failed 29201/-22, size 80-24 line 3013 [ 962.298783] binder: 18575:18590 got transaction to invalid handle [ 962.298792] binder: 18575:18590 transaction failed 29201/-22, size 80-24 line 3013 [ 962.403789] binder: 18613:18616 got transaction to invalid handle [ 962.403797] binder: 18613:18616 transaction failed 29201/-22, size 80-24 line 3013 [ 962.536809] binder: 18636:18645 got transaction to invalid handle [ 962.536817] binder: 18636:18645 transaction failed 29201/-22, size 80-24 line 3013 [ 962.599284] binder: 18671:18676 got transaction to invalid handle [ 962.599293] binder: 18671:18676 transaction failed 29201/-22, size 80-24 line 3013 [ 962.666765] binder: 18694:18698 got transaction to invalid handle [ 962.666773] binder: 18694:18698 transaction failed 29201/-22, size 80-24 line 3013 [ 962.719145] binder: 18710:18712 got transaction to invalid handle [ 962.719162] binder: 18710:18712 transaction failed 29201/-22, size 80-24 line 3013 [ 962.766825] binder: 18724:18730 got transaction to invalid handle [ 962.766834] binder: 18724:18730 transaction failed 29201/-22, size 80-24 line 3013 [ 962.794649] binder: 18735:18741 got transaction to invalid handle [ 962.794659] binder: 18735:18741 transaction failed 29201/-22, size 80-24 line 3013 [ 962.864124] binder: 18753:18758 got transaction to invalid handle [ 962.864133] binder: 18753:18758 transaction failed 29201/-22, size 80-24 line 3013 [ 962.944735] binder: 18774:18785 got transaction to invalid handle [ 962.944745] binder: 18774:18785 transaction failed 29201/-22, size 80-24 line 3013 [ 962.991798] binder: 18795:18801 got transaction to invalid handle [ 962.991807] binder: 18795:18801 transaction failed 29201/-22, size 80-24 line 3013 [ 963.029954] binder: 18811:18812 got transaction to invalid handle [ 963.029962] binder: 18811:18812 transaction failed 29201/-22, size 80-24 line 3013 [ 963.068483] binder: 18829:18836 got transaction to invalid handle [ 963.068492] binder: 18829:18836 transaction failed 29201/-22, size 80-24 line 3013 [ 963.108539] binder: 18844:18847 got transaction to invalid handle [ 963.108549] binder: 18844:18847 transaction failed 29201/-22, size 80-24 line 3013 [ 963.150806] binder: 18857:18860 got transaction to invalid handle [ 963.150814] binder: 18857:18860 transaction failed 29201/-22, size 80-24 line 3013 [ 963.203284] binder: 18868:18872 got transaction to invalid handle [ 963.203291] binder: 18868:18872 transaction failed 29201/-22, size 80-24 line 3013 [ 963.261115] binder: 18888:18892 got transaction to invalid handle [ 963.261126] binder: 18888:18892 transaction failed 29201/-22, size 80-24 line 3013 [ 963.357502] binder: 18903:18907 got transaction to invalid handle [ 963.357513] binder: 18903:18907 transaction failed 29201/-22, size 80-24 line 3013 [ 963.408915] binder: 18928:18934 got transaction to invalid handle [ 963.408925] binder: 18928:18934 transaction failed 29201/-22, size 80-24 line 3013 [ 963.513628] binder: 18955:18962 got transaction to invalid handle [ 963.513639] binder: 18955:18962 transaction failed 29201/-22, size 80-24 line 3013 [ 963.558237] binder: 18974:18975 got transaction to invalid handle [ 963.558246] binder: 18974:18975 transaction failed 29201/-22, size 80-24 line 3013 [ 963.607048] binder: 18985:18990 got transaction to invalid handle [ 963.607056] binder: 18985:18990 transaction failed 29201/-22, size 80-24 line 3013 [ 963.671147] binder: 18998:19010 got transaction to invalid handle [ 963.671158] binder: 18998:19010 transaction failed 29201/-22, size 80-24 line 3013 [ 963.753259] binder: 19034:19040 got transaction to invalid handle [ 963.753268] binder: 19034:19040 transaction failed 29201/-22, size 80-24 line 3013 [ 963.800126] binder: 19050:19055 got transaction to invalid handle [ 963.800134] binder: 19050:19055 transaction failed 29201/-22, size 80-24 line 3013 [ 963.863945] binder: 19068:19077 got transaction to invalid handle [ 963.863954] binder: 19068:19077 transaction failed 29201/-22, size 80-24 line 3013 [ 963.913393] binder: 19088:19094 got transaction to invalid handle [ 963.913405] binder: 19088:19094 transaction failed 29201/-22, size 80-24 line 3013 [ 964.008384] binder: 19115:19126 got transaction to invalid handle [ 964.008394] binder: 19115:19126 transaction failed 29201/-22, size 80-24 line 3013 [ 964.116719] binder: 19154:19161 got transaction to invalid handle [ 964.116727] binder: 19154:19161 transaction failed 29201/-22, size 80-24 line 3013 [ 964.220691] binder: 19192:19197 got transaction to invalid handle [ 964.220700] binder: 19192:19197 transaction failed 29201/-22, size 80-24 line 3013 [ 964.324989] binder: 19212:19230 got transaction to invalid handle [ 964.324998] binder: 19212:19230 transaction failed 29201/-22, size 80-24 line 3013 [ 964.400334] binder: 19243:19251 got transaction to invalid handle [ 964.400344] binder: 19243:19251 transaction failed 29201/-22, size 80-24 line 3013 [ 964.537286] binder: 19264:19269 got transaction to invalid handle [ 964.537294] binder: 19264:19269 transaction failed 29201/-22, size 80-24 line 3013 [ 964.626137] binder: 19284:19291 got transaction to invalid handle [ 964.626145] binder: 19284:19291 transaction failed 29201/-22, size 80-24 line 3013 [ 964.724733] binder: 19311:19325 got transaction to invalid handle [ 964.724742] binder: 19311:19325 transaction failed 29201/-22, size 80-24 line 3013 [ 964.790225] binder: 19342:19345 got transaction to invalid handle [ 964.790235] binder: 19342:19345 transaction failed 29201/-22, size 80-24 line 3013 [ 964.855350] binder: 19361:19365 got transaction to invalid handle [ 964.855360] binder: 19361:19365 transaction failed 29201/-22, size 80-24 line 3013 [ 964.936776] binder: 19377:19382 got transaction to invalid handle [ 964.936787] binder: 19377:19382 transaction failed 29201/-22, size 80-24 line 3013 [ 964.984142] binder: 19403:19405 got transaction to invalid handle [ 964.984150] binder: 19403:19405 transaction failed 29201/-22, size 80-24 line 3013 [ 965.032682] binder: 19413:19421 got transaction to invalid handle [ 965.032690] binder: 19413:19421 transaction failed 29201/-22, size 80-24 line 3013 [ 965.160718] binder: 19432:19451 got transaction to invalid handle [ 965.160726] binder: 19432:19451 transaction failed 29201/-22, size 80-24 line 3013 [ 965.217379] binder: 19466:19479 got transaction to invalid handle [ 965.217389] binder: 19466:19479 transaction failed 29201/-22, size 80-24 line 3013 [ 965.285394] binder: 19488:19496 got transaction to invalid handle [ 965.285404] binder: 19488:19496 transaction failed 29201/-22, size 80-24 line 3013 [ 965.397028] binder: 19529:19531 got transaction to invalid handle [ 965.397040] binder: 19529:19531 transaction failed 29201/-22, size 80-24 line 3013 [ 965.466717] binder: 19543:19548 got transaction to invalid handle [ 965.466725] binder: 19543:19548 transaction failed 29201/-22, size 80-24 line 3013 [ 965.518041] binder: 19560:19561 got transaction to invalid handle [ 965.518050] binder: 19560:19561 transaction failed 29201/-22, size 80-24 line 3013 [ 965.579896] binder: 19577:19589 got transaction to invalid handle [ 965.579905] binder: 19577:19589 transaction failed 29201/-22, size 80-24 line 3013 [ 965.616406] binder: 19594:19596 got transaction to invalid handle [ 965.616415] binder: 19594:19596 transaction failed 29201/-22, size 80-24 line 3013 [ 965.664543] binder: 19608:19614 got transaction to invalid handle [ 965.664552] binder: 19608:19614 transaction failed 29201/-22, size 80-24 line 3013 [ 965.733804] binder: 19627:19629 got transaction to invalid handle [ 965.733814] binder: 19627:19629 transaction failed 29201/-22, size 80-24 line 3013 [ 965.766248] binder: 19639:19646 got transaction to invalid handle [ 965.766256] binder: 19639:19646 transaction failed 29201/-22, size 80-24 line 3013 [ 965.870145] binder: 19662:19671 got transaction to invalid handle [ 965.870156] binder: 19662:19671 transaction failed 29201/-22, size 80-24 line 3013 [ 965.904658] binder: 19688:19692 got transaction to invalid handle [ 965.904669] binder: 19688:19692 transaction failed 29201/-22, size 80-24 line 3013 [ 965.972625] binder: 19713:19716 got transaction to invalid handle [ 965.972634] binder: 19713:19716 transaction failed 29201/-22, size 80-24 line 3013 [ 966.039924] binder: 19731:19734 got transaction to invalid handle [ 966.039933] binder: 19731:19734 transaction failed 29201/-22, size 80-24 line 3013 [ 966.081697] binder: 19742:19750 got transaction to invalid handle [ 966.081711] binder: 19742:19750 transaction failed 29201/-22, size 80-24 line 3013 [ 966.146924] binder: 19765:19770 got transaction to invalid handle [ 966.146933] binder: 19765:19770 transaction failed 29201/-22, size 80-24 line 3013 [ 966.229323] binder: 19775:19789 got transaction to invalid handle [ 966.229332] binder: 19775:19789 transaction failed 29201/-22, size 80-24 line 3013 [ 966.253769] binder: 19800:19806 got transaction to invalid handle [ 966.253777] binder: 19800:19806 transaction failed 29201/-22, size 80-24 line 3013 [ 966.333103] binder: 19814:19826 got transaction to invalid handle [ 966.333113] binder: 19814:19826 transaction failed 29201/-22, size 80-24 line 3013 [ 966.413429] binder: 19843:19852 got transaction to invalid handle [ 966.413438] binder: 19843:19852 transaction failed 29201/-22, size 80-24 line 3013 [ 966.524911] binder: 19872:19877 got transaction to invalid handle [ 966.524920] binder: 19872:19877 transaction failed 29201/-22, size 80-24 line 3013 [ 966.644396] binder: 19902:19916 got transaction to invalid handle [ 966.644406] binder: 19902:19916 transaction failed 29201/-22, size 80-24 line 3013 [ 966.685621] binder: 19927:19934 got transaction to invalid handle [ 966.685630] binder: 19927:19934 transaction failed 29201/-22, size 80-24 line 3013 [ 966.761969] binder: 19950:19960 got transaction to invalid handle [ 966.761978] binder: 19950:19960 transaction failed 29201/-22, size 80-24 line 3013 [ 966.825744] binder: 19966:19980 got transaction to invalid handle [ 966.825753] binder: 19966:19980 transaction failed 29201/-22, size 80-24 line 3013 [ 966.897053] binder: 19999:20002 got transaction to invalid handle [ 966.897062] binder: 19999:20002 transaction failed 29201/-22, size 80-24 line 3013 [ 966.972064] binder: 20011:20024 got transaction to invalid handle [ 966.972072] binder: 20011:20024 transaction failed 29201/-22, size 80-24 line 3013 [ 967.041243] binder: 20044:20049 got transaction to invalid handle [ 967.041251] binder: 20044:20049 transaction failed 29201/-22, size 80-24 line 3013 [ 967.121206] binder: 20065:20073 got transaction to invalid handle [ 967.121216] binder: 20065:20073 transaction failed 29201/-22, size 80-24 line 3013 [ 967.251869] binder: 20087:20109 got transaction to invalid handle [ 967.251880] binder: 20087:20109 transaction failed 29201/-22, size 80-24 line 3013 [ 967.319769] binder: 20116:20126 got transaction to invalid handle [ 967.319778] binder: 20116:20126 transaction failed 29201/-22, size 80-24 line 3013 [ 967.356010] binder: 20141:20144 got transaction to invalid handle [ 967.356018] binder: 20141:20144 transaction failed 29201/-22, size 80-24 line 3013 [ 967.458082] binder: 20160:20162 got transaction to invalid handle [ 967.458092] binder: 20160:20162 transaction failed 29201/-22, size 80-24 line 3013 [ 967.510585] binder: 20180:20185 got transaction to invalid handle [ 967.510592] binder: 20180:20185 transaction failed 29201/-22, size 80-24 line 3013 [ 967.551430] binder: 20201:20205 got transaction to invalid handle [ 967.551440] binder: 20201:20205 transaction failed 29201/-22, size 80-24 line 3013 [ 967.654009] binder: 20217:20228 got transaction to invalid handle [ 967.654018] binder: 20217:20228 transaction failed 29201/-22, size 80-24 line 3013 [ 967.691159] binder: 20244:20247 got transaction to invalid handle [ 967.691167] binder: 20244:20247 transaction failed 29201/-22, size 80-24 line 3013 [ 967.830077] binder: 20261:20286 got transaction to invalid handle [ 967.830088] binder: 20261:20286 transaction failed 29201/-22, size 80-24 line 3013 [ 967.877033] binder: 20305:20311 got transaction to invalid handle [ 967.877042] binder: 20305:20311 transaction failed 29201/-22, size 80-24 line 3013 [ 967.957031] binder: 20324:20332 got transaction to invalid handle [ 967.957040] binder: 20324:20332 transaction failed 29201/-22, size 80-24 line 3013 [ 968.016848] binder: 20343:20347 got transaction to invalid handle [ 968.016858] binder: 20343:20347 transaction failed 29201/-22, size 80-24 line 3013 [ 968.085938] binder: 20364:20369 got transaction to invalid handle [ 968.085947] binder: 20364:20369 transaction failed 29201/-22, size 80-24 line 3013 [ 968.130453] binder: 20385:20390 got transaction to invalid handle [ 968.130461] binder: 20385:20390 transaction failed 29201/-22, size 80-24 line 3013 [ 968.218063] binder: 20402:20414 got transaction to invalid handle [ 968.218075] binder: 20402:20414 transaction failed 29201/-22, size 80-24 line 3013 [ 968.342759] binder: 20436:20440 got transaction to invalid handle [ 968.342768] binder: 20436:20440 transaction failed 29201/-22, size 80-24 line 3013 [ 968.387063] binder: 20460:20464 got transaction to invalid handle [ 968.387073] binder: 20460:20464 transaction failed 29201/-22, size 80-24 line 3013 [ 968.439238] binder: 20469:20479 got transaction to invalid handle [ 968.439247] binder: 20469:20479 transaction failed 29201/-22, size 80-24 line 3013 [ 968.485942] binder: 20491:20496 got transaction to invalid handle [ 968.485952] binder: 20491:20496 transaction failed 29201/-22, size 80-24 line 3013 [ 968.561901] binder: 20508:20513 got transaction to invalid handle [ 968.561910] binder: 20508:20513 transaction failed 29201/-22, size 80-24 line 3013 [ 968.640604] binder: 20540:20544 got transaction to invalid handle [ 968.640615] binder: 20540:20544 transaction failed 29201/-22, size 80-24 line 3013 [ 968.743043] binder: 20560:20578 got transaction to invalid handle [ 968.743052] binder: 20560:20578 transaction failed 29201/-22, size 80-24 line 3013 [ 968.802728] binder: 20593:20597 got transaction to invalid handle [ 968.802736] binder: 20593:20597 transaction failed 29201/-22, size 80-24 line 3013 [ 968.889687] binder: 20606:20621 got transaction to invalid handle [ 968.889698] binder: 20606:20621 transaction failed 29201/-22, size 80-24 line 3013 [ 969.048413] binder: 20650:20657 got transaction to invalid handle [ 969.048422] binder: 20650:20657 transaction failed 29201/-22, size 80-24 line 3013 [ 969.074115] binder: 20667:20669 got transaction to invalid handle [ 969.074126] binder: 20667:20669 transaction failed 29201/-22, size 80-24 line 3013 [ 969.156569] binder: 20677:20693 got transaction to invalid handle [ 969.156577] binder: 20677:20693 transaction failed 29201/-22, size 80-24 line 3013 [ 969.246876] binder: 20708:20714 got transaction to invalid handle [ 969.246887] binder: 20708:20714 transaction failed 29201/-22, size 80-24 line 3013 [ 969.278469] binder: 20727:20729 got transaction to invalid handle [ 969.278477] binder: 20727:20729 transaction failed 29201/-22, size 80-24 line 3013 [ 969.334792] binder: 20740:20746 got transaction to invalid handle [ 969.334801] binder: 20740:20746 transaction failed 29201/-22, size 80-24 line 3013 [ 969.468889] binder: 20758:20767 got transaction to invalid handle [ 969.468898] binder: 20758:20767 transaction failed 29201/-22, size 80-24 line 3013 [ 969.531495] binder: 20786:20791 got transaction to invalid handle [ 969.531505] binder: 20786:20791 transaction failed 29201/-22, size 80-24 line 3013 [ 969.590371] binder: 20809:20815 got transaction to invalid handle [ 969.590381] binder: 20809:20815 transaction failed 29201/-22, size 80-24 line 3013 [ 969.668778] binder: 20832:20834 got transaction to invalid handle [ 969.668787] binder: 20832:20834 transaction failed 29201/-22, size 80-24 line 3013 [ 969.723718] binder: 20849:20862 got transaction to invalid handle [ 969.723727] binder: 20849:20862 transaction failed 29201/-22, size 80-24 line 3013 [ 969.776667] binder: 20865:20873 got transaction to invalid handle [ 969.776674] binder: 20865:20873 transaction failed 29201/-22, size 80-24 line 3013 [ 969.858881] binder: 20880:20885 got transaction to invalid handle [ 969.858891] binder: 20880:20885 transaction failed 29201/-22, size 80-24 line 3013 [ 969.909857] binder: 20904:20911 got transaction to invalid handle [ 969.909867] binder: 20904:20911 transaction failed 29201/-22, size 80-24 line 3013 [ 969.977084] binder: 20930:20934 got transaction to invalid handle [ 969.977096] binder: 20930:20934 transaction failed 29201/-22, size 80-24 line 3013 [ 970.048870] binder: 20943:20954 got transaction to invalid handle [ 970.048879] binder: 20943:20954 transaction failed 29201/-22, size 80-24 line 3013 [ 970.121299] binder: 20969:20974 got transaction to invalid handle [ 970.121308] binder: 20969:20974 transaction failed 29201/-22, size 80-24 line 3013 [ 970.185053] binder: 20992:20996 got transaction to invalid handle [ 970.185062] binder: 20992:20996 transaction failed 29201/-22, size 80-24 line 3013 [ 970.260802] binder: 21012:21015 got transaction to invalid handle [ 970.260809] binder: 21012:21015 transaction failed 29201/-22, size 80-24 line 3013 [ 970.388614] binder: 21044:21055 got transaction to invalid handle [ 970.388623] binder: 21044:21055 transaction failed 29201/-22, size 80-24 line 3013 [ 970.512823] binder: 21076:21091 got transaction to invalid handle [ 970.512833] binder: 21076:21091 transaction failed 29201/-22, size 80-24 line 3013 [ 970.590407] binder: 21115:21118 got transaction to invalid handle [ 970.590416] binder: 21115:21118 transaction failed 29201/-22, size 80-24 line 3013 [ 970.633332] binder: 21122:21130 got transaction to invalid handle [ 970.633340] binder: 21122:21130 transaction failed 29201/-22, size 80-24 line 3013 [ 970.735818] binder: 21141:21152 got transaction to invalid handle [ 970.735827] binder: 21141:21152 transaction failed 29201/-22, size 80-24 line 3013 [ 970.824238] binder: 21171:21183 got transaction to invalid handle [ 970.824248] binder: 21171:21183 transaction failed 29201/-22, size 80-24 line 3013 [ 970.858442] binder: 21191:21196 got transaction to invalid handle [ 970.858451] binder: 21191:21196 transaction failed 29201/-22, size 80-24 line 3013 [ 970.940357] binder: 21214:21216 got transaction to invalid handle [ 970.940367] binder: 21214:21216 transaction failed 29201/-22, size 80-24 line 3013 [ 970.987962] binder: 21226:21234 got transaction to invalid handle [ 970.987972] binder: 21226:21234 transaction failed 29201/-22, size 80-24 line 3013 [ 971.084813] binder: 21259:21264 got transaction to invalid handle [ 971.084822] binder: 21259:21264 transaction failed 29201/-22, size 80-24 line 3013 [ 971.116724] binder: 21271:21275 got transaction to invalid handle [ 971.116732] binder: 21271:21275 transaction failed 29201/-22, size 80-24 line 3013 [ 971.225836] binder: 21296:21314 got transaction to invalid handle [ 971.225846] binder: 21296:21314 transaction failed 29201/-22, size 80-24 line 3013 [ 971.278051] binder: 21320:21331 got transaction to invalid handle [ 971.278060] binder: 21320:21331 transaction failed 29201/-22, size 80-24 line 3013 [ 971.330423] binder: 21338:21341 got transaction to invalid handle [ 971.330432] binder: 21338:21341 transaction failed 29201/-22, size 80-24 line 3013 [ 971.404968] binder: 21355:21365 got transaction to invalid handle [ 971.404975] binder: 21355:21365 transaction failed 29201/-22, size 80-24 line 3013 [ 971.487751] binder: 21379:21391 got transaction to invalid handle [ 971.487760] binder: 21379:21391 transaction failed 29201/-22, size 80-24 line 3013 [ 971.556034] binder: 21403:21413 got transaction to invalid handle [ 971.556043] binder: 21403:21413 transaction failed 29201/-22, size 80-24 line 3013 [ 971.615215] binder: 21425:21433 got transaction to invalid handle [ 971.615226] binder: 21425:21433 transaction failed 29201/-22, size 80-24 line 3013 [ 971.661689] binder: 21439:21441 got transaction to invalid handle [ 971.661700] binder: 21439:21441 transaction failed 29201/-22, size 80-24 line 3013 [ 971.759661] binder: 21469:21474 got transaction to invalid handle [ 971.759669] binder: 21469:21474 transaction failed 29201/-22, size 80-24 line 3013 [ 971.803133] binder: 21485:21488 got transaction to invalid handle [ 971.803141] binder: 21485:21488 transaction failed 29201/-22, size 80-24 line 3013 [ 971.880677] binder: 21502:21512 got transaction to invalid handle [ 971.880688] binder: 21502:21512 transaction failed 29201/-22, size 80-24 line 3013 [ 971.933657] binder: 21528:21529 got transaction to invalid handle [ 971.933666] binder: 21528:21529 transaction failed 29201/-22, size 80-24 line 3013 [ 972.025647] binder: 21551:21560 got transaction to invalid handle [ 972.025655] binder: 21551:21560 transaction failed 29201/-22, size 80-24 line 3013 [ 972.076565] binder: 21570:21575 got transaction to invalid handle [ 972.076573] binder: 21570:21575 transaction failed 29201/-22, size 80-24 line 3013 [ 972.146459] binder: 21582:21590 got transaction to invalid handle [ 972.146512] binder: 21582:21590 transaction failed 29201/-22, size 80-24 line 3013 [ 972.200459] binder: 21601:21610 got transaction to invalid handle [ 972.200468] binder: 21601:21610 transaction failed 29201/-22, size 80-24 line 3013 [ 972.241322] binder: 21623:21631 got transaction to invalid handle [ 972.241333] binder: 21623:21631 transaction failed 29201/-22, size 80-24 line 3013 [ 972.318849] binder: 21638:21650 got transaction to invalid handle [ 972.318858] binder: 21638:21650 transaction failed 29201/-22, size 80-24 line 3013 [ 972.406480] binder: 21661:21677 got transaction to invalid handle [ 972.406491] binder: 21661:21677 transaction failed 29201/-22, size 80-24 line 3013 [ 972.446627] binder: 21682:21693 got transaction to invalid handle [ 972.446638] binder: 21682:21693 transaction failed 29201/-22, size 80-24 line 3013 [ 972.523965] binder: 21705:21713 got transaction to invalid handle [ 972.523975] binder: 21705:21713 transaction failed 29201/-22, size 80-24 line 3013 [ 972.589336] binder: 21726:21734 got transaction to invalid handle [ 972.589344] binder: 21726:21734 transaction failed 29201/-22, size 80-24 line 3013 [ 972.654110] binder: 21749:21753 got transaction to invalid handle [ 972.654119] binder: 21749:21753 transaction failed 29201/-22, size 80-24 line 3013 [ 972.839519] binder: 21785:21807 got transaction to invalid handle [ 972.839527] binder: 21785:21807 transaction failed 29201/-22, size 80-24 line 3013 [ 972.946451] binder: 21825:21847 got transaction to invalid handle [ 972.946462] binder: 21825:21847 transaction failed 29201/-22, size 80-24 line 3013 [ 973.020018] binder: 21854:21860 got transaction to invalid handle [ 973.020040] binder: 21854:21860 transaction failed 29201/-22, size 80-24 line 3013 [ 973.098877] binder: 21878:21883 got transaction to invalid handle [ 973.098885] binder: 21878:21883 transaction failed 29201/-22, size 80-24 line 3013 [ 973.202927] binder: 21909:21922 got transaction to invalid handle [ 973.202936] binder: 21909:21922 transaction failed 29201/-22, size 80-24 line 3013 [ 973.242565] binder: 21934:21941 got transaction to invalid handle [ 973.242574] binder: 21934:21941 transaction failed 29201/-22, size 80-24 line 3013 [ 973.319315] binder: 21953:21956 got transaction to invalid handle [ 973.319324] binder: 21953:21956 transaction failed 29201/-22, size 80-24 line 3013 [ 973.395170] binder: 21972:21984 got transaction to invalid handle [ 973.395180] binder: 21972:21984 transaction failed 29201/-22, size 80-24 line 3013 [ 973.447885] binder: 22000:22004 got transaction to invalid handle [ 973.447894] binder: 22000:22004 transaction failed 29201/-22, size 80-24 line 3013 [ 973.496073] binder: 22010:22016 got transaction to invalid handle [ 973.496081] binder: 22010:22016 transaction failed 29201/-22, size 80-24 line 3013 [ 973.540165] binder: 22026:22033 got transaction to invalid handle [ 973.540174] binder: 22026:22033 transaction failed 29201/-22, size 80-24 line 3013 [ 973.604821] binder: 22037:22047 got transaction to invalid handle [ 973.604830] binder: 22037:22047 transaction failed 29201/-22, size 80-24 line 3013 [ 973.675198] binder: 22059:22067 got transaction to invalid handle [ 973.675208] binder: 22059:22067 transaction failed 29201/-22, size 80-24 line 3013 [ 973.768319] binder: 22087:22092 got transaction to invalid handle [ 973.768330] binder: 22087:22092 transaction failed 29201/-22, size 80-24 line 3013 [ 973.869575] binder: 22112:22127 got transaction to invalid handle [ 973.869584] binder: 22112:22127 transaction failed 29201/-22, size 80-24 line 3013 [ 973.939996] binder: 22139:22142 got transaction to invalid handle [ 973.940006] binder: 22139:22142 transaction failed 29201/-22, size 80-24 line 3013 [ 974.006892] binder: 22161:22170 got transaction to invalid handle [ 974.006901] binder: 22161:22170 transaction failed 29201/-22, size 80-24 line 3013 [ 974.061601] binder: 22180:22185 got transaction to invalid handle [ 974.061611] binder: 22180:22185 transaction failed 29201/-22, size 80-24 line 3013 [ 974.134290] binder: 22197:22201 got transaction to invalid handle [ 974.134298] binder: 22197:22201 transaction failed 29201/-22, size 80-24 line 3013 [ 974.203694] binder: 22212:22222 got transaction to invalid handle [ 974.203704] binder: 22212:22222 transaction failed 29201/-22, size 80-24 line 3013 [ 974.258987] binder: 22228:22243 got transaction to invalid handle [ 974.258995] binder: 22228:22243 transaction failed 29201/-22, size 80-24 line 3013 [ 974.298361] binder: 22250:22255 got transaction to invalid handle [ 974.298371] binder: 22250:22255 transaction failed 29201/-22, size 80-24 line 3013 [ 974.345202] binder: 22264:22270 got transaction to invalid handle [ 974.345212] binder: 22264:22270 transaction failed 29201/-22, size 80-24 line 3013 [ 974.390162] binder: 22272:22274 got transaction to invalid handle [ 974.390173] binder: 22272:22274 transaction failed 29201/-22, size 80-24 line 3013 [ 974.435112] binder: 22285:22292 got transaction to invalid handle [ 974.435121] binder: 22285:22292 transaction failed 29201/-22, size 80-24 line 3013 [ 974.535136] binder: 22305:22319 got transaction to invalid handle [ 974.535146] binder: 22305:22319 transaction failed 29201/-22, size 80-24 line 3013 [ 974.628320] binder: 22332:22347 got transaction to invalid handle [ 974.628328] binder: 22332:22347 transaction failed 29201/-22, size 80-24 line 3013 [ 974.693553] binder: 22357:22359 got transaction to invalid handle [ 974.693562] binder: 22357:22359 transaction failed 29201/-22, size 80-24 line 3013 [ 974.742307] binder: 22365:22373 got transaction to invalid handle [ 974.742316] binder: 22365:22373 transaction failed 29201/-22, size 80-24 line 3013 [ 974.841888] binder: 22396:22401 got transaction to invalid handle [ 974.841895] binder: 22396:22401 transaction failed 29201/-22, size 80-24 line 3013 [ 974.912445] binder: 22412:22419 got transaction to invalid handle [ 974.912454] binder: 22412:22419 transaction failed 29201/-22, size 80-24 line 3013 [ 974.976537] binder: 22425:22438 got transaction to invalid handle [ 974.976545] binder: 22425:22438 transaction failed 29201/-22, size 80-24 line 3013 [ 975.102218] binder: 22447:22468 got transaction to invalid handle [ 975.102227] binder: 22447:22468 transaction failed 29201/-22, size 80-24 line 3013 [ 975.165094] binder: 22483:22490 got transaction to invalid handle [ 975.165102] binder: 22483:22490 transaction failed 29201/-22, size 80-24 line 3013 [ 975.254497] binder: 22514:22519 got transaction to invalid handle [ 975.254506] binder: 22514:22519 transaction failed 29201/-22, size 80-24 line 3013 [ 975.351899] binder: 22532:22544 got transaction to invalid handle [ 975.351909] binder: 22532:22544 transaction failed 29201/-22, size 80-24 line 3013 [ 975.420916] binder: 22567:22569 got transaction to invalid handle [ 975.420926] binder: 22567:22569 transaction failed 29201/-22, size 80-24 line 3013 [ 975.464810] binder: 22582:22585 got transaction to invalid handle [ 975.464820] binder: 22582:22585 transaction failed 29201/-22, size 80-24 line 3013 [ 975.512203] binder: 22598:22601 got transaction to invalid handle [ 975.512211] binder: 22598:22601 transaction failed 29201/-22, size 80-24 line 3013 [ 975.589966] binder: 22617:22628 got transaction to invalid handle [ 975.589974] binder: 22617:22628 transaction failed 29201/-22, size 80-24 line 3013 [ 975.740161] binder: 22636:22653 got transaction to invalid handle [ 975.740171] binder: 22636:22653 transaction failed 29201/-22, size 80-24 line 3013 [ 975.820225] binder: 22681:22684 got transaction to invalid handle [ 975.820233] binder: 22681:22684 transaction failed 29201/-22, size 80-24 line 3013 [ 975.888274] binder: 22703:22708 got transaction to invalid handle [ 975.888282] binder: 22703:22708 transaction failed 29201/-22, size 80-24 line 3013 [ 975.965709] binder: 22730:22734 got transaction to invalid handle [ 975.965717] binder: 22730:22734 transaction failed 29201/-22, size 80-24 line 3013 [ 976.146254] binder: 22766:22772 got transaction to invalid handle [ 976.146262] binder: 22766:22772 transaction failed 29201/-22, size 80-24 line 3013 [ 976.199369] binder: 22786:22791 got transaction to invalid handle [ 976.199377] binder: 22786:22791 transaction failed 29201/-22, size 80-24 line 3013 [ 976.233952] binder: 22804:22809 got transaction to invalid handle [ 976.233961] binder: 22804:22809 transaction failed 29201/-22, size 80-24 line 3013 [ 976.290409] binder: 22822:22829 got transaction to invalid handle [ 976.290420] binder: 22822:22829 transaction failed 29201/-22, size 80-24 line 3013 [ 976.357037] binder: 22843:22846 got transaction to invalid handle [ 976.357048] binder: 22843:22846 transaction failed 29201/-22, size 80-24 line 3013 [ 976.453116] binder: 22874:22881 got transaction to invalid handle [ 976.453124] binder: 22874:22881 transaction failed 29201/-22, size 80-24 line 3013 [ 976.521855] binder: 22897:22901 got transaction to invalid handle [ 976.521865] binder: 22897:22901 transaction failed 29201/-22, size 80-24 line 3013 [ 976.594874] binder: 22922:22925 got transaction to invalid handle [ 976.594883] binder: 22922:22925 transaction failed 29201/-22, size 80-24 line 3013 [ 976.669131] binder: 22931:22946 got transaction to invalid handle [ 976.669141] binder: 22931:22946 transaction failed 29201/-22, size 80-24 line 3013 [ 976.749736] binder: 22965:22967 got transaction to invalid handle [ 976.749745] binder: 22965:22967 transaction failed 29201/-22, size 80-24 line 3013 [ 976.828998] binder: 22994:23000 got transaction to invalid handle [ 976.829006] binder: 22994:23000 transaction failed 29201/-22, size 80-24 line 3013 [ 976.878201] binder: 23006:23013 got transaction to invalid handle [ 976.878212] binder: 23006:23013 transaction failed 29201/-22, size 80-24 line 3013 [ 976.956826] binder: 23030:23039 got transaction to invalid handle [ 976.956835] binder: 23030:23039 transaction failed 29201/-22, size 80-24 line 3013 [ 977.021798] binder: 23047:23058 got transaction to invalid handle [ 977.021808] binder: 23047:23058 transaction failed 29201/-22, size 80-24 line 3013 [ 977.093212] binder: 23077:23080 got transaction to invalid handle [ 977.093221] binder: 23077:23080 transaction failed 29201/-22, size 80-24 line 3013 [ 977.141357] binder: 23093:23099 got transaction to invalid handle [ 977.141365] binder: 23093:23099 transaction failed 29201/-22, size 80-24 line 3013 [ 977.218969] binder: 23110:23115 got transaction to invalid handle [ 977.218981] binder: 23110:23115 transaction failed 29201/-22, size 80-24 line 3013 [ 977.326625] binder: 23131:23138 got transaction to invalid handle [ 977.326633] binder: 23131:23138 transaction failed 29201/-22, size 80-24 line 3013 [ 977.368032] binder: 23153:23161 got transaction to invalid handle [ 977.368041] binder: 23153:23161 transaction failed 29201/-22, size 80-24 line 3013 [ 977.440232] binder: 23172:23177 got transaction to invalid handle [ 977.440240] binder: 23172:23177 transaction failed 29201/-22, size 80-24 line 3013 [ 977.516561] binder: 23192:23195 got transaction to invalid handle [ 977.516569] binder: 23192:23195 transaction failed 29201/-22, size 80-24 line 3013 [ 977.606273] binder: 23207:23221 got transaction to invalid handle [ 977.606282] binder: 23207:23221 transaction failed 29201/-22, size 80-24 line 3013 [ 977.666040] binder: 23233:23239 got transaction to invalid handle [ 977.666048] binder: 23233:23239 transaction failed 29201/-22, size 80-24 line 3013 [ 977.720360] binder: 23246:23252 got transaction to invalid handle [ 977.720368] binder: 23246:23252 transaction failed 29201/-22, size 80-24 line 3013 [ 977.749856] binder: 23263:23266 got transaction to invalid handle [ 977.749873] binder: 23263:23266 transaction failed 29201/-22, size 80-24 line 3013 [ 977.810378] binder: 23277:23290 got transaction to invalid handle [ 977.810386] binder: 23277:23290 transaction failed 29201/-22, size 80-24 line 3013 [ 977.879929] binder: 23302:23310 got transaction to invalid handle [ 977.879941] binder: 23302:23310 transaction failed 29201/-22, size 80-24 line 3013 [ 977.930711] binder: 23324:23330 got transaction to invalid handle [ 977.930720] binder: 23324:23330 transaction failed 29201/-22, size 80-24 line 3013 [ 978.030848] binder: 23351:23361 got transaction to invalid handle [ 978.030857] binder: 23351:23361 transaction failed 29201/-22, size 80-24 line 3013 [ 978.118818] binder: 23373:23382 got transaction to invalid handle [ 978.118825] binder: 23373:23382 transaction failed 29201/-22, size 80-24 line 3013 [ 978.180781] binder: 23389:23397 got transaction to invalid handle [ 978.180790] binder: 23389:23397 transaction failed 29201/-22, size 80-24 line 3013 [ 978.256792] binder: 23419:23425 got transaction to invalid handle [ 978.256801] binder: 23419:23425 transaction failed 29201/-22, size 80-24 line 3013 [ 978.296626] binder: 23436:23440 got transaction to invalid handle [ 978.296637] binder: 23436:23440 transaction failed 29201/-22, size 80-24 line 3013 [ 978.343055] binder: 23448:23450 got transaction to invalid handle [ 978.343064] binder: 23448:23450 transaction failed 29201/-22, size 80-24 line 3013 [ 978.403701] binder: 23461:23467 got transaction to invalid handle [ 978.403710] binder: 23461:23467 transaction failed 29201/-22, size 80-24 line 3013 [ 978.454776] binder: 23474:23484 got transaction to invalid handle [ 978.454784] binder: 23474:23484 transaction failed 29201/-22, size 80-24 line 3013 [ 978.506065] binder: 23489:23495 got transaction to invalid handle [ 978.506076] binder: 23489:23495 transaction failed 29201/-22, size 80-24 line 3013 [ 978.588352] binder: 23512:23515 got transaction to invalid handle [ 978.588361] binder: 23512:23515 transaction failed 29201/-22, size 80-24 line 3013 [ 978.641240] binder: 23530:23534 got transaction to invalid handle [ 978.641250] binder: 23530:23534 transaction failed 29201/-22, size 80-24 line 3013 [ 978.700730] binder: 23555:23557 got transaction to invalid handle [ 978.700738] binder: 23555:23557 transaction failed 29201/-22, size 80-24 line 3013 [ 978.789270] binder: 23570:23577 got transaction to invalid handle [ 978.789278] binder: 23570:23577 transaction failed 29201/-22, size 80-24 line 3013 [ 978.878618] binder: 23600:23607 got transaction to invalid handle [ 978.878626] binder: 23600:23607 transaction failed 29201/-22, size 80-24 line 3013 [ 978.953547] binder: 23621:23624 got transaction to invalid handle [ 978.953556] binder: 23621:23624 transaction failed 29201/-22, size 80-24 line 3013 [ 978.998811] binder: 23637:23645 got transaction to invalid handle [ 978.998823] binder: 23637:23645 transaction failed 29201/-22, size 80-24 line 3013 [ 979.084709] binder: 23665:23671 got transaction to invalid handle [ 979.084719] binder: 23665:23671 transaction failed 29201/-22, size 80-24 line 3013 [ 979.135264] binder: 23679:23683 got transaction to invalid handle [ 979.135274] binder: 23679:23683 transaction failed 29201/-22, size 80-24 line 3013 [ 979.202784] binder: 23692:23707 got transaction to invalid handle [ 979.202793] binder: 23692:23707 transaction failed 29201/-22, size 80-24 line 3013 [ 979.291079] binder: 23714:23720 got transaction to invalid handle [ 979.291089] binder: 23714:23720 transaction failed 29201/-22, size 80-24 line 3013 [ 979.366322] binder: 23737:23745 got transaction to invalid handle [ 979.366331] binder: 23737:23745 transaction failed 29201/-22, size 80-24 line 3013 [ 979.433391] binder: 23766:23770 got transaction to invalid handle [ 979.433400] binder: 23766:23770 transaction failed 29201/-22, size 80-24 line 3013 [ 979.512298] binder: 23790:23792 got transaction to invalid handle [ 979.512306] binder: 23790:23792 transaction failed 29201/-22, size 80-24 line 3013 [ 979.588200] binder: 23803:23818 got transaction to invalid handle [ 979.588211] binder: 23803:23818 transaction failed 29201/-22, size 80-24 line 3013 [ 979.694129] binder: 23836:23842 got transaction to invalid handle [ 979.694138] binder: 23836:23842 transaction failed 29201/-22, size 80-24 line 3013 [ 979.852046] binder: 23875:23886 got transaction to invalid handle [ 979.852054] binder: 23875:23886 transaction failed 29201/-22, size 80-24 line 3013 [ 979.945790] binder: 23904:23918 got transaction to invalid handle [ 979.945799] binder: 23904:23918 transaction failed 29201/-22, size 80-24 line 3013 [ 980.039259] binder: 23933:23939 got transaction to invalid handle [ 980.039267] binder: 23933:23939 transaction failed 29201/-22, size 80-24 line 3013 [ 980.111279] binder: 23953:23956 got transaction to invalid handle [ 980.111288] binder: 23953:23956 transaction failed 29201/-22, size 80-24 line 3013 [ 980.193621] binder: 23971:23977 got transaction to invalid handle [ 980.193632] binder: 23971:23977 transaction failed 29201/-22, size 80-24 line 3013 [ 980.281378] binder: 23998:24006 got transaction to invalid handle [ 980.281387] binder: 23998:24006 transaction failed 29201/-22, size 80-24 line 3013 [ 980.317612] binder: 24013:24016 got transaction to invalid handle [ 980.317623] binder: 24013:24016 transaction failed 29201/-22, size 80-24 line 3013 [ 980.372327] binder: 24027:24037 got transaction to invalid handle [ 980.372336] binder: 24027:24037 transaction failed 29201/-22, size 80-24 line 3013 [ 980.418611] binder: 24043:24048 got transaction to invalid handle [ 980.418622] binder: 24043:24048 transaction failed 29201/-22, size 80-24 line 3013 [ 980.489435] binder: 24068:24075 got transaction to invalid handle [ 980.489443] binder: 24068:24075 transaction failed 29201/-22, size 80-24 line 3013 [ 980.544361] binder: 24083:24090 got transaction to invalid handle [ 980.544371] binder: 24083:24090 transaction failed 29201/-22, size 80-24 line 3013 [ 980.591272] binder: 24099:24106 got transaction to invalid handle [ 980.591281] binder: 24099:24106 transaction failed 29201/-22, size 80-24 line 3013 [ 980.642145] binder: 24112:24119 got transaction to invalid handle [ 980.642154] binder: 24112:24119 transaction failed 29201/-22, size 80-24 line 3013 [ 980.706175] binder: 24129:24137 got transaction to invalid handle [ 980.706183] binder: 24129:24137 transaction failed 29201/-22, size 80-24 line 3013 [ 980.790835] binder: 24152:24164 got transaction to invalid handle [ 980.790845] binder: 24152:24164 transaction failed 29201/-22, size 80-24 line 3013 [ 980.870873] binder: 24177:24190 got transaction to invalid handle [ 980.870883] binder: 24177:24190 transaction failed 29201/-22, size 80-24 line 3013 [ 980.940410] binder: 24204:24212 got transaction to invalid handle [ 980.940419] binder: 24204:24212 transaction failed 29201/-22, size 80-24 line 3013 [ 980.997805] binder: 24222:24228 got transaction to invalid handle [ 980.997814] binder: 24222:24228 transaction failed 29201/-22, size 80-24 line 3013 [ 981.051039] binder: 24237:24244 got transaction to invalid handle [ 981.051048] binder: 24237:24244 transaction failed 29201/-22, size 80-24 line 3013 [ 981.118901] binder: 24265:24272 got transaction to invalid handle [ 981.118912] binder: 24265:24272 transaction failed 29201/-22, size 80-24 line 3013 [ 981.156336] binder: 24280:24283 got transaction to invalid handle [ 981.156345] binder: 24280:24283 transaction failed 29201/-22, size 80-24 line 3013 [ 981.231054] binder: 24298:24304 got transaction to invalid handle [ 981.231063] binder: 24298:24304 transaction failed 29201/-22, size 80-24 line 3013 [ 981.296227] binder: 24315:24328 got transaction to invalid handle [ 981.296235] binder: 24315:24328 transaction failed 29201/-22, size 80-24 line 3013 [ 981.333656] binder: 24337:24338 got transaction to invalid handle [ 981.333665] binder: 24337:24338 transaction failed 29201/-22, size 80-24 line 3013 [ 981.393149] binder: 24346:24357 got transaction to invalid handle [ 981.393157] binder: 24346:24357 transaction failed 29201/-22, size 80-24 line 3013 [ 981.442888] binder: 24360:24370 got transaction to invalid handle [ 981.442899] binder: 24360:24370 transaction failed 29201/-22, size 80-24 line 3013 [ 981.535929] binder: 24386:24401 got transaction to invalid handle [ 981.535938] binder: 24386:24401 transaction failed 29201/-22, size 80-24 line 3013 [ 981.586623] binder: 24413:24420 got transaction to invalid handle [ 981.586632] binder: 24413:24420 transaction failed 29201/-22, size 80-24 line 3013 [ 981.646511] binder: 24427:24436 got transaction to invalid handle [ 981.646522] binder: 24427:24436 transaction failed 29201/-22, size 80-24 line 3013 [ 981.713414] binder: 24450:24462 got transaction to invalid handle [ 981.713423] binder: 24450:24462 transaction failed 29201/-22, size 80-24 line 3013 [ 981.771993] binder: 24463:24468 got transaction to invalid handle [ 981.772003] binder: 24463:24468 transaction failed 29201/-22, size 80-24 line 3013 [ 981.884735] binder: 24479:24487 got transaction to invalid handle [ 981.884744] binder: 24479:24487 transaction failed 29201/-22, size 80-24 line 3013 [ 981.916563] binder: 24510:24512 got transaction to invalid handle [ 981.916572] binder: 24510:24512 transaction failed 29201/-22, size 80-24 line 3013 [ 981.957704] binder: 24522:24524 got transaction to invalid handle [ 981.957712] binder: 24522:24524 transaction failed 29201/-22, size 80-24 line 3013 [ 982.042182] binder: 24538:24547 got transaction to invalid handle [ 982.042191] binder: 24538:24547 transaction failed 29201/-22, size 80-24 line 3013 [ 982.096772] binder: 24559:24563 got transaction to invalid handle [ 982.096782] binder: 24559:24563 transaction failed 29201/-22, size 80-24 line 3013 [ 982.154886] binder: 24577:24582 got transaction to invalid handle [ 982.154896] binder: 24577:24582 transaction failed 29201/-22, size 80-24 line 3013 [ 982.278675] binder: 24593:24619 got transaction to invalid handle [ 982.278685] binder: 24593:24619 transaction failed 29201/-22, size 80-24 line 3013 [ 982.381342] binder: 24636:24647 got transaction to invalid handle [ 982.381350] binder: 24636:24647 transaction failed 29201/-22, size 80-24 line 3013 [ 982.442661] binder: 24655:24670 got transaction to invalid handle [ 982.442669] binder: 24655:24670 transaction failed 29201/-22, size 80-24 line 3013 [ 982.500964] binder: 24677:24684 got transaction to invalid handle [ 982.500975] binder: 24677:24684 transaction failed 29201/-22, size 80-24 line 3013 [ 982.556995] binder: 24697:24702 got transaction to invalid handle [ 982.557004] binder: 24697:24702 transaction failed 29201/-22, size 80-24 line 3013 [ 982.626389] binder: 24710:24721 got transaction to invalid handle [ 982.626399] binder: 24710:24721 transaction failed 29201/-22, size 80-24 line 3013 [ 982.699575] binder: 24742:24748 got transaction to invalid handle [ 982.699583] binder: 24742:24748 transaction failed 29201/-22, size 80-24 line 3013 [ 982.781802] binder: 24764:24770 got transaction to invalid handle [ 982.781812] binder: 24764:24770 transaction failed 29201/-22, size 80-24 line 3013 [ 982.850563] binder: 24790:24798 got transaction to invalid handle [ 982.850574] binder: 24790:24798 transaction failed 29201/-22, size 80-24 line 3013 [ 982.928757] binder: 24808:24811 got transaction to invalid handle [ 982.928767] binder: 24808:24811 transaction failed 29201/-22, size 80-24 line 3013 [ 982.985440] binder: 24829:24837 got transaction to invalid handle [ 982.985450] binder: 24829:24837 transaction failed 29201/-22, size 80-24 line 3013 [ 983.061706] binder: 24850:24860 got transaction to invalid handle [ 983.061715] binder: 24850:24860 transaction failed 29201/-22, size 80-24 line 3013 [ 983.097718] binder: 24867:24873 got transaction to invalid handle [ 983.097727] binder: 24867:24873 transaction failed 29201/-22, size 80-24 line 3013 [ 983.140503] binder: 24880:24883 got transaction to invalid handle [ 983.140512] binder: 24880:24883 transaction failed 29201/-22, size 80-24 line 3013 [ 983.182316] binder: 24893:24898 got transaction to invalid handle [ 983.182326] binder: 24893:24898 transaction failed 29201/-22, size 80-24 line 3013 [ 983.221544] binder: 24903:24911 got transaction to invalid handle [ 983.221554] binder: 24903:24911 transaction failed 29201/-22, size 80-24 line 3013 [ 983.261030] binder: 24916:24923 got transaction to invalid handle [ 983.261040] binder: 24916:24923 transaction failed 29201/-22, size 80-24 line 3013 [ 983.312257] binder: 24937:24940 got transaction to invalid handle [ 983.312266] binder: 24937:24940 transaction failed 29201/-22, size 80-24 line 3013 [ 983.336315] binder: 24948:24950 got transaction to invalid handle [ 983.336324] binder: 24948:24950 transaction failed 29201/-22, size 80-24 line 3013 [ 983.386053] binder: 24966:24970 got transaction to invalid handle [ 983.386062] binder: 24966:24970 transaction failed 29201/-22, size 80-24 line 3013 [ 983.445885] binder: 24985:24990 got transaction to invalid handle [ 983.445894] binder: 24985:24990 transaction failed 29201/-22, size 80-24 line 3013 [ 983.483411] binder: 24994:25000 got transaction to invalid handle [ 983.483420] binder: 24994:25000 transaction failed 29201/-22, size 80-24 line 3013 [ 983.515854] binder: 25009:25015 got transaction to invalid handle [ 983.515862] binder: 25009:25015 transaction failed 29201/-22, size 80-24 line 3013 [ 983.607657] binder: 25025:25035 got transaction to invalid handle [ 983.607666] binder: 25025:25035 transaction failed 29201/-22, size 80-24 line 3013 [ 983.683121] binder: 25061:25064 got transaction to invalid handle [ 983.683129] binder: 25061:25064 transaction failed 29201/-22, size 80-24 line 3013 [ 983.728045] binder: 25074:25082 got transaction to invalid handle [ 983.728056] binder: 25074:25082 transaction failed 29201/-22, size 80-24 line 3013 [ 983.824351] binder: 25097:25112 got transaction to invalid handle [ 983.824360] binder: 25097:25112 transaction failed 29201/-22, size 80-24 line 3013 [ 983.890027] binder: 25120:25131 got transaction to invalid handle [ 983.890037] binder: 25120:25131 transaction failed 29201/-22, size 80-24 line 3013 [ 984.028663] binder: 25159:25175 got transaction to invalid handle [ 984.028672] binder: 25159:25175 transaction failed 29201/-22, size 80-24 line 3013 [ 984.069462] binder: 25179:25185 got transaction to invalid handle [ 984.069472] binder: 25179:25185 transaction failed 29201/-22, size 80-24 line 3013 [ 984.142806] binder: 25197:25203 got transaction to invalid handle [ 984.142815] binder: 25197:25203 transaction failed 29201/-22, size 80-24 line 3013 [ 984.215799] binder: 25217:25229 got transaction to invalid handle [ 984.215809] binder: 25217:25229 transaction failed 29201/-22, size 80-24 line 3013 [ 984.265995] binder: 25240:25251 got transaction to invalid handle [ 984.266004] binder: 25240:25251 transaction failed 29201/-22, size 80-24 line 3013 [ 984.355371] binder: 25259:25271 got transaction to invalid handle [ 984.355380] binder: 25259:25271 transaction failed 29201/-22, size 80-24 line 3013 [ 984.420452] binder: 25285:25296 got transaction to invalid handle [ 984.420461] binder: 25285:25296 transaction failed 29201/-22, size 80-24 line 3013 [ 984.496813] binder: 25310:25317 got transaction to invalid handle [ 984.496821] binder: 25310:25317 transaction failed 29201/-22, size 80-24 line 3013 [ 984.572656] binder: 25325:25338 got transaction to invalid handle [ 984.572665] binder: 25325:25338 transaction failed 29201/-22, size 80-24 line 3013 [ 984.629878] binder: 25346:25352 got transaction to invalid handle [ 984.629886] binder: 25346:25352 transaction failed 29201/-22, size 80-24 line 3013 [ 984.691251] binder: 25363:25373 got transaction to invalid handle [ 984.691261] binder: 25363:25373 transaction failed 29201/-22, size 80-24 line 3013 [ 984.735778] binder: 25378:25381 got transaction to invalid handle [ 984.735787] binder: 25378:25381 transaction failed 29201/-22, size 80-24 line 3013 [ 984.786363] binder: 25389:25396 got transaction to invalid handle [ 984.786373] binder: 25389:25396 transaction failed 29201/-22, size 80-24 line 3013 [ 984.841665] binder: 25410:25415 got transaction to invalid handle [ 984.841673] binder: 25410:25415 transaction failed 29201/-22, size 80-24 line 3013 [ 984.939489] binder: 25429:25436 got transaction to invalid handle [ 984.939497] binder: 25429:25436 transaction failed 29201/-22, size 80-24 line 3013 [ 984.973790] binder: 25451:25455 got transaction to invalid handle [ 984.973799] binder: 25451:25455 transaction failed 29201/-22, size 80-24 line 3013 [ 985.087815] binder: 25484:25490 got transaction to invalid handle [ 985.087825] binder: 25484:25490 transaction failed 29201/-22, size 80-24 line 3013 [ 985.150532] binder: 25501:25509 got transaction to invalid handle [ 985.150542] binder: 25501:25509 transaction failed 29201/-22, size 80-24 line 3013 [ 985.250256] binder: 25528:25536 got transaction to invalid handle [ 985.250265] binder: 25528:25536 transaction failed 29201/-22, size 80-24 line 3013 [ 985.349661] binder: 25550:25560 got transaction to invalid handle [ 985.349670] binder: 25550:25560 transaction failed 29201/-22, size 80-24 line 3013 [ 985.396010] binder: 25582:25586 got transaction to invalid handle [ 985.396019] binder: 25582:25586 transaction failed 29201/-22, size 80-24 line 3013 [ 985.480957] binder: 25603:25614 got transaction to invalid handle [ 985.480965] binder: 25603:25614 transaction failed 29201/-22, size 80-24 line 3013 [ 985.547186] binder: 25626:25632 got transaction to invalid handle [ 985.547197] binder: 25626:25632 transaction failed 29201/-22, size 80-24 line 3013 [ 985.732509] binder: 25654:25681 got transaction to invalid handle [ 985.732517] binder: 25654:25681 transaction failed 29201/-22, size 80-24 line 3013 [ 985.770805] binder: 25686:25691 got transaction to invalid handle [ 985.770814] binder: 25686:25691 transaction failed 29201/-22, size 80-24 line 3013 [ 985.825123] binder: 25706:25708 got transaction to invalid handle [ 985.825132] binder: 25706:25708 transaction failed 29201/-22, size 80-24 line 3013 [ 985.868049] binder: 25720:25725 got transaction to invalid handle [ 985.868058] binder: 25720:25725 transaction failed 29201/-22, size 80-24 line 3013 [ 985.921607] binder: 25731:25737 got transaction to invalid handle [ 985.921617] binder: 25731:25737 transaction failed 29201/-22, size 80-24 line 3013 [ 986.002946] binder: 25757:25768 got transaction to invalid handle [ 986.002956] binder: 25757:25768 transaction failed 29201/-22, size 80-24 line 3013 [ 986.074509] binder: 25776:25782 got transaction to invalid handle [ 986.074517] binder: 25776:25782 transaction failed 29201/-22, size 80-24 line 3013 [ 986.151750] binder: 25797:25815 got transaction to invalid handle [ 986.151759] binder: 25797:25815 transaction failed 29201/-22, size 80-24 line 3013 [ 986.223568] binder: 25819:25826 got transaction to invalid handle [ 986.223578] binder: 25819:25826 transaction failed 29201/-22, size 80-24 line 3013 [ 986.271443] binder: 25844:25850 got transaction to invalid handle [ 986.271453] binder: 25844:25850 transaction failed 29201/-22, size 80-24 line 3013 [ 986.321112] binder: 25859:25866 got transaction to invalid handle [ 986.321120] binder: 25859:25866 transaction failed 29201/-22, size 80-24 line 3013 [ 986.418851] binder: 25877:25885 got transaction to invalid handle [ 986.418860] binder: 25877:25885 transaction failed 29201/-22, size 80-24 line 3013 [ 986.479682] binder: 25902:25906 got transaction to invalid handle [ 986.479690] binder: 25902:25906 transaction failed 29201/-22, size 80-24 line 3013 [ 986.538833] binder: 25924:25932 got transaction to invalid handle [ 986.538842] binder: 25924:25932 transaction failed 29201/-22, size 80-24 line 3013 [ 986.623708] binder: 25943:25951 got transaction to invalid handle [ 986.623718] binder: 25943:25951 transaction failed 29201/-22, size 80-24 line 3013 [ 986.686520] binder: 25967:25977 got transaction to invalid handle [ 986.686529] binder: 25967:25977 transaction failed 29201/-22, size 80-24 line 3013 [ 986.783190] binder: 25993:26003 got transaction to invalid handle [ 986.783197] binder: 25993:26003 transaction failed 29201/-22, size 80-24 line 3013 [ 986.869614] binder: 26016:26029 got transaction to invalid handle [ 986.869622] binder: 26016:26029 transaction failed 29201/-22, size 80-24 line 3013 [ 986.944068] binder: 26046:26052 got transaction to invalid handle [ 986.944077] binder: 26046:26052 transaction failed 29201/-22, size 80-24 line 3013 [ 987.045929] binder: 26070:26077 got transaction to invalid handle [ 987.045938] binder: 26070:26077 transaction failed 29201/-22, size 80-24 line 3013 [ 987.086349] binder: 26087:26096 got transaction to invalid handle [ 987.086358] binder: 26087:26096 transaction failed 29201/-22, size 80-24 line 3013 [ 987.146449] binder: 26108:26111 got transaction to invalid handle [ 987.146460] binder: 26108:26111 transaction failed 29201/-22, size 80-24 line 3013 [ 987.216784] binder: 26129:26137 got transaction to invalid handle [ 987.216794] binder: 26129:26137 transaction failed 29201/-22, size 80-24 line 3013 [ 987.266771] binder: 26145:26150 got transaction to invalid handle [ 987.266780] binder: 26145:26150 transaction failed 29201/-22, size 80-24 line 3013 [ 987.344880] binder: 26158:26164 got transaction to invalid handle [ 987.344890] binder: 26158:26164 transaction failed 29201/-22, size 80-24 line 3013 [ 987.450210] binder: 26177:26188 got transaction to invalid handle [ 987.450218] binder: 26177:26188 transaction failed 29201/-22, size 80-24 line 3013 [ 987.554829] binder: 26209:26221 got transaction to invalid handle [ 987.554839] binder: 26209:26221 transaction failed 29201/-22, size 80-24 line 3013 [ 987.636023] binder: 26241:26244 got transaction to invalid handle [ 987.636032] binder: 26241:26244 transaction failed 29201/-22, size 80-24 line 3013 [ 987.704896] binder: 26256:26259 got transaction to invalid handle [ 987.704906] binder: 26256:26259 transaction failed 29201/-22, size 80-24 line 3013 [ 987.745986] binder: 26276:26281 got transaction to invalid handle [ 987.745995] binder: 26276:26281 transaction failed 29201/-22, size 80-24 line 3013 [ 987.786944] binder: 26292:26296 got transaction to invalid handle [ 987.786952] binder: 26292:26296 transaction failed 29201/-22, size 80-24 line 3013 [ 987.858782] binder: 26308:26316 got transaction to invalid handle [ 987.858793] binder: 26308:26316 transaction failed 29201/-22, size 80-24 line 3013 [ 987.910995] binder: 26334:26338 got transaction to invalid handle [ 987.911004] binder: 26334:26338 transaction failed 29201/-22, size 80-24 line 3013 [ 987.987488] binder: 26357:26361 got transaction to invalid handle [ 987.987497] binder: 26357:26361 transaction failed 29201/-22, size 80-24 line 3013 [ 988.077342] binder: 26371:26380 got transaction to invalid handle [ 988.077350] binder: 26371:26380 transaction failed 29201/-22, size 80-24 line 3013 [ 988.128879] binder: 26393:26399 got transaction to invalid handle [ 988.128890] binder: 26393:26399 transaction failed 29201/-22, size 80-24 line 3013 [ 988.194391] binder: 26413:26417 got transaction to invalid handle [ 988.194399] binder: 26413:26417 transaction failed 29201/-22, size 80-24 line 3013 [ 988.261006] binder: 26430:26437 got transaction to invalid handle [ 988.261014] binder: 26430:26437 transaction failed 29201/-22, size 80-24 line 3013 [ 988.341046] binder: 26454:26459 got transaction to invalid handle [ 988.341055] binder: 26454:26459 transaction failed 29201/-22, size 80-24 line 3013 [ 988.393194] binder: 26471:26473 got transaction to invalid handle [ 988.393204] binder: 26471:26473 transaction failed 29201/-22, size 80-24 line 3013 [ 988.525806] binder: 26500:26507 got transaction to invalid handle [ 988.525815] binder: 26500:26507 transaction failed 29201/-22, size 80-24 line 3013 [ 988.588685] binder: 26525:26530 got transaction to invalid handle [ 988.588695] binder: 26525:26530 transaction failed 29201/-22, size 80-24 line 3013 [ 988.676386] binder: 26542:26547 got transaction to invalid handle [ 988.676397] binder: 26542:26547 transaction failed 29201/-22, size 80-24 line 3013 [ 988.743578] binder: 26574:26579 got transaction to invalid handle [ 988.743595] binder: 26574:26579 transaction failed 29201/-22, size 80-24 line 3013 [ 988.844598] binder: 26590:26606 got transaction to invalid handle [ 988.844610] binder: 26590:26606 transaction failed 29201/-22, size 80-24 line 3013 [ 988.889181] binder: 26618:26622 got transaction to invalid handle [ 988.889189] binder: 26618:26622 transaction failed 29201/-22, size 80-24 line 3013 [ 988.933907] binder: 26629:26636 got transaction to invalid handle [ 988.934843] binder: 26629:26636 transaction failed 29201/-22, size 80-24 line 3013 [ 988.997584] binder: 26647:26656 got transaction to invalid handle [ 988.997595] binder: 26647:26656 transaction failed 29201/-22, size 80-24 line 3013 [ 989.077937] binder: 26670:26679 got transaction to invalid handle [ 989.077946] binder: 26670:26679 transaction failed 29201/-22, size 80-24 line 3013 [ 989.147190] binder: 26690:26699 got transaction to invalid handle [ 989.147198] binder: 26690:26699 transaction failed 29201/-22, size 80-24 line 3013 [ 989.207800] binder: 26719:26723 got transaction to invalid handle [ 989.207809] binder: 26719:26723 transaction failed 29201/-22, size 80-24 line 3013 [ 989.327166] binder: 26748:26757 got transaction to invalid handle [ 989.327175] binder: 26748:26757 transaction failed 29201/-22, size 80-24 line 3013 [ 989.388338] binder: 26766:26777 got transaction to invalid handle [ 989.388348] binder: 26766:26777 transaction failed 29201/-22, size 80-24 line 3013 [ 989.471375] binder: 26793:26797 got transaction to invalid handle [ 989.471386] binder: 26793:26797 transaction failed 29201/-22, size 80-24 line 3013 [ 989.536525] binder: 26809:26815 got transaction to invalid handle [ 989.536534] binder: 26809:26815 transaction failed 29201/-22, size 80-24 line 3013 [ 989.565734] binder: 26823:26826 got transaction to invalid handle [ 989.565745] binder: 26823:26826 transaction failed 29201/-22, size 80-24 line 3013 [ 989.631698] binder: 26836:26841 got transaction to invalid handle [ 989.631707] binder: 26836:26841 transaction failed 29201/-22, size 80-24 line 3013 [ 989.683353] binder: 26851:26857 got transaction to invalid handle [ 989.683363] binder: 26851:26857 transaction failed 29201/-22, size 80-24 line 3013 [ 989.732048] binder: 26868:26872 got transaction to invalid handle [ 989.732058] binder: 26868:26872 transaction failed 29201/-22, size 80-24 line 3013 [ 989.804948] binder: 26881:26899 got transaction to invalid handle [ 989.804958] binder: 26881:26899 transaction failed 29201/-22, size 80-24 line 3013 [ 989.940296] binder: 26909:26917 got transaction to invalid handle [ 989.940304] binder: 26909:26917 transaction failed 29201/-22, size 80-24 line 3013 [ 989.986359] binder: 26948:26955 got transaction to invalid handle [ 989.986369] binder: 26948:26955 transaction failed 29201/-22, size 80-24 line 3013 [ 990.044656] binder: 26962:26967 got transaction to invalid handle [ 990.044672] binder: 26962:26967 transaction failed 29201/-22, size 80-24 line 3013 [ 990.117777] binder: 26978:26989 got transaction to invalid handle [ 990.117786] binder: 26978:26989 transaction failed 29201/-22, size 80-24 line 3013 [ 990.177710] binder: 27005:27010 got transaction to invalid handle [ 990.177720] binder: 27005:27010 transaction failed 29201/-22, size 80-24 line 3013 [ 990.234790] binder: 27027:27035 got transaction to invalid handle [ 990.234801] binder: 27027:27035 transaction failed 29201/-22, size 80-24 line 3013 [ 990.312145] binder: 27039:27046 got transaction to invalid handle [ 990.312153] binder: 27039:27046 transaction failed 29201/-22, size 80-24 line 3013 [ 990.353504] binder: 27058:27065 got transaction to invalid handle [ 990.353513] binder: 27058:27065 transaction failed 29201/-22, size 80-24 line 3013 [ 990.419597] binder: 27072:27086 got transaction to invalid handle [ 990.419607] binder: 27072:27086 transaction failed 29201/-22, size 80-24 line 3013 [ 990.478485] binder: 27099:27107 got transaction to invalid handle [ 990.478494] binder: 27099:27107 transaction failed 29201/-22, size 80-24 line 3013 [ 990.536441] binder: 27116:27119 got transaction to invalid handle [ 990.536449] binder: 27116:27119 transaction failed 29201/-22, size 80-24 line 3013 [ 990.610038] binder: 27140:27142 got transaction to invalid handle [ 990.610052] binder: 27140:27142 transaction failed 29201/-22, size 80-24 line 3013 [ 990.632851] binder: 27151:27152 got transaction to invalid handle [ 990.632860] binder: 27151:27152 transaction failed 29201/-22, size 80-24 line 3013 [ 990.722962] binder: 27162:27180 got transaction to invalid handle [ 990.722970] binder: 27162:27180 transaction failed 29201/-22, size 80-24 line 3013 [ 990.786724] binder: 27191:27197 got transaction to invalid handle [ 990.786735] binder: 27191:27197 transaction failed 29201/-22, size 80-24 line 3013 [ 990.829402] binder: 27207:27211 got transaction to invalid handle [ 990.829420] binder: 27207:27211 transaction failed 29201/-22, size 80-24 line 3013 [ 990.894844] binder: 27222:27235 got transaction to invalid handle [ 990.894864] binder: 27222:27235 transaction failed 29201/-22, size 80-24 line 3013 [ 990.962946] binder: 27243:27256 got transaction to invalid handle [ 990.962956] binder: 27243:27256 transaction failed 29201/-22, size 80-24 line 3013 [ 990.999840] binder: 27265:27274 got transaction to invalid handle [ 990.999848] binder: 27265:27274 transaction failed 29201/-22, size 80-24 line 3013 [ 991.050103] binder: 27281:27291 got transaction to invalid handle [ 991.050111] binder: 27281:27291 transaction failed 29201/-22, size 80-24 line 3013 [ 991.100200] binder: 27300:27309 got transaction to invalid handle [ 991.100209] binder: 27300:27309 transaction failed 29201/-22, size 80-24 line 3013 [ 991.163267] binder: 27320:27324 got transaction to invalid handle [ 991.163278] binder: 27320:27324 transaction failed 29201/-22, size 80-24 line 3013 [ 991.225190] binder: 27338:27341 got transaction to invalid handle [ 991.225201] binder: 27338:27341 transaction failed 29201/-22, size 80-24 line 3013 [ 991.268771] binder: 27352:27356 got transaction to invalid handle [ 991.268779] binder: 27352:27356 transaction failed 29201/-22, size 80-24 line 3013 [ 991.317745] binder: 27365:27369 got transaction to invalid handle [ 991.317755] binder: 27365:27369 transaction failed 29201/-22, size 80-24 line 3013 [ 991.355018] binder: 27380:27384 got transaction to invalid handle [ 991.355028] binder: 27380:27384 transaction failed 29201/-22, size 80-24 line 3013 [ 991.418446] binder: 27408:27410 got transaction to invalid handle [ 991.418455] binder: 27408:27410 transaction failed 29201/-22, size 80-24 line 3013 [ 991.451650] binder: 27417:27421 got transaction to invalid handle [ 991.451660] binder: 27417:27421 transaction failed 29201/-22, size 80-24 line 3013 [ 991.502138] binder: 27432:27438 got transaction to invalid handle [ 991.502147] binder: 27432:27438 transaction failed 29201/-22, size 80-24 line 3013 [ 991.575381] binder: 27457:27464 got transaction to invalid handle [ 991.575391] binder: 27457:27464 transaction failed 29201/-22, size 80-24 line 3013 [ 991.660514] binder: 27479:27481 got transaction to invalid handle [ 991.660523] binder: 27479:27481 transaction failed 29201/-22, size 80-24 line 3013 [ 991.724589] binder: 27496:27503 got transaction to invalid handle [ 991.724598] binder: 27496:27503 transaction failed 29201/-22, size 80-24 line 3013 [ 991.822055] binder: 27516:27521 got transaction to invalid handle [ 991.822065] binder: 27516:27521 transaction failed 29201/-22, size 80-24 line 3013 [ 991.880025] binder: 27546:27550 got transaction to invalid handle [ 991.880035] binder: 27546:27550 transaction failed 29201/-22, size 80-24 line 3013 [ 991.940769] binder: 27571:27578 got transaction to invalid handle [ 991.940778] binder: 27571:27578 transaction failed 29201/-22, size 80-24 line 3013 [ 991.991934] binder: 27584:27594 got transaction to invalid handle [ 991.991942] binder: 27584:27594 transaction failed 29201/-22, size 80-24 line 3013 [ 992.052868] binder: 27606:27612 got transaction to invalid handle [ 992.052876] binder: 27606:27612 transaction failed 29201/-22, size 80-24 line 3013 [ 992.103242] binder: 27624:27629 got transaction to invalid handle [ 992.103251] binder: 27624:27629 transaction failed 29201/-22, size 80-24 line 3013 [ 992.162725] binder: 27638:27647 got transaction to invalid handle [ 992.162990] binder: 27638:27647 transaction failed 29201/-22, size 80-24 line 3013 [ 992.205695] binder: 27654:27663 got transaction to invalid handle [ 992.205704] binder: 27654:27663 transaction failed 29201/-22, size 80-24 line 3013 [ 992.254280] binder: 27668:27671 got transaction to invalid handle [ 992.254291] binder: 27668:27671 transaction failed 29201/-22, size 80-24 line 3013 [ 992.334837] binder: 27689:27699 got transaction to invalid handle [ 992.334845] binder: 27689:27699 transaction failed 29201/-22, size 80-24 line 3013 [ 992.381001] binder: 27705:27712 got transaction to invalid handle [ 992.381009] binder: 27705:27712 transaction failed 29201/-22, size 80-24 line 3013 [ 992.404490] binder: 27723:27726 got transaction to invalid handle [ 992.404497] binder: 27723:27726 transaction failed 29201/-22, size 80-24 line 3013 [ 992.491234] binder: 27742:27744 got transaction to invalid handle [ 992.491243] binder: 27742:27744 transaction failed 29201/-22, size 80-24 line 3013 [ 992.547667] binder: 27754:27760 got transaction to invalid handle [ 992.547675] binder: 27754:27760 transaction failed 29201/-22, size 80-24 line 3013 [ 992.679373] binder: 27785:27795 got transaction to invalid handle [ 992.679383] binder: 27785:27795 transaction failed 29201/-22, size 80-24 line 3013 [ 992.731999] binder: 27811:27819 got transaction to invalid handle [ 992.732008] binder: 27811:27819 transaction failed 29201/-22, size 80-24 line 3013 [ 992.790444] binder: 27825:27830 got transaction to invalid handle [ 992.790453] binder: 27825:27830 transaction failed 29201/-22, size 80-24 line 3013 [ 992.835844] binder: 27845:27848 got transaction to invalid handle [ 992.835853] binder: 27845:27848 transaction failed 29201/-22, size 80-24 line 3013 [ 992.942880] binder: 27872:27879 got transaction to invalid handle [ 992.942889] binder: 27872:27879 transaction failed 29201/-22, size 80-24 line 3013 [ 993.036828] binder: 27907:27909 got transaction to invalid handle [ 993.036837] binder: 27907:27909 transaction failed 29201/-22, size 80-24 line 3013 [ 993.103222] binder: 27921:27926 got transaction to invalid handle [ 993.103230] binder: 27921:27926 transaction failed 29201/-22, size 80-24 line 3013 [ 993.150907] binder: 27938:27941 got transaction to invalid handle [ 993.150915] binder: 27938:27941 transaction failed 29201/-22, size 80-24 line 3013 [ 993.184903] binder: 27950:27954 got transaction to invalid handle [ 993.184912] binder: 27950:27954 transaction failed 29201/-22, size 80-24 line 3013 [ 993.248832] binder: 27965:27974 got transaction to invalid handle [ 993.248841] binder: 27965:27974 transaction failed 29201/-22, size 80-24 line 3013 [ 993.318053] binder: 27994:28003 got transaction to invalid handle [ 993.318062] binder: 27994:28003 transaction failed 29201/-22, size 80-24 line 3013 [ 993.365754] binder: 28008:28009 got transaction to invalid handle [ 993.365763] binder: 28008:28009 transaction failed 29201/-22, size 80-24 line 3013 [ 993.431998] binder: 28029:28032 got transaction to invalid handle [ 993.432006] binder: 28029:28032 transaction failed 29201/-22, size 80-24 line 3013 [ 993.493164] binder: 28044:28057 got transaction to invalid handle [ 993.493173] binder: 28044:28057 transaction failed 29201/-22, size 80-24 line 3013 [ 993.567620] binder: 28070:28076 got transaction to invalid handle [ 993.567630] binder: 28070:28076 transaction failed 29201/-22, size 80-24 line 3013 [ 993.622635] binder: 28091:28096 got transaction to invalid handle [ 993.622645] binder: 28091:28096 transaction failed 29201/-22, size 80-24 line 3013 [ 993.676284] binder: 28112:28115 got transaction to invalid handle [ 993.676292] binder: 28112:28115 transaction failed 29201/-22, size 80-24 line 3013 [ 993.719584] binder: 28123:28129 got transaction to invalid handle [ 993.719593] binder: 28123:28129 transaction failed 29201/-22, size 80-24 line 3013 [ 993.881975] binder: 28154:28165 got transaction to invalid handle [ 993.881987] binder: 28154:28165 transaction failed 29201/-22, size 80-24 line 3013 [ 993.968904] binder: 28199:28213 got transaction to invalid handle [ 993.968912] binder: 28199:28213 transaction failed 29201/-22, size 80-24 line 3013 [ 994.100051] binder: 28232:28246 got transaction to invalid handle [ 994.100061] binder: 28232:28246 transaction failed 29201/-22, size 80-24 line 3013 [ 994.145830] binder: 28261:28268 got transaction to invalid handle [ 994.145840] binder: 28261:28268 transaction failed 29201/-22, size 80-24 line 3013 [ 994.237580] binder: 28281:28296 got transaction to invalid handle [ 994.237593] binder: 28281:28296 transaction failed 29201/-22, size 80-24 line 3013 [ 994.294543] binder: 28311:28316 got transaction to invalid handle [ 994.294553] binder: 28311:28316 transaction failed 29201/-22, size 80-24 line 3013 [ 994.357836] binder: 28331:28340 got transaction to invalid handle [ 994.357845] binder: 28331:28340 transaction failed 29201/-22, size 80-24 line 3013 [ 994.429407] binder: 28350:28358 got transaction to invalid handle [ 994.429415] binder: 28350:28358 transaction failed 29201/-22, size 80-24 line 3013 [ 994.491176] binder: 28375:28376 got transaction to invalid handle [ 994.491186] binder: 28375:28376 transaction failed 29201/-22, size 80-24 line 3013 [ 994.568572] binder: 28392:28396 got transaction to invalid handle [ 994.568581] binder: 28392:28396 transaction failed 29201/-22, size 80-24 line 3013 [ 994.613605] binder: 28415:28416 got transaction to invalid handle [ 994.613623] binder: 28415:28416 transaction failed 29201/-22, size 80-24 line 3013 [ 994.660713] binder: 28422:28429 got transaction to invalid handle [ 994.660722] binder: 28422:28429 transaction failed 29201/-22, size 80-24 line 3013 [ 994.692855] binder: 28438:28442 got transaction to invalid handle [ 994.692865] binder: 28438:28442 transaction failed 29201/-22, size 80-24 line 3013 [ 994.732004] binder: 28449:28455 got transaction to invalid handle [ 994.732013] binder: 28449:28455 transaction failed 29201/-22, size 80-24 line 3013 [ 994.809809] binder: 28465:28474 got transaction to invalid handle [ 994.809820] binder: 28465:28474 transaction failed 29201/-22, size 80-24 line 3013 [ 994.873420] binder: 28490:28498 got transaction to invalid handle [ 994.873430] binder: 28490:28498 transaction failed 29201/-22, size 80-24 line 3013 [ 994.970269] binder: 28508:28522 got transaction to invalid handle [ 994.970279] binder: 28508:28522 transaction failed 29201/-22, size 80-24 line 3013 [ 995.039276] binder: 28540:28547 got transaction to invalid handle [ 995.039284] binder: 28540:28547 transaction failed 29201/-22, size 80-24 line 3013 [ 995.099060] binder: 28552:28560 got transaction to invalid handle [ 995.099070] binder: 28552:28560 transaction failed 29201/-22, size 80-24 line 3013 [ 995.144739] binder: 28573:28580 got transaction to invalid handle [ 995.144750] binder: 28573:28580 transaction failed 29201/-22, size 80-24 line 3013 [ 995.244504] binder: 28603:28607 got transaction to invalid handle [ 995.244513] binder: 28603:28607 transaction failed 29201/-22, size 80-24 line 3013 [ 995.323791] binder: 28619:28623 got transaction to invalid handle [ 995.323799] binder: 28619:28623 transaction failed 29201/-22, size 80-24 line 3013 [ 995.406333] binder: 28641:28652 got transaction to invalid handle [ 995.406341] binder: 28641:28652 transaction failed 29201/-22, size 80-24 line 3013 [ 995.457597] binder: 28664:28669 got transaction to invalid handle [ 995.457606] binder: 28664:28669 transaction failed 29201/-22, size 80-24 line 3013 [ 995.515143] binder: 28682:28688 got transaction to invalid handle [ 995.515152] binder: 28682:28688 transaction failed 29201/-22, size 80-24 line 3013 [ 995.614424] binder: 28703:28716 got transaction to invalid handle [ 995.614434] binder: 28703:28716 transaction failed 29201/-22, size 80-24 line 3013 [ 995.685224] binder: 28736:28742 got transaction to invalid handle [ 995.685235] binder: 28736:28742 transaction failed 29201/-22, size 80-24 line 3013 [ 995.766651] binder: 28761:28775 got transaction to invalid handle [ 995.766662] binder: 28761:28775 transaction failed 29201/-22, size 80-24 line 3013 [ 995.834740] binder: 28788:28793 got transaction to invalid handle [ 995.834750] binder: 28788:28793 transaction failed 29201/-22, size 80-24 line 3013 [ 995.899925] binder: 28809:28812 got transaction to invalid handle [ 995.899936] binder: 28809:28812 transaction failed 29201/-22, size 80-24 line 3013 [ 995.966497] binder: 28823:28827 got transaction to invalid handle [ 995.966517] binder: 28823:28827 transaction failed 29201/-22, size 80-24 line 3013 [ 996.007875] binder: 28836:28842 got transaction to invalid handle [ 996.007884] binder: 28836:28842 transaction failed 29201/-22, size 80-24 line 3013 [ 996.055034] binder: 28853:28857 got transaction to invalid handle [ 996.055044] binder: 28853:28857 transaction failed 29201/-22, size 80-24 line 3013 [ 996.157681] binder: 28873:28880 got transaction to invalid handle [ 996.157690] binder: 28873:28880 transaction failed 29201/-22, size 80-24 line 3013 [ 996.229635] binder: 28889:28893 got transaction to invalid handle [ 996.229643] binder: 28889:28893 transaction failed 29201/-22, size 80-24 line 3013 [ 996.327907] binder: 28927:28933 got transaction to invalid handle [ 996.327935] binder: 28927:28933 transaction failed 29201/-22, size 80-24 line 3013 [ 996.411946] binder: 28948:28954 got transaction to invalid handle [ 996.411957] binder: 28948:28954 transaction failed 29201/-22, size 80-24 line 3013 [ 996.468452] binder: 28973:28978 got transaction to invalid handle [ 996.468461] binder: 28973:28978 transaction failed 29201/-22, size 80-24 line 3013 [ 996.508797] binder: 28984:28989 got transaction to invalid handle [ 996.508806] binder: 28984:28989 transaction failed 29201/-22, size 80-24 line 3013 [ 996.553847] binder: 28998:29004 got transaction to invalid handle [ 996.553857] binder: 28998:29004 transaction failed 29201/-22, size 80-24 line 3013 [ 996.617657] binder: 29017:29022 got transaction to invalid handle [ 996.617666] binder: 29017:29022 transaction failed 29201/-22, size 80-24 line 3013 [ 996.663440] binder: 29032:29040 got transaction to invalid handle [ 996.663448] binder: 29032:29040 transaction failed 29201/-22, size 80-24 line 3013 [ 996.709634] binder: 29052:29058 got transaction to invalid handle [ 996.709644] binder: 29052:29058 transaction failed 29201/-22, size 80-24 line 3013 [ 996.786995] binder: 29061:29071 got transaction to invalid handle [ 996.787005] binder: 29061:29071 transaction failed 29201/-22, size 80-24 line 3013 [ 996.835084] binder: 29089:29095 got transaction to invalid handle [ 996.835093] binder: 29089:29095 transaction failed 29201/-22, size 80-24 line 3013 [ 996.921069] binder: 29112:29125 got transaction to invalid handle [ 996.921079] binder: 29112:29125 transaction failed 29201/-22, size 80-24 line 3013 [ 996.974057] binder: 29140:29143 got transaction to invalid handle [ 996.974067] binder: 29140:29143 transaction failed 29201/-22, size 80-24 line 3013 [ 997.034126] binder: 29147:29156 got transaction to invalid handle [ 997.034134] binder: 29147:29156 transaction failed 29201/-22, size 80-24 line 3013 [ 997.085495] binder: 29170:29173 got transaction to invalid handle [ 997.085502] binder: 29170:29173 transaction failed 29201/-22, size 80-24 line 3013 [ 997.115781] binder: 29176:29186 got transaction to invalid handle [ 997.115791] binder: 29176:29186 transaction failed 29201/-22, size 80-24 line 3013 [ 997.219594] binder: 29206:29210 got transaction to invalid handle [ 997.219609] binder: 29206:29210 transaction failed 29201/-22, size 80-24 line 3013 [ 997.290621] binder: 29224:29232 got transaction to invalid handle [ 997.290631] binder: 29224:29232 transaction failed 29201/-22, size 80-24 line 3013 [ 997.384985] binder: 29242:29255 got transaction to invalid handle [ 997.384994] binder: 29242:29255 transaction failed 29201/-22, size 80-24 line 3013 [ 997.440462] binder: 29269:29279 got transaction to invalid handle [ 997.440472] binder: 29269:29279 transaction failed 29201/-22, size 80-24 line 3013 [ 997.505013] binder: 29287:29297 got transaction to invalid handle [ 997.505022] binder: 29287:29297 transaction failed 29201/-22, size 80-24 line 3013 [ 997.595402] binder: 29311:29319 got transaction to invalid handle [ 997.595412] binder: 29311:29319 transaction failed 29201/-22, size 80-24 line 3013 [ 997.723101] binder: 29352:29359 got transaction to invalid handle [ 997.723110] binder: 29352:29359 transaction failed 29201/-22, size 80-24 line 3013 [ 997.826677] binder: 29377:29379 got transaction to invalid handle [ 997.826686] binder: 29377:29379 transaction failed 29201/-22, size 80-24 line 3013 [ 997.898172] binder: 29392:29410 got transaction to invalid handle [ 997.898185] binder: 29392:29410 transaction failed 29201/-22, size 80-24 line 3013 [ 997.951801] binder: 29422:29425 got transaction to invalid handle [ 997.951810] binder: 29422:29425 transaction failed 29201/-22, size 80-24 line 3013 [ 997.988094] binder: 29434:29437 got transaction to invalid handle [ 997.988103] binder: 29434:29437 transaction failed 29201/-22, size 80-24 line 3013 [ 998.084118] binder: 29455:29459 got transaction to invalid handle [ 998.084126] binder: 29455:29459 transaction failed 29201/-22, size 80-24 line 3013 [ 998.137492] binder: 29471:29477 got transaction to invalid handle [ 998.137501] binder: 29471:29477 transaction failed 29201/-22, size 80-24 line 3013 [ 998.186054] binder: 29496:29501 got transaction to invalid handle [ 998.186064] binder: 29496:29501 transaction failed 29201/-22, size 80-24 line 3013 [ 998.266805] binder: 29507:29508 got transaction to invalid handle [ 998.266816] binder: 29507:29508 transaction failed 29201/-22, size 80-24 line 3013 [ 998.317147] binder: 29531:29536 got transaction to invalid handle [ 998.317155] binder: 29531:29536 transaction failed 29201/-22, size 80-24 line 3013 [ 998.352658] binder: 29539:29543 got transaction to invalid handle [ 998.352668] binder: 29539:29543 transaction failed 29201/-22, size 80-24 line 3013 [ 998.382540] binder: 29550:29555 got transaction to invalid handle [ 998.382547] binder: 29550:29555 transaction failed 29201/-22, size 80-24 line 3013 [ 998.475321] binder: 29568:29570 got transaction to invalid handle [ 998.475329] binder: 29568:29570 transaction failed 29201/-22, size 80-24 line 3013 [ 998.570635] binder: 29584:29592 got transaction to invalid handle [ 998.570647] binder: 29584:29592 transaction failed 29201/-22, size 80-24 line 3013 [ 998.614406] binder: 29600:29607 got transaction to invalid handle [ 998.614416] binder: 29600:29607 transaction failed 29201/-22, size 80-24 line 3013 [ 998.665325] binder: 29615:29618 got transaction to invalid handle [ 998.665333] binder: 29615:29618 transaction failed 29201/-22, size 80-24 line 3013 [ 998.790155] binder: 29642:29643 got transaction to invalid handle [ 998.790166] binder: 29642:29643 transaction failed 29201/-22, size 80-24 line 3013 [ 998.846578] binder: 29666:29671 got transaction to invalid handle [ 998.846588] binder: 29666:29671 transaction failed 29201/-22, size 80-24 line 3013 [ 998.945120] binder: 29687:29698 got transaction to invalid handle [ 998.945130] binder: 29687:29698 transaction failed 29201/-22, size 80-24 line 3013 [ 998.994997] binder: 29707:29715 got transaction to invalid handle [ 998.995007] binder: 29707:29715 transaction failed 29201/-22, size 80-24 line 3013 [ 999.040597] binder: 29718:29729 got transaction to invalid handle [ 999.040606] binder: 29718:29729 transaction failed 29201/-22, size 80-24 line 3013 [ 999.184710] binder: 29755:29757 got transaction to invalid handle [ 999.184719] binder: 29755:29757 transaction failed 29201/-22, size 80-24 line 3013 [ 999.257883] binder: 29773:29787 got transaction to invalid handle [ 999.257893] binder: 29773:29787 transaction failed 29201/-22, size 80-24 line 3013 [ 999.333460] binder: 29804:29810 got transaction to invalid handle [ 999.333469] binder: 29804:29810 transaction failed 29201/-22, size 80-24 line 3013 [ 999.395107] binder: 29825:29830 got transaction to invalid handle [ 999.395118] binder: 29825:29830 transaction failed 29201/-22, size 80-24 line 3013 [ 999.439406] binder: 29838:29845 got transaction to invalid handle [ 999.439417] binder: 29838:29845 transaction failed 29201/-22, size 80-24 line 3013 [ 999.478251] binder: 29856:29859 got transaction to invalid handle [ 999.478260] binder: 29856:29859 transaction failed 29201/-22, size 80-24 line 3013 [ 999.543834] binder: 29873:29879 got transaction to invalid handle [ 999.543845] binder: 29873:29879 transaction failed 29201/-22, size 80-24 line 3013 [ 999.622464] binder: 29894:29900 got transaction to invalid handle [ 999.622473] binder: 29894:29900 transaction failed 29201/-22, size 80-24 line 3013 [ 999.653134] binder: 29909:29914 got transaction to invalid handle [ 999.653143] binder: 29909:29914 transaction failed 29201/-22, size 80-24 line 3013 [ 999.717679] binder: 29921:29933 got transaction to invalid handle [ 999.717688] binder: 29921:29933 transaction failed 29201/-22, size 80-24 line 3013 [ 999.777511] binder: 29943:29951 got transaction to invalid handle [ 999.777521] binder: 29943:29951 transaction failed 29201/-22, size 80-24 line 3013 [ 999.826055] binder: 29965:29969 got transaction to invalid handle [ 999.826066] binder: 29965:29969 transaction failed 29201/-22, size 80-24 line 3013 [ 999.845819] binder: 29977:29979 got transaction to invalid handle [ 999.845828] binder: 29977:29979 transaction failed 29201/-22, size 80-24 line 3013 [ 999.910303] binder: 29988:29990 got transaction to invalid handle [ 999.910314] binder: 29988:29990 transaction failed 29201/-22, size 80-24 line 3013 [ 999.951569] binder: 30004:30005 got transaction to invalid handle [ 999.951578] binder: 30004:30005 transaction failed 29201/-22, size 80-24 line 3013 [ 1000.040716] binder: 30040:30043 got transaction to invalid handle [ 1000.040725] binder: 30040:30043 transaction failed 29201/-22, size 80-24 line 3013 [ 1000.139260] binder: 30065:30070 got transaction to invalid handle [ 1000.139270] binder: 30065:30070 transaction failed 29201/-22, size 80-24 line 3013 [ 1000.201846] binder: 30085:30092 got transaction to invalid handle [ 1000.201855] binder: 30085:30092 transaction failed 29201/-22, size 80-24 line 3013 [ 1000.329042] binder: 30113:30128 got transaction to invalid handle [ 1000.329052] binder: 30113:30128 transaction failed 29201/-22, size 80-24 line 3013 [ 1000.423511] binder: 30145:30156 got transaction to invalid handle [ 1000.423519] binder: 30145:30156 transaction failed 29201/-22, size 80-24 line 3013 [ 1000.490165] binder: 30168:30172 got transaction to invalid handle [ 1000.490177] binder: 30168:30172 transaction failed 29201/-22, size 80-24 line 3013 [ 1000.536102] binder: 30185:30186 got transaction to invalid handle [ 1000.536112] binder: 30185:30186 transaction failed 29201/-22, size 80-24 line 3013 [ 1000.594913] binder: 30199:30207 got transaction to invalid handle [ 1000.594924] binder: 30199:30207 transaction failed 29201/-22, size 80-24 line 3013 [ 1000.638845] binder: 30217:30225 got transaction to invalid handle [ 1000.638854] binder: 30217:30225 transaction failed 29201/-22, size 80-24 line 3013 [ 1000.685435] binder: 30235:30240 got transaction to invalid handle [ 1000.685444] binder: 30235:30240 transaction failed 29201/-22, size 80-24 line 3013 [ 1000.726978] binder: 30249:30252 got transaction to invalid handle [ 1000.736700] binder: 30249:30252 transaction failed 29201/-22, size 80-24 line 3013 [ 1000.783075] binder: 30263:30271 got transaction to invalid handle [ 1000.783084] binder: 30263:30271 transaction failed 29201/-22, size 80-24 line 3013 [ 1000.853502] binder: 30288:30293 got transaction to invalid handle [ 1000.853510] binder: 30288:30293 transaction failed 29201/-22, size 80-24 line 3013 [ 1000.898946] binder: 30301:30312 got transaction to invalid handle [ 1000.898956] binder: 30301:30312 transaction failed 29201/-22, size 80-24 line 3013 [ 1000.987407] binder: 30327:30336 got transaction to invalid handle [ 1000.987416] binder: 30327:30336 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.038657] binder: 30342:30346 got transaction to invalid handle [ 1001.038666] binder: 30342:30346 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.074594] binder: 30360:30369 got transaction to invalid handle [ 1001.074603] binder: 30360:30369 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.188145] binder: 30390:30394 got transaction to invalid handle [ 1001.188155] binder: 30390:30394 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.319247] binder: 30407:30430 got transaction to invalid handle [ 1001.319256] binder: 30407:30430 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.362550] binder: 30440:30447 got transaction to invalid handle [ 1001.362559] binder: 30440:30447 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.420703] binder: 30456:30460 got transaction to invalid handle [ 1001.420712] binder: 30456:30460 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.481824] binder: 30477:30483 got transaction to invalid handle [ 1001.481834] binder: 30477:30483 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.540126] binder: 30497:30499 got transaction to invalid handle [ 1001.540134] binder: 30497:30499 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.613877] binder: 30518:30525 got transaction to invalid handle [ 1001.613885] binder: 30518:30525 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.639579] binder: 30534:30539 got transaction to invalid handle [ 1001.639587] binder: 30534:30539 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.705921] binder: 30548:30552 got transaction to invalid handle [ 1001.705931] binder: 30548:30552 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.777704] binder: 30561:30571 got transaction to invalid handle [ 1001.777714] binder: 30561:30571 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.826903] binder: 30585:30592 got transaction to invalid handle [ 1001.826912] binder: 30585:30592 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.889676] binder: 30597:30607 got transaction to invalid handle [ 1001.889687] binder: 30597:30607 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.956049] binder: 30626:30631 got transaction to invalid handle [ 1001.956058] binder: 30626:30631 transaction failed 29201/-22, size 80-24 line 3013 [ 1001.994005] binder: 30638:30643 got transaction to invalid handle [ 1001.994014] binder: 30638:30643 transaction failed 29201/-22, size 80-24 line 3013 [ 1002.078544] binder: 30666:30669 got transaction to invalid handle [ 1002.078554] binder: 30666:30669 transaction failed 29201/-22, size 80-24 line 3013 [ 1002.175401] binder: 30683:30694 got transaction to invalid handle [ 1002.175410] binder: 30683:30694 transaction failed 29201/-22, size 80-24 line 3013 [ 1002.272960] binder: 30709:30726 got transaction to invalid handle [ 1002.272971] binder: 30709:30726 transaction failed 29201/-22, size 80-24 line 3013 [ 1002.345261] binder: 30740:30747 got transaction to invalid handle [ 1002.345269] binder: 30740:30747 transaction failed 29201/-22, size 80-24 line 3013 [ 1002.460632] binder: 30780:30782 got transaction to invalid handle [ 1002.460644] binder: 30780:30782 transaction failed 29201/-22, size 80-24 line 3013 [ 1002.564076] binder: 30793:30809 got transaction to invalid handle [ 1002.564088] binder: 30793:30809 transaction failed 29201/-22, size 80-24 line 3013 [ 1002.656407] binder: 30832:30838 got transaction to invalid handle [ 1002.656415] binder: 30832:30838 transaction failed 29201/-22, size 80-24 line 3013 [ 1002.708817] binder: 30849:30854 got transaction to invalid handle [ 1002.708827] binder: 30849:30854 transaction failed 29201/-22, size 80-24 line 3013 [ 1002.784543] binder: 30864:30871 got transaction to invalid handle [ 1002.784552] binder: 30864:30871 transaction failed 29201/-22, size 80-24 line 3013 [ 1002.843551] binder: 30882:30892 got transaction to invalid handle [ 1002.843560] binder: 30882:30892 transaction failed 29201/-22, size 80-24 line 3013 [ 1002.882982] binder: 30902:30903 got transaction to invalid handle [ 1002.882991] binder: 30902:30903 transaction failed 29201/-22, size 80-24 line 3013 [ 1002.944555] INFO: task kworker/u4:2:2085 blocked for more than 140 seconds. [ 1002.944560] Not tainted 4.9.141+ #1 [ 1002.944562] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1002.944583] kworker/u4:2 D25400 2085 2 0x80000000 [ 1002.944601] Workqueue: events_unbound fsnotify_mark_destroy_workfn [ 1002.944614] ffff8801d166df00 ffff880171c1f380 ffff8801b47ed280 ffff8801d86197c0 [ 1002.944625] ffff8801db721018 ffff8801c50377c0 ffffffff828075c2 0000000000000096 [ 1002.944634] ffffffff83ce58a0 ffffffff830d2c20 0000000000005426 ffff8801db7218f0 [ 1002.944636] Call Trace: [ 1002.944649] [] ? __schedule+0x662/0x1b10 [ 1002.944656] [] schedule+0x7f/0x1b0 [ 1002.944663] [] schedule_timeout+0x735/0xe20 [ 1002.944671] [] ? mod_timer+0x5b2/0xf80 [ 1002.944680] [] ? calc_wheel_index+0x33/0x1b0 [ 1002.944687] [] ? usleep_range+0x140/0x140 [ 1002.944694] [] ? _raw_spin_unlock_irqrestore+0x45/0x70 [ 1002.944701] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1002.944709] [] ? mark_held_locks+0xc7/0x130 [ 1002.944715] [] ? _raw_spin_unlock_irq+0x27/0x50 [ 1002.944722] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 1002.944730] [] wait_for_common+0x3ef/0x5d0 [ 1002.944737] [] ? out_of_line_wait_on_atomic_t+0x1e0/0x1e0 [ 1002.944744] [] ? wake_up_q+0xe0/0xe0 [ 1002.944751] [] ? srcu_reschedule+0x85/0x310 [ 1002.944757] [] ? srcu_advance_batches+0x1e4/0x430 [ 1002.944765] [] wait_for_completion+0x18/0x20 [ 1002.944772] [] __synchronize_srcu+0x254/0x3b0 [ 1002.944779] [] ? srcu_advance_batches+0x430/0x430 [ 1002.944785] [] ? trace_raw_output_rcu_utilization+0x150/0x150 [ 1002.944793] [] ? fsnotify_mark_destroy_list+0x80/0x390 [ 1002.944800] [] ? fsnotify_mark_destroy_list+0x103/0x390 [ 1002.944807] [] synchronize_srcu+0x1e/0x40 [ 1002.944814] [] fsnotify_mark_destroy_list+0x10f/0x390 [ 1002.944823] [] ? debug_object_deactivate+0x214/0x340 [ 1002.944830] [] ? fsnotify_init_mark+0xa0/0xa0 [ 1002.944838] [] fsnotify_mark_destroy_workfn+0xe/0x10 [ 1002.944845] [] process_one_work+0x831/0x15f0 [ 1002.944852] [] ? process_one_work+0x774/0x15f0 [ 1002.944859] [] ? cancel_delayed_work_sync+0x20/0x20 [ 1002.944865] [] worker_thread+0xd6/0x1140 [ 1002.944874] [] kthread+0x26d/0x300 [ 1002.944881] [] ? process_one_work+0x15f0/0x15f0 [ 1002.944888] [] ? kthread_park+0xa0/0xa0 [ 1002.944895] [] ? __switch_to_asm+0x34/0x70 [ 1002.944902] [] ? kthread_park+0xa0/0xa0 [ 1002.944908] [] ? kthread_park+0xa0/0xa0 [ 1002.944915] [] ret_from_fork+0x5c/0x70 [ 1002.944919] [ 1002.944919] Showing all locks held in the system: [ 1002.944925] 2 locks held by khungtaskd/24: [ 1002.944941] #0: (rcu_read_lock){......}, at: [] watchdog+0x11c/0xa20 [ 1002.944962] #1: (tasklist_lock){.+.+..}, at: [] debug_show_all_locks+0x79/0x218 [ 1002.944970] 1 lock held by rsyslogd/1894: [ 1002.944984] #0: (&f->f_pos_lock){+.+.+.}, at: [] __fdget_pos+0xac/0xd0 [ 1002.944988] 2 locks held by getty/2021: [ 1002.945001] #0: (&tty->ldisc_sem){++++++}, at: [] ldsem_down_read+0x32/0x40 [ 1002.945016] #1: (&ldata->atomic_read_lock){+.+...}, at: [] n_tty_read+0x202/0x16e0 [ 1002.945021] 2 locks held by kworker/u4:2/2085: [ 1002.945033] #0: ("events_unbound"){.+.+.+}, at: [] process_one_work+0x73c/0x15f0 [ 1002.945045] #1: ((reaper_work).work){+.+...}, at: [] process_one_work+0x774/0x15f0 [ 1002.945049] 2 locks held by udevd/2273: [ 1002.945062] #0: (sb_writers#6){.+.+.+}, at: [] mnt_want_write+0x3f/0xb0 [ 1002.945075] #1: (&type->i_mutex_dir_key#4){++++++}, at: [] path_openat+0xf13/0x2790 [ 1002.945498] 1 lock held by init/8543: [ 1002.945513] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 1002.945517] 1 lock held by init/8544: [ 1002.945528] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 1002.945532] 1 lock held by init/8548: [ 1002.945561] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 1002.945565] 1 lock held by init/8549: [ 1002.945577] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 1002.945582] 1 lock held by init/8837: [ 1002.945593] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 1002.945597] 1 lock held by init/8838: [ 1002.945609] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 1002.945818] [ 1002.945820] ============================================= [ 1002.945820] [ 1002.945824] NMI backtrace for cpu 1 [ 1002.945831] CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.141+ #1 [ 1002.945843] ffff8801d9907d08 ffffffff81b42e79 0000000000000000 0000000000000001 [ 1002.945852] 0000000000000001 0000000000000001 ffffffff810983b0 ffff8801d9907d40 [ 1002.945861] ffffffff81b4df89 0000000000000001 0000000000000000 0000000000000002 [ 1002.945863] Call Trace: [ 1002.945873] [] dump_stack+0xc1/0x128 [ 1002.945883] [] ? irq_force_complete_move+0x330/0x330 [ 1002.945891] [] nmi_cpu_backtrace.cold.0+0x48/0x87 [ 1002.945899] [] ? irq_force_complete_move+0x330/0x330 [ 1002.945907] [] nmi_trigger_cpumask_backtrace+0x12c/0x151 [ 1002.945915] [] arch_trigger_cpumask_backtrace+0x14/0x20 [ 1002.945923] [] watchdog+0x6ad/0xa20 [ 1002.945930] [] ? watchdog+0x11c/0xa20 [ 1002.945938] [] kthread+0x26d/0x300 [ 1002.945945] [] ? reset_hung_task_detector+0x20/0x20 [ 1002.945959] [] ? kthread_park+0xa0/0xa0 [ 1002.945969] [] ? __switch_to_asm+0x34/0x70 [ 1002.945976] [] ? kthread_park+0xa0/0xa0 [ 1002.945982] [] ? kthread_park+0xa0/0xa0 [ 1002.945988] [] ret_from_fork+0x5c/0x70 [ 1002.945993] Sending NMI from CPU 1 to CPUs 0: [ 1002.946225] NMI backtrace for cpu 0 [ 1002.946228] CPU: 0 PID: 30920 Comm: blkid Not tainted 4.9.141+ #1 [ 1002.946230] task: ffff88014ed14740 task.stack: ffff880149458000 [ 1002.946233] RIP: 0010:[] c [] __sanitizer_cov_trace_pc+0x18/0x50 [ 1002.946235] RSP: 0000:ffff88014945fbd8 EFLAGS: 00000206 [ 1002.946238] RAX: ffff88014ed14740 RBX: 0000000000000026 RCX: 0000000000000002 [ 1002.946240] RDX: 0000000080000001 RSI: ffffffff8140e8e3 RDI: ffff88014945fde0 [ 1002.946243] RBP: ffff88014945fbd8 R08: ffff88014ed14ff0 R09: 7f70417bce56eb79 [ 1002.946246] R10: ffff88014ed14740 R11: 0000000000000001 R12: ffffea00087eb3c0 [ 1002.946248] R13: dffffc0000000000 R14: 0000000000000001 R15: ffff8801462e23d0 [ 1002.946251] FS: 0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 [ 1002.946253] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1002.946256] CR2: 00007f6a52e7ad80 CR3: 0000000144f91000 CR4: 00000000001606b0 [ 1002.946259] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1002.946261] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1002.946262] Stack: [ 1002.946265] ffff88014945fce0c ffffffff8140e8e3c ffffffff8140e524c ffffed003189d2adc [ 1002.946268] ffff88018c4e956cc 1ffff1002928bf8bc ffff8801d93e74c8c 0000000000000026c [ 1002.946271] ffff88014945fdd0c ffff88018c4e9400c 0000000000000026c ffffea00087eb3c0c [ 1002.946272] Call Trace: [ 1002.946275] [] filemap_map_pages+0x4b3/0xc30 [ 1002.946277] [] ? filemap_map_pages+0xf4/0xc30 [ 1002.946279] [] ? generic_file_readonly_mmap+0x190/0x190 [ 1002.946282] [] ? generic_file_readonly_mmap+0x190/0x190 [ 1002.946284] [] handle_mm_fault+0x1985/0x2350 [ 1002.946287] [] ? vm_insert_page+0x6f0/0x6f0 [ 1002.946289] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1002.946292] [] __do_page_fault+0x403/0xa60 [ 1002.946294] [] ? bad_area_access_error+0x3a0/0x3a0 [ 1002.946296] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1002.946299] [] do_page_fault+0x27/0x30 [ 1002.946301] [] page_fault+0x25/0x30 [ 1002.946308] Code: cfe cff cff c4c c89 ce7 ce8 c08 c76 c1d c00 ce9 c23 cfe cff cff c0f c1f c00 c55 c48 c89 ce5 c48 c8b c75 c08 c65 c48 c8b c04 c25 c00 c7e c01 c00 c65 c8b c15 c18 cc3 ccf c7e c<81> ce2 c00 c01 c1f c00 c75 c2b c8b c90 c38 c12 c00 c00 c83 cfa c02 c75 c20 c48 c8b c [ 1002.947009] Kernel panic - not syncing: hung_task: blocked tasks [ 1002.947016] CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.141+ #1 [ 1002.947027] ffff8801d9907cc8 ffffffff81b42e79 ffffffff82a78560 00000000ffffffff [ 1002.947037] 0000000000000000 0000000000000001 dffffc0000000000 ffff8801d9907d88 [ 1002.947046] ffffffff813f7125 0000000041b58ab3 ffffffff82e2b62b ffffffff813f6f66 [ 1002.947048] Call Trace: [ 1002.947059] [] dump_stack+0xc1/0x128 [ 1002.947066] [] panic+0x1bf/0x39f [ 1002.947073] [] ? add_taint.cold.5+0x16/0x16 [ 1002.947081] [] ? nmi_trigger_cpumask_backtrace+0x102/0x151 [ 1002.947087] [] watchdog+0x6be/0xa20 [ 1002.947093] [] ? watchdog+0x11c/0xa20 [ 1002.947099] [] kthread+0x26d/0x300 [ 1002.947107] [] ? reset_hung_task_detector+0x20/0x20 [ 1002.947113] [] ? kthread_park+0xa0/0xa0 [ 1002.947120] [] ? __switch_to_asm+0x34/0x70 [ 1002.947127] [] ? kthread_park+0xa0/0xa0 [ 1002.947133] [] ? kthread_park+0xa0/0xa0 [ 1002.947140] [] ret_from_fork+0x5c/0x70 [ 1002.947654] Kernel Offset: disabled