], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3237.112112][ T4870] binder: 4861:4870 ioctl c0306201 0 returned -14
14:56:44 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:44 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
getpid()
sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
write(r3, &(0x7f0000000340), 0x41395527)
vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:56:44 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3237.309147][ T4882] binder: 4881:4882 ioctl c0306201 0 returned -14
14:56:44 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140)}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:44 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:56:44 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aa", 0x94, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3237.729608][   T26] audit: type=1326 audit(1586876204.669:487): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=4890 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3237.876733][ T4912] binder: 4910:4912 ioctl c0306201 0 returned -14
14:56:44 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3238.307927][ T4927] binder: 4897:4927 ioctl c0306201 0 returned -14
[ 3238.312455][ T4914] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 0)
[ 3238.323123][ T4914] FAT-fs (loop3): Filesystem has been set read-only
[ 3238.331480][ T4914] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3238.349279][ T4890] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
14:56:45 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
getpid()
sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
write(r3, &(0x7f0000000340), 0x41395527)
vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:56:45 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2", 0x95, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:45 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140)}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:45 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r1 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000000100))

14:56:45 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r1 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000000100))

14:56:45 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:45 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3c", 0xb9}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:45 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r1 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000000100))

[ 3238.952551][ T4949] binder: 4945:4949 ioctl c0306201 0 returned -14
[ 3239.086166][   T26] audit: type=1326 audit(1586876206.029:488): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=4947 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:56:46 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

[ 3239.368932][ T4973] binder: 4960:4973 ioctl c0306201 0 returned -14
14:56:46 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2", 0x95, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:46 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140)}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:46 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {0x0, 0x0, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:46 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
getpid()
sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
write(r3, &(0x7f0000000340), 0x41395527)
vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:56:46 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3c", 0xb9}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3240.050543][ T4996] binder: 4992:4996 ioctl c0306201 0 returned -14
[ 3240.198209][   T26] audit: type=1326 audit(1586876207.139:489): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5001 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3240.690396][ T5016] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 0)
[ 3240.699329][ T5016] FAT-fs (loop3): Filesystem has been set read-only
[ 3240.710744][ T5016] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
14:56:47 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {0x0, 0x0, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:47 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:56:47 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3c", 0xb9}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3240.883342][ T5001] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
14:56:47 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, 0x0, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:56:47 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:47 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2", 0x95, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3241.359366][ T5052] binder: 5047:5052 ioctl c0306201 0 returned -14
14:56:48 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {0x0, 0x0, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:48 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1", 0xd8}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3241.521525][   T26] audit: type=1326 audit(1586876208.459:490): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5050 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:56:48 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3241.851297][ T5073] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 0)
[ 3241.860064][ T5073] FAT-fs (loop3): Filesystem has been set read-only
[ 3241.868706][ T5073] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3241.879990][ T5073] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3241.889990][ T5073] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
14:56:48 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:56:48 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:49 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0), 0x0, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3242.157929][ T5050] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
14:56:49 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, 0x0, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:56:49 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3242.539343][   T26] audit: type=1326 audit(1586876209.479:491): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5108 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:56:49 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1", 0xd8}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:49 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3242.611688][ T5113] binder: 5096:5113 ioctl c0306201 0 returned -14
14:56:50 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
getpid()
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r1, &(0x7f0000000340), 0x41395527)
vmsplice(r0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))

14:56:50 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{0x0, 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:50 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, 0x0, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

[ 3243.683755][ T5132] binder: 5131:5132 ioctl c0306201 0 returned -14
14:56:50 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0), 0x0, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:50 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1", 0xd8}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3243.996828][   T26] audit: type=1326 audit(1586876210.939:492): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5137 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:56:51 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:51 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0), 0x0, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:51 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{0x0, 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:51 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b6", 0xe7}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:51 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
getpid()
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r1, &(0x7f0000000340), 0x41395527)
vmsplice(r0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))

14:56:51 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

[ 3245.054629][ T5196] binder: 5176:5196 ioctl c0306201 0 returned -14
14:56:52 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:52 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{0x0, 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3245.514283][ T5215] binder: 5212:5215 ioctl c0306201 0 returned -14
14:56:52 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eab", 0x4b, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3245.601367][   T26] audit: type=1326 audit(1586876212.539:493): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5206 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3245.863232][ T5230] binder: 5226:5230 ioctl c0306201 0 returned -14
14:56:53 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
getpid()
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r1, &(0x7f0000000340), 0x41395527)
vmsplice(r0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))

14:56:53 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b6", 0xe7}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:53 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0), 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:53 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:56:53 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:53 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eab", 0x4b, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3246.835254][   T26] audit: type=1326 audit(1586876213.780:494): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5256 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3246.867640][ T5268] binder: 5254:5268 ioctl c0306201 0 returned -14
14:56:54 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r1, &(0x7f0000000340), 0x41395527)
vmsplice(r0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))

14:56:54 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0), 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:54 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b6", 0xe7}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:54 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:54 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eab", 0x4b, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:54 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

[ 3247.848766][ T5299] binder: 5293:5299 ioctl c0306201 0 returned -14
14:56:55 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0), 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3248.179572][ T5315] binder: 5295:5315 ioctl c0306201 0 returned -14
[ 3248.219568][   T26] audit: type=1326 audit(1586876215.160:495): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5305 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:56:55 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc3", 0xef}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:55 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {0x0, 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:55 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r1, &(0x7f0000000340), 0x41395527)
vmsplice(r0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))

14:56:55 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c", 0x71, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:56 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:56:56 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca", 0x76, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:56 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {0x0, 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3249.326734][   T26] audit: type=1326 audit(1586876216.270:496): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5350 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3249.620238][ T5371] binder: 5370:5371 ioctl c0306201 0 returned -14
[ 3249.639233][ T5365] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 0)
[ 3249.683625][ T5365] FAT-fs (loop3): Filesystem has been set read-only
[ 3249.708062][ T5365] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3249.716579][ T5365] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3249.725030][ T5365] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
14:56:56 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r1, &(0x7f0000000340), 0x41395527)
vmsplice(r0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))

14:56:56 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c", 0x71, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:56 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc3", 0xef}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:56 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {0x0, 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3250.010392][ T5350] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3250.061973][ T5386] binder: 5385:5386 ioctl c0306201 0 returned -14
14:56:57 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:56:57 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca", 0x76, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3250.346389][ T5389] binder: 5387:5389 ioctl c0306201 0 returned -14
14:56:57 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140)}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3250.581333][   T26] audit: type=1326 audit(1586876217.520:497): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5399 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3250.787887][ T5414] binder: 5412:5414 ioctl c0306201 0 returned -14
14:56:58 executing program 4:
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:56:58 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc3", 0xef}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:58 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c", 0x71, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:58 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:56:58 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140)}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:58 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca", 0x76, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3251.706049][ T5443] binder: 5435:5443 ioctl c0306201 0 returned -14
14:56:58 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140)}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3251.915523][   T26] audit: type=1326 audit(1586876218.860:498): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5444 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:56:59 executing program 4:
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:56:59 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df", 0x84, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:59 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f419", 0xf3}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:59 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bc", 0xb1, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:59 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:56:59 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:56:59 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df", 0x84, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3253.079334][ T5499] binder: 5496:5499 ioctl c0306201 0 returned -14
14:57:00 executing program 4:
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

[ 3253.308000][   T26] audit: type=1326 audit(1586876220.250:499): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5500 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3253.504635][ T5517] binder: 5505:5517 ioctl c0306201 0 returned -14
14:57:00 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f419", 0xf3}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:00 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:00 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bc", 0xb1, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:00 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:00 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df", 0x84, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3254.051982][ T5532] binder: 5531:5532 ioctl c0306201 0 returned -14
[ 3254.479825][   T26] audit: type=1326 audit(1586876221.420:500): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5539 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:01 executing program 4:
prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:01 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bc", 0xb1, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:02 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94", 0x8d, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:02 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:02 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f419", 0xf3}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:02 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3255.384761][ T5570] binder: 5569:5570 ioctl c0306201 0 returned -14
[ 3255.475448][ T5582] binder: 5576:5582 ioctl c0306201 0 returned -14
14:57:02 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94", 0x8d, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:02 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f92", 0xcf, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3255.706565][   T26] audit: type=1326 audit(1586876222.650:501): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5583 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3255.870150][ T5610] binder: 5604:5610 ioctl c0306201 0 returned -14
14:57:03 executing program 4:
prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:03 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{0x0, 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:03 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f", 0xf5}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:03 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94", 0x8d, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3256.408563][ T5621] binder: 5620:5621 ioctl c0306201 0 returned -14
14:57:03 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff})
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:03 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f92", 0xcf, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3256.801961][   T26] audit: type=1326 audit(1586876223.740:502): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5635 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3256.833243][ T5637] binder: 5632:5637 ioctl c0306201 0 returned -14
14:57:03 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{0x0, 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:04 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff})
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:04 executing program 4:
prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:04 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f", 0xf5}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:04 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f92", 0xcf, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:04 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e1", 0x92, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3257.891199][   T26] audit: type=1326 audit(1586876224.830:503): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5669 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:05 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff})
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:05 executing program 4:
prlimit64(0x0, 0xe, 0x0, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:05 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{0x0, 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:05 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f", 0xf5}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:05 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da5", 0xde, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3258.977050][ T5721] binder: 5718:5721 ioctl c0306201 0 returned -14
[ 3258.989269][   T26] audit: type=1326 audit(1586876225.931:504): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5717 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:06 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e1", 0x92, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3259.174371][ T5724] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3259.182446][ T5724] FAT-fs (loop3): Filesystem has been set read-only
[ 3259.191498][ T5724] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
14:57:06 executing program 4:
prlimit64(0x0, 0xe, 0x0, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

[ 3259.643343][ T5732] binder: 5730:5732 ioctl c0306201 0 returned -14
14:57:06 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, 0x0, 0x0)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:06 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0), 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:06 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da5", 0xde, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:06 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3260.039997][   T26] audit: type=1326 audit(1586876226.981:505): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5756 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:07 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e1", 0x92, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3260.236375][ T5767] binder: 5759:5767 ioctl c0306201 0 returned -14
[ 3260.242339][ T5766] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3260.250870][ T5766] FAT-fs (loop3): Filesystem has been set read-only
[ 3260.258919][ T5766] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3260.460490][ T5772] binder: 5771:5772 ioctl c0306201 0 returned -14
14:57:07 executing program 4:
prlimit64(0x0, 0xe, 0x0, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:07 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0), 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:07 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, 0x0, 0x0)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:07 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3260.914833][ T5795] binder: 5794:5795 ioctl c0306201 0 returned -14
14:57:08 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da5", 0xde, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:08 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aa", 0x94, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3261.132934][   T26] audit: type=1326 audit(1586876228.071:506): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5800 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:08 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0), 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3261.336524][ T5813] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3261.344893][ T5813] FAT-fs (loop3): Filesystem has been set read-only
[ 3261.351850][ T5813] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3261.597122][ T5827] binder: 5818:5827 ioctl c0306201 0 returned -14
14:57:08 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3261.657342][ T5829] binder: 5815:5829 ioctl c0306201 0 returned -14
14:57:08 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c", 0xe5, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:08 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:08 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, 0x0, 0x0)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:08 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca", 0x76, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3262.071328][ T5848] binder: 5846:5848 ioctl c0306201 0 returned -14
14:57:09 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aa", 0x94, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:09 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c", 0xe5, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3262.506390][   T26] audit: type=1326 audit(1586876229.451:507): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5859 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:09 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{0x0}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:09 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca", 0x76, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:10 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:10 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
write(r3, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

[ 3263.229417][ T5891] binder: 5887:5891 ioctl c0306201 0 returned -14
14:57:10 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aa", 0x94, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:10 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c", 0xe5, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3263.589305][   T26] audit: type=1326 audit(1586876230.531:508): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5903 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:10 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{0x0}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3263.766213][ T5920] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3263.775263][ T5920] FAT-fs (loop3): Filesystem has been set read-only
[ 3263.782858][ T5920] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
14:57:10 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca", 0x76, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3263.812208][ T5917] binder: 5906:5917 ioctl c0306201 0 returned -14
[ 3264.098280][ T5930] binder: 5929:5930 ioctl c0306201 0 returned -14
14:57:11 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:11 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
write(r3, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:11 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0", 0xe9, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:11 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{0x0}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:11 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2", 0x95, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:11 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bc", 0xb1, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3265.010942][   T26] audit: type=1326 audit(1586876231.951:509): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=5956 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:12 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:12 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
write(r3, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:12 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0", 0xe9, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:12 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2", 0x95, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:12 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:12 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bc", 0xb1, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3266.133537][   T26] audit: type=1326 audit(1586876233.081:510): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6000 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3266.297748][ T6013] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3266.306112][ T6013] FAT-fs (loop3): Filesystem has been set read-only
[ 3266.313756][ T6013] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3266.329021][ T5997] binder: 5994:5997 ioctl c0306201 0 returned -14
14:57:13 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3266.526052][ T6025] binder: 6018:6025 ioctl c0306201 0 returned -14
14:57:13 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0", 0xe9, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:13 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2", 0x95, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:13 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:13 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, 0x0, 0x0, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

[ 3267.235021][ T6049] binder: 6036:6049 ioctl c0306201 0 returned -14
[ 3267.289374][   T26] audit: type=1326 audit(1586876234.231:511): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6048 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:14 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:14 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bc", 0xb1, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:14 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:14 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe83", 0xeb, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:14 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:15 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, 0x0, 0x0, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:15 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f92", 0xcf, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:15 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c", 0x2c}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:15 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe83", 0xeb, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:15 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3268.557971][   T26] audit: type=1326 audit(1586876235.501:512): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6096 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:16 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
getpid()
sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r1, &(0x7f0000000340), 0x41395527)
vmsplice(r0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))

14:57:16 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, 0x0, 0x0, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:16 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f92", 0xcf, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:16 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe83", 0xeb, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:16 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:16 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c", 0x2c}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3269.794654][ T6143] binder: 6142:6143 ioctl c0306201 0 returned -14
[ 3270.054938][   T26] audit: type=1326 audit(1586876237.001:513): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6144 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:17 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000), 0x0, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:17 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f92", 0xcf, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:17 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
getpid()
sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r1, &(0x7f0000000340), 0x41395527)
vmsplice(r0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))

14:57:17 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:17 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:17 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c", 0x2c}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3271.182163][   T26] audit: type=1326 audit(1586876238.131:514): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6184 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:18 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da5", 0xde, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:18 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:18 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000), 0x0, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:18 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
getpid()
sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r1, &(0x7f0000000340), 0x41395527)
vmsplice(r0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))

[ 3271.854271][ T6222] binder: 6221:6222 ioctl c0306201 0 returned -14
14:57:18 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:19 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4", 0x42}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3272.377521][   T26] audit: type=1326 audit(1586876239.322:515): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6233 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:19 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:19 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da5", 0xde, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:19 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:19 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:20 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000), 0x0, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:20 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4", 0x42}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3273.235264][ T6269] binder: 6263:6269 ioctl c0306201 0 returned -14
[ 3273.354652][ T6270] binder: 6264:6270 ioctl c0306201 0 returned -14
[ 3273.625122][   T26] audit: type=1326 audit(1586876240.572:516): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6281 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:20 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {0x0, 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:20 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x0, &(0x7f0000000180)=']vmnet1+\x00')

14:57:21 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:21 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:21 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da5", 0xde, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:21 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4", 0x42}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:22 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {0x0, 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:22 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x0, &(0x7f0000000180)=']vmnet1+\x00')

[ 3275.113133][   T26] audit: type=1326 audit(1586876242.062:517): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6319 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:22 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c", 0xe5, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:22 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

[ 3275.644880][ T6351] binder: 6347:6351 ioctl c0306201 0 returned -14
14:57:22 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:22 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca65", 0x4d}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:22 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {0x0, 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3275.904907][ T6364] binder: 6354:6364 ioctl c0306201 0 returned -14
14:57:23 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c", 0xe5, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:23 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x0, &(0x7f0000000180)=']vmnet1+\x00')

[ 3276.257760][   T26] audit: type=1326 audit(1586876243.202:518): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6378 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3276.359263][ T6397] binder: 6396:6397 ioctl c0306201 0 returned -14
14:57:23 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:23 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca65", 0x4d}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:23 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:24 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140)}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:24 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, 0x0)

14:57:24 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c", 0xe5, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3277.500799][   T26] audit: type=1326 audit(1586876244.442:519): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6424 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:24 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca65", 0x4d}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3277.714454][ T6449] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3277.723022][ T6449] FAT-fs (loop3): Filesystem has been set read-only
[ 3277.730388][ T6449] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
14:57:24 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140)}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:24 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:24 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, 0x0)

14:57:25 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0", 0xe9, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:25 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

[ 3278.234456][ T6461] binder: 6458:6461 ioctl c0306201 0 returned -14
[ 3278.324289][ T6474] binder: 6470:6474 ioctl c0306201 0 returned -14
14:57:25 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc9", 0x52}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3278.664841][   T26] audit: type=1326 audit(1586876245.612:520): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6483 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:25 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140)}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:26 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000600)})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), 0x0)
setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c", 0x7b}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, 0x0)

14:57:26 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x9}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:26 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0", 0xe9, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:26 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:26 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc9", 0x52}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3279.503875][ T6510] binder: 6503:6510 ioctl c0306201 0 returned -14
[ 3279.615732][ T6515] binder: 6511:6515 ioctl c0306201 0 returned -14
14:57:26 executing program 1:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
fcntl$setpipe(r3, 0x407, 0x0)
write(r3, &(0x7f0000000340), 0x41395527)
vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r4 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000000100))
ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000000100))

[ 3279.794772][   T26] audit: type=1326 audit(1586876246.742:521): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6524 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:26 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0", 0xe9, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3279.969911][ T6543] binder: 6542:6543 ioctl c0306201 0 returned -14
14:57:27 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:27 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:27 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:27 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc9", 0x52}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:27 executing program 1:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
r1 = socket$inet6(0xa, 0x0, 0x0)
recvmmsg(r1, &(0x7f0000000700), 0x0, 0x0, 0x0)
pipe(0x0)
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100)={0x2, {0x2, 0x3f2}})

[ 3280.819568][   T26] audit: type=1326 audit(1586876247.762:522): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6556 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3280.906673][ T6569] binder: 6561:6569 ioctl c0306201 0 returned -14
14:57:28 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe83", 0xeb, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:28 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:28 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:28 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
ioctl(r0, 0x1000008912, &(0x7f0000001b40)="080db5055e0bcfe847a071")
r1 = creat(&(0x7f0000000340)='./bus\x00', 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x300000e, 0x10, r1, 0x0)

[ 3281.605492][ T6591] binder: 6588:6591 ioctl c0306201 0 returned -14
14:57:28 executing program 1:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
mkdir(&(0x7f00000009c0)='./file1\x00', 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400}, 0x100}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$qat_adf_ctl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
fstat(0xffffffffffffffff, 0x0)
setxattr$system_posix_acl(0x0, &(0x7f00000005c0)='system.posix_acl_default\x00', 0x0, 0x0, 0x0)
mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000})
mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000003e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]}}], 0x1, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x8000, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000002ec0), 0x4000000000009b8, 0x2, &(0x7f00000001c0)={0x77359400})
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)

14:57:28 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:28 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585", 0x55}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:29 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe83", 0xeb, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3282.049405][ T6605] overlayfs: filesystem on './file0' not supported as upperdir
[ 3282.104240][ T6620] binder: 6618:6620 ioctl c0306201 0 returned -14
[ 3282.227063][   T26] audit: type=1326 audit(1586876249.172:523): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6608 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3282.302334][ T6627] binder: 6610:6627 ioctl c0306201 0 returned -14
14:57:29 executing program 1:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
mkdir(&(0x7f00000009c0)='./file1\x00', 0x0)
syz_open_dev$dmmidi(0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400, 0xfff}, 0x100}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$qat_adf_ctl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
fstat(0xffffffffffffffff, 0x0)
setxattr$system_posix_acl(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [{}], {}, [{}, {}, {0x8, 0x3}, {}]}, 0x4c, 0x0)
mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000})
mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000003e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="5c76ca910ae2a325e460ac89b93400"], 0x3}}], 0x1, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-vsock\x00', 0x2, 0x0)
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x8000, &(0x7f0000000140)={0xa, 0x45, 0x0, @mcast1}, 0x1c)
write(0xffffffffffffffff, &(0x7f0000000280)="1c0000001a009b8a140000003b9b301f00"/28, 0x32)
recvmmsg(0xffffffffffffffff, &(0x7f0000002ec0), 0x4000000000009b8, 0x2, &(0x7f00000001c0)={0x77359400})
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20044000, 0x0, 0x0)

14:57:29 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe83", 0xeb, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:29 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585", 0x55}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:29 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:29 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000480)=[{&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3282.766131][ T6642] binder: 6640:6642 ioctl c0306201 0 returned -14
[ 3282.782491][ T6641] overlayfs: conflicting lowerdir path
14:57:29 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

[ 3283.018554][ T6641] overlayfs: workdir and upperdir must reside under the same mount
14:57:30 executing program 1:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
mkdir(&(0x7f00000009c0)='./file1\x00', 0x0)
syz_open_dev$dmmidi(0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400, 0xfff}, 0x100}, 0x0, 0x1, 0xffffffffffffffff, 0x0)
openat$qat_adf_ctl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
fstat(0xffffffffffffffff, 0x0)
setxattr$system_posix_acl(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [{}, {}], {}, [{}, {}, {0x8, 0x3}, {}, {}]}, 0x5c, 0x0)
mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000})
mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0)
connect$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e21, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0x7}}, 0x24)
sendmmsg(0xffffffffffffffff, &(0x7f0000003e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="5c76ca910ae2a325e460ac89b93400"], 0x3}}], 0x1, 0x0)
ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c)
r0 = socket$inet(0x2, 0x4000000805, 0x0)
dup3(r0, 0xffffffffffffffff, 0x0)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x8000, &(0x7f0000000140)={0xa, 0x45, 0x0, @mcast1}, 0x1c)
write(0xffffffffffffffff, &(0x7f0000000280)="1c0000001a009b8a140000003b9b301f00"/28, 0x32)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000340)="2fd8bcfc17cb0ed4f857f40ada6b5f8a4e3f54f3b9e0bdf18947691ec4d305e3558b5cb1308ea663524a6ac0c3f91b9018080e786a1e3f921fec9b24482752ebfb6007acc0713996df2c80c548768905884345f1198b1fe74d9de830ced8a9a1e972eda53b250f18e079b64a2b1e694873134a34b9e5", 0x76, 0x20044000, 0x0, 0x0)

14:57:30 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:30 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585", 0x55}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:30 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{0x0, 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3283.408214][   T26] audit: type=1326 audit(1586876250.352:524): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6674 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3283.529233][ T6680] overlayfs: workdir and upperdir must reside under the same mount
[ 3283.620081][ T6689] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3283.628284][ T6689] FAT-fs (loop3): Filesystem has been set read-only
[ 3283.635300][ T6689] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3283.649725][ T6693] binder: 6684:6693 ioctl c0306201 0 returned -14
[ 3283.675146][ T6680] overlayfs: workdir and upperdir must reside under the same mount
14:57:30 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:30 executing program 1:
socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
socket$can_bcm(0x1d, 0x2, 0x2)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = dup2(r1, r0)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400207)

14:57:30 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{0x0, 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:30 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:31 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:31 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:31 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

[ 3284.641649][   T26] audit: type=1326 audit(1586876251.592:525): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6730 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3284.760698][   T26] audit: type=1326 audit(1586876251.712:526): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6739 comm="syz-executor.1" exe="/root/syz-executor.1" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:32 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{0x0, 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:32 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:32 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:32 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:32 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:32 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3285.865605][ T6773] binder: 6769:6773 ioctl c0306201 0 returned -14
[ 3285.885075][ T6761] binder: 6759:6761 ioctl c0306201 0 returned -14
[ 3285.950344][   T26] audit: type=1326 audit(1586876252.903:527): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6767 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3286.406736][   T26] audit: type=1326 audit(1586876253.353:528): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6781 comm="syz-executor.1" exe="/root/syz-executor.1" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:33 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:33 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700), 0x0, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:35 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:35 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:35 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x0, &(0x7f0000000180)=']vmnet1+\x00')

14:57:35 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0), 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3289.040459][   T26] audit: type=1326 audit(1586876255.993:529): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6813 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3289.094259][ T6819] binder: 6815:6819 ioctl c0306201 0 returned -14
[ 3289.410947][   T26] audit: type=1326 audit(1586876256.283:530): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6817 comm="syz-executor.1" exe="/root/syz-executor.1" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:36 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:36 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700), 0x0, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:36 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:36 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:36 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x0, &(0x7f0000000180)=']vmnet1+\x00')

14:57:36 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0), 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3290.205087][ T6865] binder: 6859:6865 ioctl c0306201 0 returned -14
[ 3290.226952][   T26] audit: type=1326 audit(1586876257.173:531): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6851 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3290.273306][   T26] audit: type=1326 audit(1586876257.223:532): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6860 comm="syz-executor.1" exe="/root/syz-executor.1" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:38 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700), 0x0, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

[ 3291.076355][ T6876] binder: 6864:6876 ioctl c0306201 0 returned -14
14:57:38 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140)}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:38 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x0, &(0x7f0000000180)=']vmnet1+\x00')

14:57:38 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:38 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

[ 3291.396525][ T6891] binder: 6890:6891 ioctl c0306201 0 returned -14
14:57:38 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0), 0x0, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:38 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, 0x0)

[ 3291.926303][   T26] audit: type=1326 audit(1586876258.873:533): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6903 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:39 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(0x0)
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r1 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000000100))

14:57:39 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(0x0)
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r1 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000000100))

14:57:39 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:39 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(0x0)
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r1 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000000100))

14:57:39 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:39 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
write(r3, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:39 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, 0x0)

14:57:39 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca", 0x76, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:39 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))

14:57:40 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3293.162416][   T26] audit: type=1326 audit(1586876260.113:534): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6956 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:40 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))

[ 3293.272403][ T6981] binder: 6977:6981 ioctl c0306201 0 returned -14
14:57:40 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aa", 0x94, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:40 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb", 0x56}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, 0x0)

14:57:40 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

[ 3293.870614][   T26] audit: type=1326 audit(1586876260.153:535): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6959 comm="syz-executor.1" exe="/root/syz-executor.1" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:41 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca", 0x76, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:41 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))

[ 3294.084640][ T6994] binder: 6991:6994 ioctl c0306201 0 returned -14
[ 3294.489439][   T26] audit: type=1326 audit(1586876261.433:536): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=6999 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:41 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, 0x0, 0x0)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:41 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca", 0x76, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:41 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:42 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, 0x0, 0x0)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:42 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e1", 0x92, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:42 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:42 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, 0x0, 0x0)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

14:57:42 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, 0x0, 0x0)
vmsplice(r1, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

[ 3295.512338][   T26] audit: type=1326 audit(1586876262.463:537): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=7049 comm="syz-executor.0" exe="/root/syz-executor.0" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:42 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bc", 0xb1, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3295.709407][ T7078] binder: 7057:7078 ioctl c0306201 0 returned -14
14:57:42 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r1, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))

[ 3296.165335][   T26] audit: type=1326 audit(1586876262.683:538): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=7056 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:43 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, 0x0, 0x0)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:43 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x70, 0x0, &(0x7f0000000700)=[@decrefs={0x40046307, 0x1}, @increfs_done, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000040)={@flat=@weak_binder={0x77622a85, 0x1, 0x3}, @fd={0x66642a85, 0x0, r3}, @flat=@weak_handle={0x77682a85, 0x102, 0x2}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}], 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:43 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:43 executing program 1:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e1", 0x92, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3296.946962][   T26] audit: type=1326 audit(1586876263.893:539): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=7099 comm="syz-executor.0" exe="/root/syz-executor.0" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3297.018546][   T26] audit: type=1326 audit(1586876263.963:540): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=7106 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3297.191001][ T7121] FAT-fs (loop0): error, invalid access to FAT (entry 0x00000500)
[ 3297.199311][ T7121] FAT-fs (loop0): Filesystem has been set read-only
[ 3297.207363][ T7121] FAT-fs (loop0): error, invalid access to FAT (entry 0x00000500)
14:57:44 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bc", 0xb1, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:44 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r1, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))

14:57:44 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff})
write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:44 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:44 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:44 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, 0x0, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

[ 3297.947472][   T26] audit: type=1326 audit(1586876264.893:541): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=7135 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3298.082867][ T7146] binder: 7136:7146 ioctl c0306201 0 returned -14
[ 3298.553092][   T26] audit: type=1326 audit(1586876265.504:542): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=7142 comm="syz-executor.1" exe="/root/syz-executor.1" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:45 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:45 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r1, &(0x7f0000000340), 0x41395527)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r2 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r2, 0x541c, &(0x7f0000000100))

[ 3298.807445][   T26] audit: type=1326 audit(1586876265.694:543): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=7141 comm="syz-executor.0" exe="/root/syz-executor.0" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:46 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bc", 0xb1, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:46 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, 0x0, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:46 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3299.376918][   T26] audit: type=1326 audit(1586876266.324:544): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=7173 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3301.259658][    C1] sched: RT throttling activated
14:57:48 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

[ 3301.528802][   T26] audit: type=1326 audit(1586876268.484:545): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=7199 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:48 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, 0x0, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:48 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, 0x0, 0x0, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

[ 3301.632591][ T7205] binder: 7192:7205 ioctl c0306201 0 returned -14
[ 3301.918761][   T26] audit: type=1326 audit(1586876268.804:546): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=7189 comm="syz-executor.0" exe="/root/syz-executor.0" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3302.291160][ T7209] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000500)
[ 3302.299124][ T7209] FAT-fs (loop3): Filesystem has been set read-only
14:57:49 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:49 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f92", 0xcf, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:49 executing program 0:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
getpid()
sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
write(r3, &(0x7f0000000340), 0x41395527)
vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:49 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3303.139887][   T26] audit: type=1326 audit(1586876270.094:547): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=7225 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3303.319414][   T26] audit: type=1326 audit(1586876270.154:548): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=7226 comm="syz-executor.1" exe="/root/syz-executor.1" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3303.365407][ T7249] binder: 7238:7249 ioctl c0306201 0 returned -14
14:57:50 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:50 executing program 4:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(&(0x7f0000000ac0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
write(r2, &(0x7f0000000340), 0x41395527)
vmsplice(r1, 0x0, 0x0, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7f)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000100))

[ 3304.126457][   T26] audit: type=1326 audit(1586876271.074:549): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=7253 comm="syz-executor.0" exe="/root/syz-executor.0" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
14:57:51 executing program 1:
syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0)
r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000040)='./bus\x00', 0x17e, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r2 = getpid()
sched_setattr(r2, 0x0, 0x0)
seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f0000000340), 0x41395527)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$binfmt_aout(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="000637800003555e5689d91b59672a8a298a7d"], 0x13)
unlink(&(0x7f0000001e00)='./bus\x00')
sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe)
creat(&(0x7f0000000280)='./file0\x00', 0x0)

14:57:51 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840010000000000000000000000000000000000000010000000000000000000000060000000000000001800000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00'], @ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0})
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x0, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, 0x0, &(0x7f0000cab000))
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1c", 0xf6}, {0x0}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e", 0xbb}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8", 0x1f}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0xf8, 0x0, &(0x7f0000000780)="a61554544d3ae6e657c6f609b7ae7c6263ec34c4c2a0ffd2ab98cb58b519d92b33fd278fddf37476d14657c53d62b4b630ff5b5cfc0ec06924b226546fe468de927171278a7b9f01aa786144ed972c50707d57471188a12a789435f841866e41853ddc3f0de3d5a7f973db7b94051cb64adf06a2401ae3a75bfb2fe2cf2240b46209671bd99d107cc4f9fb8df8974c8b76cf24e1c77531a43f17b57a94db6a14bbc1a799cbce71b12a226e53c8c4496b479c151465fa2d79cbf29372faf838a7a0fc5745d803b430f761b9939d26c73517eed137cdeb4ac3511204e198f13f50213edbdf189fc228559810106d9e13311bbd1184fa72051e"})
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f922000542387bc1e9553835c3d6a9da559c4bb1817920c7e17d4c0fe8335", 0xec, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

14:57:51 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x43, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="126348400100000000000000000000000000000000000000100000000000000000000000600000000000000018000000000000", @ANYPTR64, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00'], @ANYBLOB], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$binderN(0x0, 0x0, 0x802)
socket$rds(0x15, 0x5, 0x0)
r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000006c0), 0xc)
r3 = socket$inet6(0xa, 0x800000000000002, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c)
setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8)
connect$inet6(r3, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc)
setsockopt$CAN_RAW_RECV_OWN_MSGS(0xffffffffffffffff, 0x65, 0x4, &(0x7f0000000880), 0x4)
sendmmsg(r3, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000011c0)}, {0x0}, {0x0}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bb", 0x20}], 0x4, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
dup2(0xffffffffffffffff, r2)
syz_mount_image$ceph(0x0, &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000480)=[{&(0x7f00000002c0)="9f5024e28a8a5255779fcf066fe759fb164da6673a06cfb06f0f356b4ef2b247d311ef55972bd73436867bf931de16b2864a0873e55e91fc18debbb875465b7a68dd00e59ff4813acefc77b77d680d60552254a41994c2ff309006a286896c13f9681e06c36f1ceff8456e445857e3231bc74759efca90904b6f667229e547c95cce0cca15703937865ff82f1b9b58c6c01123e9025bd8b85edde9fce2062b19a9dda52c7dc4634e4c37bad1046682a6bcf44d8cdd1f28296c68e5e699e173185f533b1e8c34cc92f11a4ae1a99f92", 0xcf, 0xdb}, {&(0x7f0000000140), 0x0, 0x9}, {&(0x7f00000003c0)="928a02dc1d49cc509bf27bf0005689c65aab2f7e6ccab49972b470cdd562357d7c140b92aa3b208c0f482ab7507c1ac81c23b835d4ba59ce7106fd64ed1a614d90dad0da4235b15ee78eabc398832a990796b631606ec367bf3a184a24eeed737f85078f29f13aa0459c945964b7b4505c9434051544ba9d7dbb9053e8862ecfbcc9d9df3a1f2c25a49fd38d94a56da9a8e141aad2a0", 0x96, 0x5795}], 0x800, &(0x7f0000000180)=']vmnet1+\x00')

[ 3304.670478][   T26] audit: type=1326 audit(1586876271.614:550): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=7276 comm="syz-executor.3" exe="/root/syz-executor.3" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3304.735256][   T26] audit: type=1326 audit(1586876271.684:551): auid=0 uid=0 gid=0 ses=4 subj==unconfined pid=7277 comm="syz-executor.1" exe="/root/syz-executor.1" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45f6ca code=0x0
[ 3410.380166][    C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
[ 3410.387190][    C0] 	(detected by 0, t=10502 jiffies, g=584277, q=108)
[ 3410.393995][    C0] rcu: All QSes seen, last rcu_preempt kthread activity 10503 (4295278194-4295267691), jiffies_till_next_fqs=1, root ->qsmask 0x0
[ 3410.407359][    C0] syz-executor.1  R  running task    26832  7297   7171 0x00004000
[ 3410.415391][    C0] Call Trace:
[ 3410.418675][    C0]  <IRQ>
[ 3410.421561][    C0]  sched_show_task.cold+0x2e2/0x343
[ 3410.426810][    C0]  ? can_nice.part.0+0x10/0x10
[ 3410.431795][    C0]  ? rcu_read_lock_sched_held+0x9c/0xd0
[ 3410.437357][    C0]  ? _find_next_bit.constprop.0+0x1a3/0x200
[ 3410.443267][    C0]  rcu_sched_clock_irq.cold+0xb9b/0xd00
[ 3410.448853][    C0]  update_process_times+0x25/0x60
[ 3410.454234][    C0]  tick_sched_handle+0x9b/0x180
[ 3410.459089][    C0]  tick_sched_timer+0x4e/0x140
[ 3410.463865][    C0]  __hrtimer_run_queues+0x5ca/0xed0
[ 3410.469191][    C0]  ? tick_sched_do_timer+0x1a0/0x1a0
[ 3410.474483][    C0]  ? do_raw_spin_lock+0x129/0x2e0
[ 3410.479524][    C0]  ? hrtimer_init+0x320/0x320
[ 3410.484207][    C0]  ? ktime_get_update_offsets_now+0x2d6/0x450
[ 3410.490285][    C0]  hrtimer_interrupt+0x312/0x770
[ 3410.495245][    C0]  smp_apic_timer_interrupt+0x15b/0x600
[ 3410.501500][    C0]  apic_timer_interrupt+0xf/0x20
[ 3410.506439][    C0]  </IRQ>
[ 3410.509402][    C0] RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x4/0x20
[ 3410.516171][    C0] Code: 84 00 00 00 00 00 48 8b 0c 24 0f b7 d6 0f b7 f7 bf 03 00 00 00 e9 cc fe ff ff 66 90 66 2e 0f 1f 84 00 00 00 00 00 48 8b 0c 24 <89> f2 89 fe bf 05 00 00 00 e9 ae fe ff ff 0f 1f 40 00 66 2e 0f 1f
[ 3410.535774][    C0] RSP: 0018:ffffc900169171c0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
[ 3410.544205][    C0] RAX: 0000000000000003 RBX: ffff8880502cde4c RCX: ffffffff82023bf6
[ 3410.552176][    C0] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 000000000000000f
[ 3410.560147][    C0] RBP: ffff8880502cde00 R08: ffff88809650c400 R09: ffffed1009d8be33
[ 3410.568130][    C0] R10: ffff88804ec5f197 R11: ffffed1009d8be32 R12: ffff88804ec5f164
[ 3410.576265][    C0] R13: 0000000000000009 R14: ffff88804ec5f378 R15: 0000000000000000
[ 3410.584274][    C0]  ? ext4_mark_iloc_dirty+0x1396/0x2db0
[ 3410.589833][    C0]  ext4_mark_iloc_dirty+0x1396/0x2db0
[ 3410.595264][    C0]  ? ext4_chunk_trans_blocks+0x30/0x30
[ 3410.600736][    C0]  ? __ext4_journal_get_write_access+0x6c/0xa0
[ 3410.606963][    C0]  ext4_mark_inode_dirty+0x225/0x900
[ 3410.612255][    C0]  ? ext4_expand_extra_isize+0x5a0/0x5a0
[ 3410.617915][    C0]  ? ___might_sleep+0x15a/0x2b0
[ 3410.622774][    C0]  ? ext4_journal_check_start+0x1ae/0x290
[ 3410.628514][    C0]  ? __ext4_journal_start_sb+0x14e/0x4d0
[ 3410.634147][    C0]  ? ext4_dirty_inode+0xbc/0x120
[ 3410.639089][    C0]  ext4_dirty_inode+0xe7/0x120
[ 3410.643948][    C0]  ? ext4_setattr+0x1f00/0x1f00
[ 3410.648806][    C0]  __mark_inode_dirty+0x65e/0x1350
[ 3410.653919][    C0]  ? unlock_page+0x175/0x2a0
[ 3410.658514][    C0]  generic_write_end+0x2f4/0x3d0
[ 3410.663464][    C0]  ext4_da_write_end+0x217/0xbd0
[ 3410.668421][    C0]  generic_perform_write+0x2c0/0x4e0
[ 3410.673726][    C0]  ? update_time+0xc0/0xc0
[ 3410.678148][    C0]  ? trace_event_raw_event_file_check_and_advance_wb_err+0x4a0/0x4a0
[ 3410.686226][    C0]  ext4_buffered_write_iter+0x1f7/0x450
[ 3410.691797][    C0]  ext4_file_write_iter+0x1ec/0x13f0
[ 3410.697179][    C0]  ? save_stack+0x1b/0x40
[ 3410.706562][    C0]  ? __kasan_kmalloc.constprop.0+0xbf/0xd0
[ 3410.712459][    C0]  ? __kmalloc+0x161/0x7a0
[ 3410.716892][    C0]  ? iter_file_splice_write+0x168/0xb00
[ 3410.722476][    C0]  ? direct_splice_actor+0x115/0x160
[ 3410.727766][    C0]  ? splice_direct_to_actor+0x38c/0x980
[ 3410.733310][    C0]  ? do_splice_direct+0x1b4/0x280
[ 3410.738334][    C0]  ? do_sendfile+0x555/0xc50
[ 3410.742923][    C0]  ? __x64_sys_sendfile64+0x149/0x210
[ 3410.748300][    C0]  ? do_syscall_64+0xf6/0x7d0
[ 3410.752980][    C0]  ? entry_SYSCALL_64_after_hwframe+0x49/0xb3
[ 3410.759052][    C0]  ? ext4_buffered_write_iter+0x450/0x450
[ 3410.764780][    C0]  ? common_file_perm+0x2c6/0x920
[ 3410.769820][    C0]  do_iter_readv_writev+0x5a8/0x850
[ 3410.775038][    C0]  ? no_seek_end_llseek_size+0x60/0x60
[ 3410.780541][    C0]  do_iter_write+0x18b/0x600
[ 3410.785135][    C0]  ? __kmalloc+0x62f/0x7a0
[ 3410.789554][    C0]  ? iter_file_splice_write+0x168/0xb00
[ 3410.795108][    C0]  vfs_iter_write+0x70/0xa0
[ 3410.799618][    C0]  iter_file_splice_write+0x684/0xb00
[ 3410.806223][    C0]  ? page_cache_pipe_buf_release+0x280/0x280
[ 3410.812213][    C0]  ? security_file_permission+0x24d/0x470
[ 3410.817946][    C0]  ? page_cache_pipe_buf_release+0x280/0x280
[ 3410.823929][    C0]  direct_splice_actor+0x115/0x160
[ 3410.829046][    C0]  splice_direct_to_actor+0x38c/0x980
[ 3410.834427][    C0]  ? generic_pipe_buf_nosteal+0x10/0x10
[ 3410.839982][    C0]  ? do_splice_to+0x160/0x160
[ 3410.844692][    C0]  do_splice_direct+0x1b4/0x280
[ 3410.849569][    C0]  ? splice_direct_to_actor+0x980/0x980
[ 3410.855124][    C0]  ? preempt_count_add+0x74/0x140
[ 3410.860149][    C0]  ? __this_cpu_preempt_check+0x28/0x190
[ 3410.865800][    C0]  do_sendfile+0x555/0xc50
[ 3410.870229][    C0]  ? do_compat_pwritev64+0x1b0/0x1b0
[ 3410.875525][    C0]  ? __might_fault+0x190/0x1d0
[ 3410.880330][    C0]  __x64_sys_sendfile64+0x149/0x210
[ 3410.885535][    C0]  ? __ia32_sys_sendfile+0x220/0x220
[ 3410.890821][    C0]  ? __ia32_sys_clock_settime+0x260/0x260
[ 3410.896546][    C0]  ? trace_hardirqs_off_caller+0x55/0x230
[ 3410.902278][    C0]  do_syscall_64+0xf6/0x7d0
[ 3410.906805][    C0]  entry_SYSCALL_64_after_hwframe+0x49/0xb3
[ 3410.912705][    C0] RIP: 0033:0x45c889
[ 3410.916620][    C0] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3410.936342][    C0] RSP: 002b:00007f54002d4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 3410.944762][    C0] RAX: ffffffffffffffda RBX: 00007f54002d56d4 RCX: 000000000045c889
[ 3410.952736][    C0] RDX: 00000000200001c0 RSI: 0000000000000005 RDI: 0000000000000005
[ 3410.960709][    C0] RBP: 000000000076c180 R08: 0000000000000000 R09: 0000000000000000
[ 3410.968680][    C0] R10: 00008080fffffffe R11: 0000000000000246 R12: 00000000ffffffff
[ 3410.976652][    C0] R13: 00000000000008d6 R14: 00000000004cb7ee R15: 000000000076c18c
[ 3410.984659][    C0] rcu: rcu_preempt kthread starved for 10562 jiffies! g584277 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
[ 3410.995931][    C0] rcu: RCU grace-period kthread stack dump:
[ 3411.002802][    C0] rcu_preempt     R  running task    28848    10      2 0x80004000
[ 3411.010733][    C0] Call Trace:
[ 3411.014051][    C0]  ? __schedule+0x937/0x1ff0
[ 3411.018649][    C0]  ? __sched_text_start+0x8/0x8
[ 3411.023504][    C0]  ? _raw_spin_lock_irqsave+0x94/0xbf
[ 3411.028877][    C0]  ? debug_smp_processor_id+0x2f/0x185
[ 3411.034347][    C0]  schedule+0xd0/0x2a0
[ 3411.038422][    C0]  schedule_timeout+0x35c/0x850
[ 3411.043279][    C0]  ? find_held_lock+0x2d/0x110
[ 3411.048047][    C0]  ? usleep_range+0x160/0x160
[ 3411.052741][    C0]  ? rcu_gp_kthread+0x6fd/0x1960
[ 3411.057698][    C0]  ? _raw_spin_unlock_irqrestore+0x62/0xe0
[ 3411.063509][    C0]  ? __next_timer_interrupt+0x190/0x190
[ 3411.069081][    C0]  ? prepare_to_swait_exclusive+0x110/0x110
[ 3411.074996][    C0]  rcu_gp_kthread+0x9bf/0x1960
[ 3411.079774][    C0]  ? rcu_barrier+0x4b0/0x4b0
[ 3411.084369][    C0]  ? _raw_spin_unlock_irqrestore+0x62/0xe0
[ 3411.090185][    C0]  ? lockdep_hardirqs_on+0x463/0x620
[ 3411.095475][    C0]  ? __kthread_parkme+0x13f/0x1e0
[ 3411.100500][    C0]  ? rcu_barrier+0x4b0/0x4b0
[ 3411.105094][    C0]  kthread+0x388/0x470
[ 3411.109165][    C0]  ? kthread_mod_delayed_work+0x1a0/0x1a0
[ 3411.114896][    C0]  ret_from_fork+0x24/0x30