, 0x0) 02:00:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x6c00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 744.438786] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:02 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_GET_IRQCHIP(r0, 0xc208ae62, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:02 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000000a0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:02 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x2e, 0x2f) 02:00:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x7400}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 744.850861] binder: undelivered TRANSACTION_COMPLETE [ 744.856184] binder: undelivered TRANSACTION_ERROR: 29189 [ 744.868241] binder: undelivered TRANSACTION_ERROR: 29201 [ 744.931078] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:03 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000000e0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:03 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x2f, 0x2f) 02:00:03 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$KVM_SET_SIGNAL_MASK(r0, 0x4004ae8b, &(0x7f0000000100)={0x9b, "90f367c5bb8c7a15a5614a3548b0dd2d609577a85cac822ed9c74882901ec159ae87493fdb878422e7578e267db0d3b8b9f95e9c2abc0acaa551c3121714c90f3c0e58d3e08614edc0fc5c22884e881527da752b40af0f042e961ff384488dbd59861d8a1ed1995d20f4cf456546168c80ebd140066cdd7780666d74b79e38ab51d3aa4f4b8b4a86d08a467a651e90956f1ff8c78b84f3a6a8837e"}) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 744.976205] binder: BINDER_SET_CONTEXT_MGR already set [ 745.020243] binder: 5928:5930 ioctl 40046207 0 returned -16 [ 745.048433] binder: 5928:5930 got reply transaction with no transaction stack 02:00:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x7a00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080), 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 745.111297] binder: send failed reply for transaction 175 to 5928:5936 [ 745.146966] binder: 5928:5930 transaction failed 29201/-71, size 0-0 line 2801 02:00:03 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x30, 0x2f) 02:00:03 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000000f0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 745.215159] binder: undelivered TRANSACTION_COMPLETE [ 745.220320] binder: undelivered TRANSACTION_ERROR: 29189 02:00:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:03 executing program 4: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$SIOCX25SDTEFACILITIES(r0, 0x89eb, &(0x7f0000000100)={0x7fff, 0x401, 0x1, 0x6, 0x7, 0xa, 0xf, "0538100019a6d075ae9c39c1856194d55226cab1", "7515995ecdf16259fedac83dbfb76fd01f15cf86"}) ioctl$PPPOEIOCDFWD(r0, 0xb101, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r2, 0x800c6613, &(0x7f0000000140)={0x0, @aes128, 0x2, "7f5f46b8e978e247"}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) [ 745.256288] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:03 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x31, 0x2f) [ 745.304643] binder: 5943:5958 got reply transaction with no transaction stack [ 745.338829] binder: 5943:5958 transaction failed 29201/-71, size 0-0 line 2801 02:00:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x8100}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:03 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000100000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 745.440752] binder: BINDER_SET_CONTEXT_MGR already set 02:00:03 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:03 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x32, 0x2f) [ 745.497399] binder: 5962:5965 ioctl 40046207 0 returned -16 [ 745.522780] binder: 5962:5972 got reply transaction with no transaction stack [ 745.557644] binder: 5962:5972 transaction failed 29201/-71, size 0-0 line 2801 [ 745.578293] binder: release 5962:5972 transaction 180 out, still active [ 745.590299] binder: undelivered TRANSACTION_COMPLETE 02:00:03 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000003f0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 745.608709] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 745.801043] binder: BINDER_SET_CONTEXT_MGR already set [ 745.807012] binder: 5988:5991 ioctl 40046207 0 returned -16 [ 745.816009] binder: 5988:5991 got reply transaction with no transaction stack [ 745.829781] binder: 5988:5991 transaction failed 29201/-71, size 0-0 line 2801 [ 745.838813] binder: release 5988:5991 transaction 182 out, still active [ 745.852860] binder: undelivered TRANSACTION_COMPLETE 02:00:04 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:04 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xa907}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:04 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x33, 0x2f) 02:00:04 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000600000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, &(0x7f0000000480)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 746.048045] binder: release 5943:5952 transaction 178 out, still active [ 746.054932] binder: undelivered TRANSACTION_COMPLETE [ 746.063146] binder: send failed reply for transaction 178, target dead [ 746.120307] binder: send failed reply for transaction 180, target dead [ 746.129629] binder: send failed reply for transaction 182, target dead [ 746.156122] binder: 5997:6003 got reply transaction with no transaction stack 02:00:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xf000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:04 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000d7d0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:04 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 746.185814] binder: 5997:6003 transaction failed 29201/-71, size 0-0 line 2801 [ 746.205446] binder: release 5997:6003 transaction 185 out, still active [ 746.212219] binder: undelivered TRANSACTION_COMPLETE 02:00:04 executing program 4: r0 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x0, 0x2) ioctl$RTC_VL_CLR(r0, 0x7014) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') msync(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:04 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x34, 0x2f) 02:00:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, &(0x7f0000000480)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 746.273628] binder_release_work: 4 callbacks suppressed [ 746.273635] binder: undelivered TRANSACTION_ERROR: 29201 [ 746.295048] binder: send failed reply for transaction 185, target dead 02:00:04 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008ffffff9e0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:04 executing program 0 (fault-call:4 fault-nth:0): syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xfeff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 746.499801] binder: 6021:6029 got reply transaction with no transaction stack 02:00:04 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x35, 0x2f) 02:00:04 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) fchdir(r1) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100)="0811edffef384f54847ab152c2be886fe068e762da5e036c5b04dd326473c64cd67176c54b25df1c02d94ad8f87db1311d9ac602ed60ab5a10ee2a586780e5e158a919f59ec7ca31bb68c94b7fe3c5b8d88f606b1ff65355cb57b693f158c1429c9cde9c55698b9986535734f51751c7b0e927294ec7a8bb6171def3e404c8b6802f8c3e617223eda89840c8324cb5e88f16", 0x92) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0xda43) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000300)={@rand_addr, @multicast1, 0x0}, &(0x7f0000000340)=0xc) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000380)={@mcast1, 0x3f, r3}) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000000), r2, 0x0, 0x0, 0x1}}, 0x20) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x1) [ 746.569772] binder: 6021:6029 transaction failed 29201/-71, size 0-0 line 2801 [ 746.630460] binder: BINDER_SET_CONTEXT_MGR already set 02:00:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, &(0x7f0000000480)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xff0f}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 746.652160] binder: 6032:6038 ioctl 40046207 0 returned -16 [ 746.658969] binder: release 6021:6029 transaction 188 out, still active [ 746.674542] binder: undelivered TRANSACTION_COMPLETE 02:00:04 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000ec00000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 746.725350] binder: undelivered TRANSACTION_ERROR: 29201 [ 746.731437] FAULT_INJECTION: forcing a failure. [ 746.731437] name failslab, interval 1, probability 0, space 0, times 0 [ 746.750562] binder: send failed reply for transaction 188, target dead [ 746.770247] binder: 6045:6046 transaction failed 29189/-22, size 0-0 line 2896 [ 746.795760] CPU: 1 PID: 6042 Comm: syz-executor.0 Not tainted 5.0.0-rc7+ #85 [ 746.802981] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 746.812343] Call Trace: [ 746.814950] dump_stack+0x172/0x1f0 [ 746.818637] should_fail.cold+0xa/0x1b [ 746.822541] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 746.827660] ? lock_downgrade+0x810/0x810 [ 746.831833] ? ___might_sleep+0x163/0x280 [ 746.835995] __should_failslab+0x121/0x190 [ 746.840240] should_failslab+0x9/0x14 [ 746.844052] kmem_cache_alloc_trace+0x2d1/0x760 [ 746.848746] ? kasan_check_read+0x11/0x20 [ 746.852920] ? do_raw_spin_unlock+0x57/0x270 [ 746.857345] ? _raw_spin_unlock+0x2d/0x50 [ 746.861604] binder_get_thread+0x1db/0x7c0 [ 746.865865] binder_ioctl+0x1e2/0x1b79 [ 746.869765] ? kasan_check_read+0x11/0x20 [ 746.873928] ? binder_thread_write+0x2820/0x2820 [ 746.878717] ? mark_held_locks+0x100/0x100 [ 746.882961] ? debug_smp_processor_id+0x1c/0x20 [ 746.887644] ? __fget+0x340/0x540 [ 746.891109] ? ___might_sleep+0x163/0x280 [ 746.895274] ? __might_sleep+0x95/0x190 [ 746.899266] ? binder_thread_write+0x2820/0x2820 [ 746.904035] do_vfs_ioctl+0xd6e/0x1390 [ 746.908024] ? selinux_file_ioctl+0x46f/0x5e0 [ 746.912545] ? selinux_file_ioctl+0x125/0x5e0 [ 746.917069] ? ioctl_preallocate+0x210/0x210 [ 746.921490] ? selinux_file_mprotect+0x620/0x620 [ 746.926263] ? iterate_fd+0x360/0x360 [ 746.930090] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 746.935641] ? fput+0x128/0x1a0 [ 746.938935] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 746.944483] ? security_file_ioctl+0x93/0xc0 [ 746.948909] ksys_ioctl+0xab/0xd0 [ 746.952381] __x64_sys_ioctl+0x73/0xb0 [ 746.956288] do_syscall_64+0x103/0x610 [ 746.960188] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 746.965383] RIP: 0033:0x457e29 [ 746.968590] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 746.987497] RSP: 002b:00007f00150dbc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 746.995211] RAX: ffffffffffffffda RBX: 00007f00150dbc90 RCX: 0000000000457e29 [ 747.002487] RDX: 0000000020000140 RSI: 00000000c0306201 RDI: 0000000000000004 [ 747.009762] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 747.017037] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f00150dc6d4 02:00:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xfffe}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x34000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:05 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x36, 0x2f) 02:00:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x40000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:05 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x37, 0x2f) [ 747.024323] R13: 00000000004bf15a R14: 00000000004d0b00 R15: 0000000000000005 [ 747.048103] binder: undelivered TRANSACTION_ERROR: 29189 02:00:05 executing program 0 (fault-call:4 fault-nth:1): syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:05 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000400)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x7) r1 = add_key(&(0x7f0000000040)='.request_key_auth\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000140)="13a3758470842d", 0x7, 0xfffffffffffffffc) fallocate(r0, 0x2, 0x0, 0x80) keyctl$restrict_keyring(0x1d, r1, 0x0, &(0x7f0000000180)='net/raw6\x00') preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r0, 0xc008551b, &(0x7f0000000000)={0x7, 0x24, [0x3, 0xcc5a, 0x101, 0xdf1, 0x0, 0xcd8, 0x9, 0x8, 0x401]}) 02:00:05 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008fffffff00000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x24, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad77"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:05 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x38, 0x2f) 02:00:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x400300}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 747.209260] binder: 6032:6042 ioctl c0306201 20000140 returned -12 [ 747.298125] binder: 6077:6084 got reply transaction with no transaction stack 02:00:05 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800f0ffff0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:05 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x39, 0x2f) [ 747.343661] binder: 6077:6084 transaction failed 29201/-71, size 0-0 line 2801 [ 747.362231] binder: BINDER_SET_CONTEXT_MGR already set 02:00:05 executing program 4: r0 = fcntl$getown(0xffffffffffffff9c, 0x9) r1 = getegid() setgid(r1) r2 = syz_open_procfs(r0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x200009, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xf0ffff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x24, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad77"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 747.395391] binder: 6089:6090 ioctl 40046207 0 returned -16 [ 747.395718] binder: release 6077:6084 transaction 192 out, still active [ 747.428556] binder: undelivered TRANSACTION_COMPLETE [ 747.474491] binder: undelivered TRANSACTION_ERROR: 29201 [ 747.499982] binder: send failed reply for transaction 192, target dead 02:00:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x1000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:05 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 747.548384] binder: 6101:6104 got reply transaction with no transaction stack 02:00:05 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900087fffffff0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 747.589455] binder: 6101:6104 transaction failed 29201/-71, size 0-0 line 2801 02:00:05 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) sendmmsg$nfc_llcp(r0, &(0x7f0000002940)=[{&(0x7f0000000000)={0x27, 0x1, 0x2, 0x7, 0x1, 0x3f, "482cbb1e430ebdf52bbf5c651610d0884eb792e4bf4ad10fee9a5a2d4d3fe37c6b2bdce1eed9af80d9941acffaf77ef818e79199a642ed5fb8f3777c40bddb", 0x6}, 0x60, &(0x7f00000001c0)=[{&(0x7f0000000100)='(', 0x1}, {&(0x7f0000000140)="edb8b336b51cbb839ff96c5ce65b9c14a8c385f856cd1cd45e4fb89b029dc3fdccac5bca5f42ab2a40ed778ae3bf13f41010de1ecd5d21c0e5b2edf99de0657a1597ae7f51427047d213a26b68b922e577e5f0fb9e93baf93457c5632db31bb9a0bd", 0x62}], 0x2, 0x0, 0x0, 0x4040}, {&(0x7f00000002c0)={0x27, 0x1, 0x1, 0x1, 0xfffffffffffffff7, 0x2, "83ecc909e47dfc4e99d29defe47e6c61c516a385d1cd3c8e9b99ad4b6f8f7fea2473c8325db6497730055c40c26cf5a3cf6c865b65c210a65852f7bf4d6d17", 0x27}, 0x60, &(0x7f00000004c0)=[{&(0x7f0000000340)="0fb5791ac2809a2173c12c6d4283c030e0113af917176e9e1a082d1fee90cdc4db6fd15358b9a08a8453b69e613cffbd88bc93a43545784d3e94855699de61e8552c0bc52429a6809c8dafcabfd9bc3aa9978a833c6b71cb59a52b2db6845e6062f9c838f721b5602aafc1c4bd48b56da2ace5833e", 0x75}, {&(0x7f00000003c0)="83604b0e765cecb0b1ec9f7f79de1ba8a6a6d2874a94a2bf5295", 0x1a}, {&(0x7f0000000400)="61f56fe88433467bff5deaed7647f02dfd9639b0b470d6c4b3f5ca55a2732fa8533aa8d07fa8a7fcc1", 0x29}, {&(0x7f0000000600)="3fc8bcf9e91ea0ddc22fba49ad5a284c2ed8339efc1904077b32fcbd2868fa5b97b3cbcdd761b635d44d7d32b6cf9b9df176af412ed412c189c3dd38da78343872abe806de3b420566cb156cfb37fdedb40f8ad66f313d2c83443b364b38c3301c88221f0e34262a20ae224430299af8228ab53730cf1e1d439ce2597f7f0d7a7ee752009b5c881ec7e33ce87e9dacb9651aa5205277e56419f8dba7a1c896ea2a701e9e0c65694a51bd13bf4f2aa14dc2b2bcb07361723cd0b143249d432ea3c4db17571642b31bac8931716415a0e666095a0318d888058c016f9cf35828b8a96209f888b0ad0beb21f74447acb8b54db8f31a6eea0ec4937484cbd4c4d3e822ff95f08d0527a16d600e2212591b6bf2813903ccfdc10c467c51a0c1924b23eac2922cd354de68352e4db55de529d583f7e6d7243d96dc49d4a57d6e54c12294d4849f280facf385fbe25ab51e4bab7a3702678acb044ce9e4c76406ced4edd1327ceb9c86d5c3fe5081cad2e5e60e9fac070d4381fc5887d7f899743585dbbb8f7f59069d557a8205ac89b1d277cdc8ebfea2ce7e6a8991e1cc7f66f3ac62327fdc25ba74eba790863a5e67d1a8a8252488360daa7f727771aca48c1406111f160a7650fee5c6f26e1280235bccea3668115dd0648147a102230fd34c6bccf12c2e84a9997515b557c148592d02bf422d9f746a5409533719d87ba2a80eb27e85b014cfcf15be855831cd8042677fcea53e1e7fa78887ed7cd66b0fc20a080a72fb171e74a367dfcdc7e54380e5e0100febf322423d629b7baa4c1348d3a01c7325e36e5ded4b4d2098597238a96496c47cd7dad0df2c9c2df8a3c7a1bf8a743731ec862ba8c77ba42e74bf2f1a03c504d17804a18e50f5fb0da932cc407ec26b79df6ef9b6d1a60409ae690fd277526ad0ad2d185edf3d603d8701e60aea79b0f2ddde1184d054a74ec8b663e16172bd554c57f7a16eebcbbd85972a02c5304743966a33d4a02199b5dcce260c299bd44d3b456f1b2963d5c792ff31d54bd18969acba5882482bdeeba1ad7f06d0e7974c81fc8ffd8f0e90ff6210ef182d3061ccabd9d39e5b104ad828a644f5d1643b352376420be56fc97dcf11aee52b5be6fd556132c334111eee3b80afa97112657514f0a77a30694e69ba3e6b388e431a0874a3d04e288493bff1f8cbfe2059108d93ce7d2281bfd2eb6c1d4521cc642cb409dc01724d8caa4f0afce30db20cad3bfde94737ef43cd44ef070a5205c55731a4cde309c37f43b16a8e5ca1c375a9439d1c05d600a64b8177022a32674cd60af9bdda0ce4db1fbaf3a54c9185227c187ca9e35e6db51c0c55968b50b294eea8f2d22cbaa0bf6c958f6a7d39a27138548618678c5b77193329115302c7b81b2d53d89bea9e2f105e796477ff9d37d02c382b24e2142af75e51955ae1394fc3bc06f5e8368e1548ef6734b9973d51b897d956594615ccbdef643cad5614e76fb186225b09fe538249a02ade991b946c43cdb9e27a6537342ec187eb7c9b9d41ea1ead66bc2f872a96c3e8402a7bbbe28e72c8ac2385415d0f629a077d7ca609245d62e33ca8daf19f6caf84c5ef72a24a33b165895fc962165ecd07ec182407c559728caf17bc0bb28770eceb6314b14b53e70a46a53e2990c4b362fdbe379b8db2fb0a5023203ea5f3b0ac8fc92bc9ade4c99c06a911d3c3829565d705bc53689fa852aada12e390cb84b18e15b76567ad93617db09bcc15c85babfcfb0deb17c37fce39326081c89c39e4cb543289c85b6c367b27fe6d975f5f6f61784e29ad0a49aff536bc78bf15b476bb53f6a51013fd96562159d3ce8691367fc784944e010d2af967af8299bd8b49d6f1e934aaf7f63d856cd31b1449d200296ba5fd19fe263c2aa54422d5db418ebc6332e9c2e7aeabf5cac0868da7b2006d5adc878e6846670834d01a85b5a78fd9e2b7dc2d9aa06ec9ab7157c0b11b94b020d56ff7ab6675999a7eb89d960e7778fe7e991bb500ecbd186526c5f0f2a87b2e7d1c25ef243632ca38fe1b898fb18256cec52e5b2f1d8c10f50cabc239d178f3f5e0d38ae63cea925461dec066a318e4b2f75051e6df41eea757d297d6d7b7536de80934909c24fcf44c37a424fd6f71a4518833c855cfdf7de1f9cbc76c4b172b3d828635791b5647b9603dacf1f583f467a656eea71daa52c8ce56a005284f419e97e340b836158eef623904cbd8f0ffd91a666999867180e3acab108e108e0d16888293e0dbb47c329579c0d29e603bd13544220850549ca2736a3522c70c26efefb7cfe5390b13afedc1614a3dbe137361e4c28c7cd4f1bf7ec163fda4c15169624ff6a96d1c2dbbf8ea8fb4b0448d193db18de0dbd1cead7925828a12153f68b8c91bbd1c4543fce9ad311d2437110c8fed9b47bb74284861b5910d2d2960f323913f6bc6660195785a47fec0ea96401384ef709cb4f56ac0acc752bb3cec7851c3de96f7fdf95ade4384c13acb05b93cf13ed64263268410ea0721bba60d3103843e1979ef1d23d5a977563677e1d9224c233c222c2a0b3cf6a284f6b2d75d064ea998812f8de39452082f1be0b5a84c2b44bd69d2e2a4b7bee500c7e6db179d9a35a2cbe6f24980e68fdce34317d672f5b90e08da211492f5e8224aec8ae9dc7ff4173f0ccd5cb728e1f176beb13703ed4e260793dee2367ff8e011c25262756f0fbbf32c578a7c0a0a39ef8df6fb60598d7c1540384204caeab91f5541a61764edb8851ff3a488bab43eed45fe015067751188ddcbd1a49cad9e7800bfa075d654a37c8c8fadfd08446bf0e5058d8ec300081737bdc14794eff71e96598eeb79fa890b1a6c9300ce233f5139d6072d52af9baf5c24bf4bd1ec00f0b8e82aa8612771a17b62410ea09c8a788a6c3b8d33a2ca2a6ffbc9e50e7aef4a2b57b46309880dcf778e08cba299ba68a9aa28aeed2eea872886607b6a2abf8389c9bfdcdcc768ba5d1e1949dcbb54726b37644a65f0058149c8eb144753dbf40e81995ca76ed464509382513fe6dea63f543140ca2611c292d49bb3582d0a41b85d491a44a6843c9582401c3b4bd1d0119b6dc9de09952d741003368d981bc7fca47e7ef43969309273cdbbc59d891a5b2777eb3a6c3d0c22c1660fbedd7c4b1434edb91f4caf1c9b8db99305e6eb5d8b7320843763d1786e4c0d6f6106e92c414f68dc846c6d2545f2b5acd6489f3bacaf973f795ad55adac8e6b98359365491a28fd14910cce0f2590e6c7cef103702c5781843a8e3e6c9c3c3f6a0aecab3d87d8fcdcc9f68302b0474232d0d3bd9e06b6b39527924c1c4e14eb493f555f75421fbeb8d8325e8818265a3002b648b884206b01bb20acce0e22f0450fe77fb7f9d3ae9887f6af49f6c9e958b9e8952d5e7a3e67fe491018e5bcf79f4c3dd907d9c5a80e963a8414f7569eebb8849eaf660a9745e010f571e3a3aff013c12b7ac283908fe81d57c1fbd90eac56a7b5fdfd216743802414352a605c2a4e7e776a54403f6df52ab4ada7f798ff0b0543afc4b38db07465342fa7dc4398be5f8adb0ede89093f357fecff9c8177a9af576223db0c26a0082ae5d88f780979068f57d52c6fb2d31e0f44d7e51a16ec2467b5393f2f7465a98aaacc3fdab1a1b6810f6a23a4f6de7256f7577c1cc3b0b9eafb9650b53ced4b6a0eded4b0812242cd1336e57e533dc853f2e58e21dd8d2468ece5c4f4e9b2932820c40cd378f001c1d73b2ea67d88c54852e21f1d0a0da760167bb2a6e8b52a9d9f06852ad107be8b4a9894aad6e8cb3089097277212ae2c863aa54b47afd3ebd0c8b0f1d3187a0bd2b3b63d853cc6bc6c75388316bb56ae7eef11739ff803021f450bd2d73da05e89e0792fbde30d6791d7d5f744a9828d27cad784ce1df1143e1f7633d1bdfbf10c9846657c818c82e9c53b9aff845cb60a491db6c7992920cb0ed32f56af9662f21aa1bca4fbd33114212b43bc1d20aac41cf53d00686a3e02b6b48e0f7fea0d5bb0404c1243f6773337665703910578f384172772b23f6093bb82e622d22437e0ff224290c03bfafc92a29a2251b260d880cbaed03f09365f07141265760e27d8315d2e995e680a25dc1bad4a27a0381ee3eccb2e10bb721d48f118917e6a8e4f7ff789f70df483d5de658c80ba4b55c92014c29d27924e77e9de4cba6768a680a83690d9cbd5bb6c532e53f1ff7d069414ba66583846939c4fa53dd31432512e1c29fafc1e62f8a28ce3a15e76c6f33371845faea1740ff6eda74eeb0886120ac424586e31c53363b48865ee5906e5e86d41bbc37e90e3a123ff3b9b3b971462338226b5486ea640899ebdf4c02af541c53015f4a63d1684ba27eee7a30597500820eb1d5314b518822f447fbfd3250aa6e91c5358973871b1fb9fe2e889b228e16ca7ba65093d308c849a60bcc89b591dafe4ad9142ea57848a2232b3baa7dd2b47c7db021ffd84de58b68028bd8a7a6b235575f4f712b7e9dac6c7658fb02ec01d3b3815352be79409be549c1c1a47b58a4a57ccc39470c32a6d9fa4e61c883877faf67aacd27dd0ccfb248daef674ddf8842c02fd58c8ad2165e3f21b9b7a46fe213fe58ccbc1be4075ddae8b34b9ea4797864fc83ce90bdf91b1d95f7b9dbcbc31cd3b557d9f8d1419619a340c4db00f6c07411d96fb14a55c7d6965d8999eaac7f78a3afd59d9a615f6f1ea150374a7211eb94b8eeb4c5b76fa951fb4d6bbf4eef8010dcfee59b26c976a312c61278dee080f6752d48fb501017ab1dfbd500c659ddfdb80fdad4bfb243f9e94fc46983441e485d54c04bbdb4af71ebab5fbd953df80c2570b82c74640535d7ec3d269482f464022b4396c68356a35193bbbb736986b6b2b491d40dd58cddd833445e78fee7776c8e76a7b2b9079d4fd1969f81a0a93c6c027135e4cbf5204bf9d54e64839ffb10cd992e2317233b48627d20b91e3940c2234e45a6b8d832a397e66122c31fa57aa14b3d7d2f4483cdab3b1743ea57ad29e1a4e985f4bfc2e289bb27f5a586089cc677dd9ce81c941b5b58341e837ddfd89ea2968975bfb6ff9ed530503003e1ed74dfe167a2a294318322d6fa33f81b2ee1acfedb9ecc18952255b1aa2906d1104bc95a89d751d7c3cf08680fb20ce42cb065df4a45b075f994cff0cd0e42ec37ca4fce8e736bc5301c77e6c4e7cb08ac55eebc2b09c75ed607fe610cefa1d9746113371afea45eaae87e3be869b43fb59a5e37deb2808903fc024d70b8f30a3dddc45bd22c6e2800665a1eca2f5f7b5a6556c04dce759142e1ac94da5ab4d7d1e44b13691ff79f9e2eae51bc24a59fc36ea3248625a30bd2ff14b288085dba6c40b0faa22d11c3458f99ca24a4267263f3f1d712b6f1163848f3efccb0a680e436244bc38033219b76113ac75d40533069d3379fe5c30c0b692ad086deb3535c5360b8f4b8a7696e940eb7544e98d0adf968e74f429b55dfd0379c5f5f308bd9cf9f9609e924b3c260fe28ce8dde5eab091d1af0938a929caec00f2873d3d643edfacb9720dc1e0f938f7c7045b1e2c1c564a12ded920d257766e9f8b08c83e7612b962bc45bb29c31b73d409d008ed859fc3a0081a1b714bd615d1c7960296d0e85ae57f66d9e74d90cc8975eb6ab0a18a2840e26264767c4cfdd52e867acc01ab10484ed30613ca29f41d2d256ea489a10cf776e45df8bcb5532d4a088a7cb06f579b7dcd8f49f8eaa981c0ebf006f0e14cec03efae9f689ee12b90c2b8300da9ba4902a5430e7dee87", 0x1000}, {&(0x7f0000000440)="d1283556c1907b8a08f2b70b485ce67485110d988065ec3110b6e8899e3eec01f8586aa991771dcfb4b015505218a73f40371f926d60693d669011ae77b76a70c6a7d8ea9158ac9bc174d8d88e3ce54967b2512e6ba030d3795fdf4d2de829", 0x5f}], 0x5, &(0x7f0000001600)={0x1010, 0x10b, 0x20, "3dfbc74379f6791a6dc53d071c390484e512df0dbbb65845ff734e7ece0e4f1f36166477e10ca91b48611525975762d15610f295d9ce9c2dddfe4187c573334d9c9d6ea4aee7549e730f769eb6663efab94c52de11402aed6dc1e4c3c06793b039c3174bbdb4b6bd12bce2bbce0b7fa074dac98e04e42194ed43c3865dcf091dc2b510f18fcee3359f6eb2e570b4040a8b832088775f857aae97305bba7129463b2c0554ddef6de78d5290f583ebdc9c260aa63f71bbfb3fe1e2bf1cef3fa833b11fc4c7a8bc647954b34839040daab1f29d5a0e6580773c0499cf7aa0ea2050ab43c2d37f09091ca7ca5cdfb478d5ec850410ea7c6e4f85a769fc60932ff28c559ad45e9afffd5af893ce8b0467fbb9c281e4554d588c088f62eef3651a3c7d4adb05e8cb57b051a69d059abaf51d31ac1ef44961919e7bca519abf4f614462c4de4e2ffa17ad49e64f0c0267bfac2b15a1f88cd0ca3d9fb152e897700ddcac9a45541b1c8752e44f2a06a0ed848207844393203842547a5d1ad6fd2d1ae194723b70cc24d5cc7b7a6ca99d6dab5fd6a738a07ba131590b7681d1175bec0102dfb90a9b55790a96c2fc6a376f849a1d63695273f8669079de0336eeed40a12fca711331bb222b53da5eb04f66e82a52b5720ab5cd989eb06557a3f7d96cac8bdd835f123e73293185063e12891dd8a7aab2a293fbb460caad225464d16b841d486b7896fb8907cfeb949b0d177bb890cb419cccb704a98fd21563833b1ab74dd169c1258c6cebf968f89f548377c9b435b44bcc8fa34141a95339c70f93ceac6d91685cfcb3c0091bfb25131e2eae724bed4388f64980f58dfbbd89bd350ce926dde471834ae5ab65ee5a05d17592c2bf79520fd174cd52579ea8d5ae3ca3b81de9ba752ce25d9cdb723f6d558fec38a564d1499ac102a97abbf36f11a1f8fc7315dc4f62f6cfcc1bec1f877e99e6bb4e32971cdc80677757a7c02b9e0234d4e17bb40f28af24a235c1be05fa6ce1150a93001816dcb718969ee50d1e6f05ec07c6639a83b1ce3d1f183c13acde77370ffe0cd772c3edd7c9b662f983b26414d4af067f83689cee1d3e17d750ad08ab28efaaea52f7c9e9b2aab18a4dc0af69af8f0944891b7efe421b4e6791e5cbaaeb2c7826a503a9ef9337733f3fa3c774f7f787cad699c0e90c0632ed40e47f53b07e7ce4cb4b396873185cb84310ba030c1f4cdd88f4a378895c86c2f1b8efcf6b0a3231ca0f52740d53e1c01f0df2dc9dc5611e6781c674f05d3963cbcc6e4fd712331c07ca5d28ee75318ece9af2b016f394cc61480ae9f987be5b2ebdcc0e9d6ba2ad19a096801f048490955b468100a34eb3a42e64b6a15e48aeaf210ab917749bec527d2981bc0bbfeb1fdb0153517a5f24ede25831853f3b52b87e45ac24a84105cbdcbc44bef03098ffade057f11a9961517c5ab0d433eed17d1ed0c87e2723ffe613e27bf1532c0518f1ddd21d3c21660c7d4aa44862f91773771264dbba44d7dc27cbe456e61228d43d70a82e4b3fb69acf352ff6d24afc5d174b7126998b837f37646d0b606a0359c402c7be2914776ed21b24fc0f257334fca08645a9ec03e23283768dece0c1dca805c1392c2fbe9eb609bb6daca86437e9c22791e891f1c1a9c370c7292448f69978dce1406e2fcfc7d47923138950bd7c0c3d9e597b8b15e13e98e4b7117b913aa6f2eb82dd25f8fe4bfb6e79095505281d05fa53b31f287181bc554934f6eb52da28a2d2e9c8cfb01a05f4fc78157b0c13a6b823c4f9e6f08cd3ed78af4cf4b17bb8c201f7a4fc9ba9d831de78af32e6692f89893675e1b8f4b157955f8dd4b2f2b14433374cae0ab6173cb0592671f906e7651d543743c396e0422d70178778641a2b3f54c888aa64eafc93fabf064b7580a63a22b17a87a7fee558cbceaec22c20212d190eec1b2581ab2338bbb162702bb76913666f38bbcecead997234e36550154fed751e6030c691dc5471a6a852f1edb153d4c248a59cf3e0ece708ff5db91e19b2678a8192cf76f916652c75ec295a5d25397b092f48917fcccc607780195dea37047fb95ac7f56b790233800a12fd1db4a8354b73584f503a2963f805baca5c711aa1eee571198eadffc359a2b13ad5eef0932cd8097b268a46af6dbc2a9a4def2642f1d9865aacd3dd0ac0bf192464ae1144921bc9dcb56f0e0a786769d3d73cdaa4466f95109f430eaede6b0a26df1f89cad88c7223fb9c7802734d5762c542411a9bf51b207e7f2996cd2589c26d4420a545ee22da2d2cfa6de6a2679a409b732ed4387b32d42a48ed7e8baa47452d0022cf9616d5d72950ac8f348d67d8cf1fe4b9dc0331c8c40de94748410a5a26c99dea4487ada40428af1750803c2c68eda4f7779c6f3ddc4aff53718453aa9d329eeeef9e30e1fd70292f3dab526fd5930c962d2b57b7f300c801fec6c24aee19360330e8b3d52c56aa3942433f2cdc525e3e06e004f8b47112251f96a25c4e32c3655ead9a3ed6a3983c3583f1a905beb767a5fc1c047647c3bbab5a8316d805088089be3d6b276418b1b3aa9b0189a710908e8a43e60b7436277e62bc87f7654c2602c4df44962f6188070edd0fa8ef39e5dd816f9b1017841619057b27bf2831a76ee394cfcb74da1185e78aba1140bb4f1d1f0153dc5ee0d6162cf0d0b67c2c228690119161fffadf30cfde7e91dc0bd8e6d2c62efe9a4ab2769aabbb0f12e37b9a1f31a1e04c854e6174805f23ae7401d4411aa7630a742597f7bb5edde2754bf65df43a0c8a0c2c7393b16db88a4dc3709ac2689caed29a5af41465d644ccc865fcd9f12927e42e511315afc00d7a66cac1c40846d2fefd2a2ff492019e9b04dbf9c0f1dfbd7170df3eb055c3d8b45535d5a6b1a30319856590e017e380c7e7b0377ce9d1d6bf43d40945ba1a57bf62477e29b76d5be522c3b0c84fa9bff283e8deda7d0f6e6c3be149bf2da1995332971c528c435a89043a41e3cb003b1b12ee58a7fae2bf854140b3526b4d01190b2dc88f67add5359a2aaa4b39cb56d2d718f9d57061e7d7483fe9042dab5bc39bb8963055a00fde66ea56affe085cb4984b09cd62a7000d970ad95fedfc29aed896ba9eb0ca7619abd724e1c480c8f36324af6f46a1d0f1168c313756d20cb7adc629311f83f90998d7bbd8de6dda59e3da4572ebb8483d0627c1cce485bafda9cc96c49dfe136e2d705b6e3c795df7beee7765c930f6ea4e7e665c5c80a59612a04a379c3bdf10e3f432e84d8762c7a3f365b6a421cd325730b7ffb5aaf017f41207ee6fe99ad7bd0a975333d3505bef4afb54550d1895286602dda4a207fdf964edd68fee22948cd284a50d6065feb2df315b2830dc96be872cebe989b8a3c10e0b5d1d42a57b309bc3c92b705581a2c96a34b7ccc686e845c5abd5e0dbe661615be0e0e4970e55abfc70fc92f781c55f97dbc6840298e574c76657ed41419119baa5de792b16279d86001e152ed01cbc2b8a6925a5879f9261dff3053b17118225024ba482a608437d02edd3fe2e3e3ed8bb921e7ed93a67b53a69ba79b33fb6a073708602fbb4a1d27cdbf7683697c8fd38a5ea8461d0a1f1bb91ebed5ecc00081ec9d4a41b814639c53a3ff5f08c7095854427470b8476a69fa1d7d426373eb6cd5253f3678c4b441cd6fa77b87cf0ebf91897cec929d1204613414eb725b10f039a280b16c0575a95de423d0bd9f225deb64c609273cb82da69e615bb348786e2ff2c4961fb4f6843ce69519f53f98bf42ef402e95039e17de48330b8c921f222a213b2e84a990d145595d25fcf403cd8f04f51d3f09e6a2a1295e62918e2b2241f210d06d2265893679308542fe9c0b4879eff6d56dbf0f14d202e39fde54c93383f5a40b249de9baa49d713300b589564337bcae6f247aaad48969ae6d46e2e5ca2fce4c49017b342c56f11fe4984031a71939a068e01bf7905a541cd5267ae021b032f38f582b63b5adf50837b6f4fc099c5bba8b27d909846f6a3b7b6a1b4083d31dfe33f4e850d7c30b8007db1a1869b91fa8f4e1829a291f8208513b589f72b06fb3984405cbf71380ca59d16d83491125a9427b4b71684d94fac242ac219965d4387a6b4cf61cbadb9af993e2a04cc5ea091b24f1deebe8146b25be7fadec8ccc0f3e78d145134de2003c575482fbba8da4f4c76b2b65d92cbc3bc16ccc712e3dea57544778a779499094a3ddb55fbb7cc8efe11411d1f36ca633b46def62d192f091aa51b62a3a1d102681a0360fec5428577f5b47b863039758beb387afc41d176e263433da5ca5cf97eb035b35e3ae2598bf66fa08407002ab8ee627d4687bb378c8e1fd4a8d5c2fdf8ddd0d3a8a3a2c29ad475bb7772f0d3a87ebbf34240cdfe25b56a63977434e1907134d386176b479879b840862f706fa0f022278896469c62cbf4200ac790e9824b5a737c8dd69c2b40d247add0040dadbce0acd9ac94a0ceeceef60c7466c041a96fe961a2e1ba2d4555a736f1e5f86566907df734ebecd6cf25186577fd379e540092ac92f591132ea0559feb04d112c910703bd16932a9e255f5f3696cbee99acd1828a556a9274fad5da032c8208f2c3c079e5cb21cf642e0ab6ebf8ac3ee2f75d2f8166a69ea98899e925b6bf2f58abd1612e70fdc938c4a494ee5ff79b163db87cccf3270e00d75d923cfe23eaca3cf56c0650c09b11f5d02a9d836eaeb6d76007cb3de97277ddc3f03e1d3a8498b150f2de855eba1357ebf938aa2fb2b3de3ee6f0d27c045d062b3fa315b0950becdd6d06bdbfb5e4bbc7eaf982ebaf3a30a93bb239dd49d2144f9c54c94e250314d7677abc6cc1fe17b2c27fe53807dfc7c79729455461e5e8535edaf2c1c61f6b2ad1b41852108b253d2d8eff162a906ed2c0ff2c33905ff71b61085fc11ec274c2b98a7cb7ad270ee128eac90a1e8ebfda183966690e761f8d9ce431591e9abb463766b2cfc5df7b1780b59e1615eb93109663fee656b14309e2cb471e5abe90e3e9eb80a51f6ffe9bd7db25f30683dba78bfed365c524643a8dc1aa9bb907d2bed6aaa74a7b45897ed6dbcd82c7c87f8ca0d8df30b1bf33c7d39733c7230c964a31aabbdf93c42e07fe1d4e43cc24deb13d5706ecde056b105f0cdff2de664b8df3041830a23890d087d562bdaba85712c11b2c467f2ceec4085afc3e7a85620511b765a2962bcf6edcf884a8cbf2104f619196e61a0959df39e17d1fbff38f0beba40927bfc89c11caa2291bc8d96c938c486881d9bc1f2da02495e9252cc2d75c3558e2604fa1f7c7ea06e7f5c479bc8b96f44f6baa4b89be293ba3e5dc898d64e1737347dd557044e3404573a5895150557255942b39fe86af05147c8ef37293e512cc435912c95162aeb0f39ab7bbad0934a1e80975489a9818471f979aef549281fe03fa73b371149d993565d965393c1549bf661b6382035dd6759b98f9727c0aae94efb9fab3dc3372aa1a69c5db98415a791c6e173db4cc7d9c67f64fefae54c025a2ba000ebef46b191c1eb84ae62b16417986230d76094d77d89db32911ebb768650d09518bc99ae541e569d05fa0d81a73efcfacea2309418d53032de6f0510961f54307d4113fd39e22760cce100d84b5f3cbc4d052ce17a5b6c9aa3a082e769573fa172300352365d60e89860292b4749f4e5c81283beb0aabd12747f3b63d836d1df9a3513373bda410b6aa45e5592020b45b47a50654ded05b0568a792e0b958677d85c53fa4db51b461b028b32c4a7"}, 0x1010, 0x20040041}, {&(0x7f0000000540)={0x27, 0x0, 0x2, 0x2, 0x7, 0x4, "bfbeb193a8dac19102973c218ac2f5d7152616fd7e9acb60aea8e214afe43b16c4d60ba67b845e263a7d301781f824eb30419f489dd37c1a95abd72fbdaf56", 0x29}, 0x60, &(0x7f0000002880)=[{&(0x7f0000002640)="105f7653e9c0852ad66ac3ce0a09552eca78b9c17049c2f34ac488bedeceb3def3e103e806a24d3de666482444fd7d6efa61f1c157a150eb24615867ba1279dfe666ec877e4c680774b65697c5513517aca857ae7b5ff38a8be83e36c36d129f43dfb5a0d72ce2e0dcf875296ff76c3012702b99fc4bfd1f5ade541eb5674636defc1725ca36dfa814effe7088", 0x8d}, {&(0x7f0000002700)="a6c77a2bde9baa28902ce324c6dc8991981fd24e9084a692c8c1460a8b76f0788134f6cd6a49c2e336dc993dcf3d7f7e151bd31fc765e5190165329045b2e249602b59b3014703da5ca72a14b0f64cbee28e906ab4cf61e256a2fb052de0aaac76a9c576414c0b10814783d4e4c6f3280135c510431783be00c772e7a605ca17e7c9ee0d7baa6a6f78d2096e0bcd407fd07014167bf55e698510a6fb9a2a968da5734601e3ebef4f971106481034442e00bc4d766fba53b402bcc4893f1ba7505d6f421e199c08de8ec586ecb082eae36ccafff4b3766d7531cae53805669da7b71810e77f4631f277fb4da6a7b0", 0xee}, {&(0x7f0000002800)="f5978c65dd4cd56ab91b106cbb9328b13968b1c96ab8c6126b2f9fe2b9c48925032763c43fc4d670da20c8edd85f484242dde5c210c0096bfe9226a4c08928b35b7601380ea7187638e7def1498ee5cb0221837652de132597ebaa69a105dd961547a0cf03d2369e04ef", 0x6a}], 0x3, &(0x7f0000002a80)=ANY=[@ANYBLOB="60000000000000000201000009000006000000000000006703160a6dc5f602f1061252b9c88d4f0ca1b6663d766ab739b989c307b94590880cf6d3d003d63551a9a23478a99d0639728ce4e491d0806df76cd5ceba76239380554f2c40cb691000950521d4a7c6a4266b6aed48519391f505b013cc831858c02091a4241f05cb5cb6ef2db5c97037c321d623e59b798f1154e7fe32712d7c6802f5f017d171327cb2a3c2b7c950bfae11e4350077a227f767844c0bf19c02e128021d11f19c98def4ba55faf2032307736ba090aba41141263b7a2b63628228b543b955ca44c9b6f62973e3a53fb7d0d7552cdf854b003b2f40c5d53cefebf697cbcf8ab6d23a68984f872cbd38b51cd79a843ae7e65bf2fd3292258d2be86b2d28970b1dcb1a7858b223ea091f8e22220c0c05c2e5cb811e706a9dacb7f824aed51b08ca4a56cde15123ceafbb2950c480e398ea9a41068f819fe03ed5490e3eb152c09e5e36848026703c08659bdfefc8e0b523ee9d47eb03cebde302791c1b295f0830c6e85320c118d326a9806acb2dfc4d60f1ca36f8e8d1bcdb83071100f30354b277dbfb3d3b317066192f2cfb1ba4e7164bd3a72fbb38de"], 0x60, 0x2000c004}], 0x3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000002a00), 0x0, 0x0) 02:00:05 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x3a, 0x2f) [ 747.638579] binder: release 6101:6104 transaction 195 out, still active 02:00:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x24, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad77"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 747.702026] binder: undelivered TRANSACTION_ERROR: 29201 [ 747.713394] binder: send failed reply for transaction 195, target dead 02:00:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x2000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:05 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900089effffff0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:06 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x3b, 0x2f) [ 747.840230] binder: BINDER_SET_CONTEXT_MGR already set [ 747.847918] binder: 6122:6127 ioctl 40046207 0 returned -16 02:00:06 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x3000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 747.907232] binder: release 6113:6115 transaction 198 in, still active [ 747.915393] binder: 6122:6137 got reply transaction with no transaction stack [ 747.916902] binder: send failed reply for transaction 198 to 6122:6127 [ 747.922697] binder: 6122:6137 transaction failed 29201/-71, size 0-0 line 2801 02:00:06 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008f0ffffff0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:06 executing program 4: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f0000000040)='net/r\\w6\x00\xdfT\x93\xe0') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x24001fd) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 748.017598] binder_alloc: binder_alloc_mmap_handler: 6139 20001000-20004000 already mapped failed -16 [ 748.054552] binder: BINDER_SET_CONTEXT_MGR already set [ 748.085269] binder: 6139:6142 ioctl 40046207 0 returned -16 02:00:06 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:06 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x3c, 0x2f) 02:00:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x4000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:06 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000200000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 748.288430] binder: 6157:6162 ioctl 4b47 20000140 returned -22 [ 748.319714] validate_nla: 15 callbacks suppressed [ 748.319723] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 748.329026] binder_alloc: binder_alloc_mmap_handler: 6157 20001000-20004000 already mapped failed -16 [ 748.355727] binder: BINDER_SET_CONTEXT_MGR already set [ 748.362114] binder: 6157:6162 ioctl 40046207 0 returned -16 [ 748.368368] binder: 6157:6168 ioctl 4b47 20000140 returned -22 02:00:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x36, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:06 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') ioctl$DRM_IOCTL_GET_MAP(r0, 0xc0286404, &(0x7f0000000000)={0x0, 0xc5, 0x7, 0x60, &(0x7f0000ffd000/0x1000)=nil, 0xeb9}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x6) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) sendmsg(r1, &(0x7f0000000980)={&(0x7f0000000140)=@nfc_llcp={0x27, 0x1, 0x1, 0x4, 0x2, 0x5521, "682f7f5bef28b9e02cf4d32e46b8481f9910190a435cdde7ffaaf353f0cf68319325c8a199766028b301fda15c31626f37bd2f51104a4f6880160646298ef0", 0x39}, 0x80, &(0x7f0000000600)=[{&(0x7f00000002c0)="897cec72d4344fa96be9d417cd740f2061c69539e2e078f70a08cc6576f99a431998dd9a55a06e6fbc62818c5acd41f535c78438770ff12b3da24c4bb82f406d0a6e2d8cc764a16673f9fa625d35732760a1e06f19052f54cf69f826a70afe6c85357ad2279cafad3bd3f213413af2aad12d0d3ceb85dff76b5311fcf620caa179b4d456b01b", 0x86}, {&(0x7f00000001c0)="ddddcf58d92dc2a48756d4addd76a10931babe155b2a0656290486ad", 0x1c}, {&(0x7f0000000380)="898897ac1225f3813da8b7c8a0d1074abc73af466ac7568c177c68fea7a051e24b9a854f31eaa71547f4ef5e8b6fc91a7ae4383faa3dd9c9e0eb3cc28b44b49a36c8949dcb139f8efc3bdd8ea2c88867ea2a6cb43166b354bd3601616d52d203b3601fceb89c882500e40e1ddd2f84eab403a5e6f391cce981936ddfced536eb131866ff285f26cb6dcf47a90f5b066fc058a004d7705ce5f6cdd4a6e6ef16dba88c461e292dc61fc29d4eee8e3ba28944bf6ed12c4517cddcb75bd42dbc15451d11d87e544b93eba50f49f5051d2dadcc45050a117d1befe940ee2504a3dfdc04fe3b69", 0xe4}, {&(0x7f0000000480)="b483054109b750b9adae93447b78b1b018d0d9749ecb4c8f0800ab9fddd726ee624e962b120972ba7aae05beb5d3a17ec8dc55a93289091a394fac640d2c40bfecf0038fd737529781ea", 0x4a}, {&(0x7f0000000500)="329cc04c19f9d31d1a042836535561a9d06e8d734bc7b7e8bf25befe80901a1b3215cbc71f549fa63051a50c4e51df101d203645b8ec20bdb0d682525fa389d8afe4905b53469d573c763f9ef5f85f83cef23bc03c7162d61062faff8cad8ec627dc60236cc900aa19461936c0d0a2ef6c5886632b1f5bc47da60c0f6128bd12f426b34f9caf0f2323dee40d7218d63b463c6679", 0x94}], 0x5, &(0x7f0000000680)=[{0xc0, 0x115, 0x8001, "8482a99e96748dea0f4dd260d7537251b76e786534f6ce1d7e504af39827a55422b191086e59b72ca7a8f5a2b1ecd811bab0488ea4faa05f71f8d247e7d6927498c96953afb820f54ea01800f0c54b50f5e99295b86901858d61a85a2df6e238a1c4593ff227f5b45ec7cf426e5f5f64d36fcd80fa91a632680e147704fb75e39c4f4e65d3930a4886183c2c412597086fd61c3f77389b6180fe984ad773ad4ec221ebc85d02b9ceede4f3bac2"}, {0xd0, 0x101, 0x100, "822d380ac0a7bb1cac7933ed1ac5fd30c7214a59d9c76b5d5f4a57a372a2ae03602d85d45520ad43992d81c91750aac07081f675af7c4bb434aaccec53a8c8991018ffc9cd1325e70d0151bf13eb90c738b4e9a0ad9dbafb7ccc2cb9f99de34d43b052aad03438691e8b145f554bd277aac46f74205f4767f171a0204310e2fbeb157a21e7c8b9b4c81584754aba40be714a7726927bc13783e1bf6f70dd66ec3b53aa2a7d0bb53590e40e973997450584c8ca8f9178ab663d"}, {0x58, 0x11b, 0x8, "f31e782f3d480d99cd8a99a6de08ebeb9df25ec47ac86257d78d0db84d45cd0fcebfed735e1909a5499271ea0ee40bc48a97609d5151f8221af583a3ced779265782a313d12360"}, {0x30, 0x117, 0xfffffffffffffff8, "06e46461f313d9c47ec0e23c7c6ea58e8ab2fef087f418affc55"}, {0xd0, 0x116, 0x3, "ea32a099a20964f959a65a3fd89ffbd20108629246bd91709bcdbb09d362596fd762220dea1d74c67b117d0ec126c57d7646ff12d3a41ee59fbe02569764897a4f9106615a349f67d7639ad3aee3160195c3ff281d5514c251c05d4d424d26b854391afeda8ea7e998ef15212945ba2c7f55e3fdc7763a0eb3827ef05c6ca30949438d07b5c456cebc63b736cccd17cfeb3c6b47d97c4c3c46f433cc3032e086d7b2946eea0b9fb04fd3c13067f68ee41b1110f7825b596645bd"}], 0x2e8}, 0x1) getsockopt$inet6_opts(r0, 0x29, 0x3f, &(0x7f0000000040)=""/57, &(0x7f0000000100)=0x39) 02:00:06 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000400000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:06 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x3d, 0x2f) 02:00:06 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4b49, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x5000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 748.611555] binder_release_work: 1 callbacks suppressed [ 748.611561] binder: undelivered TRANSACTION_COMPLETE [ 748.622419] binder: undelivered TRANSACTION_ERROR: 29189 [ 748.655154] binder: undelivered TRANSACTION_ERROR: 29201 [ 748.704790] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 748.717454] binder: 6175:6183 ioctl 4b49 20000140 returned -22 [ 748.733035] binder: BINDER_SET_CONTEXT_MGR already set 02:00:06 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x3e, 0x2f) 02:00:06 executing program 4: r0 = getpgid(0xffffffffffffffff) r1 = syz_open_procfs(r0, &(0x7f0000000080)='ns\x00') write$P9_RLINK(r1, &(0x7f0000000000)={0x7, 0x47, 0x1}, 0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000040)={0x2, [0x0, 0x0]}, &(0x7f0000000100)=0xc) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r0, 0x400, &(0x7f0000000600)=""/4096) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000140)={r3, 0x5}, &(0x7f0000000180)=0x8) 02:00:06 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000800000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x6000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 748.746693] binder_alloc: binder_alloc_mmap_handler: 6175 20001000-20004000 already mapped failed -16 [ 748.768322] binder: 6181:6186 ioctl 40046207 0 returned -16 [ 748.791747] binder: BINDER_SET_CONTEXT_MGR already set [ 748.820432] binder_alloc: 6175: binder_alloc_buf, no vma [ 748.829469] binder: 6175:6183 ioctl 40046207 0 returned -16 [ 748.844316] binder: 6181:6192 transaction failed 29189/-3, size 0-0 line 3035 [ 748.855227] binder: 6175:6195 ioctl 4b49 20000140 returned -22 02:00:07 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x41, 0x2f) 02:00:07 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000a00000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 748.955331] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 748.964262] binder: 6181:6192 got reply transaction with no transaction stack [ 748.986167] binder: 6181:6192 transaction failed 29201/-71, size 0-0 line 2801 02:00:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x36, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:07 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:07 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x100000000000018e, 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xa2a, 0x189040) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x117, 0x9}}, 0x20) r4 = gettid() ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r4, 0xffff, &(0x7f0000000140)=""/11) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f00000002c0)={0x15, 0x110, 0xfa00, {r3, 0x5, 0x0, 0x0, 0x0, @ib={0x1b, 0x5, 0x4, {"2e6e138b1fd482354f4f77786725abc5"}, 0x3, 0x0, 0x10001}, @ib={0x1b, 0x93e9, 0x4, {"607e5f88c543ddc2fe9ebe3fb7ef2f4d"}, 0x63, 0x7, 0xff}}}, 0x118) ioctl$CAPI_REGISTER(r0, 0x400c4301, &(0x7f00000001c0)={0x820e, 0x2000000000004, 0xfffffffffffff3e4}) 02:00:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x7000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:07 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000e00000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:07 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x42, 0x2f) [ 749.511461] binder: undelivered TRANSACTION_ERROR: 29189 [ 749.526123] binder: undelivered TRANSACTION_ERROR: 29201 [ 749.594013] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 749.602272] binder: 6218:6227 ioctl 541b 20000140 returned -22 [ 749.628579] binder_alloc: binder_alloc_mmap_handler: 6218 20001000-20004000 already mapped failed -16 02:00:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x8000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:07 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x43, 0x2f) [ 749.652901] binder: BINDER_SET_CONTEXT_MGR already set [ 749.663646] binder: 6218:6231 ioctl 541b 20000140 returned -22 02:00:07 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/user\x00', 0x2, 0x0) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x7, 0x40100) r3 = getgid() r4 = geteuid() mount$9p_fd(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x1002824, &(0x7f00000002c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, 'net/raw6\x00'}}, {@privport='privport'}, {@cachetag={'cachetag', 0x3d, 'net/raw6\x00'}}, {@debug={'debug', 0x3d, 0x1}}, {@uname={'uname', 0x3d, '/selinux/user\x00'}}, {@dfltgid={'dfltgid', 0x3d, r3}}, {@access_user='access=user'}, {@debug={'debug', 0x3d, 0xfffffffffffffffe}}], [{@fsname={'fsname', 0x3d, 'net/raw6\x00'}}, {@fowner_gt={'fowner>', r4}}, {@hash='hash'}]}}) [ 749.700382] binder: 6219:6232 ioctl 40046207 0 returned -16 [ 749.700790] binder: BINDER_SET_CONTEXT_MGR already set 02:00:07 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000f00000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 749.792217] binder: 6219:6243 got reply transaction with no transaction stack [ 749.796161] binder: 6218:6227 ioctl 40046207 0 returned -16 [ 749.812630] binder: 6219:6235 transaction failed 29189/-22, size 0-0 line 2896 02:00:07 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x44, 0x2f) 02:00:08 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 749.851356] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 749.862359] binder: 6219:6243 transaction failed 29201/-71, size 0-0 line 2801 [ 749.969466] binder_alloc: binder_alloc_mmap_handler: 6252 20001000-20004000 already mapped failed -16 [ 749.989395] binder: BINDER_SET_CONTEXT_MGR already set [ 750.001514] binder: 6252:6253 ioctl 40046207 0 returned -16 02:00:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x36, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:08 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f00000000c0)=""/191, 0xbf}], 0x1, 0x0) 02:00:08 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008001000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xa000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:08 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:08 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x45, 0x2f) [ 750.428909] binder: undelivered TRANSACTION_ERROR: 29189 [ 750.506979] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 750.524094] binder: 6269:6270 got reply transaction with no transaction stack [ 750.546371] binder: BINDER_SET_CONTEXT_MGR already set 02:00:08 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x46, 0x2f) 02:00:08 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x2, 0x70bd2a, 0x25dfdbfc, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0x44000) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 750.562670] binder: 6269:6270 transaction failed 29201/-71, size 0-0 line 2801 [ 750.566133] binder: 6267:6273 ioctl 40046207 0 returned -16 [ 750.596423] binder: release 6269:6270 transaction 210 out, still active 02:00:08 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008006000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xc000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3f, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b26"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 750.621428] binder: undelivered TRANSACTION_COMPLETE [ 750.640024] binder_alloc: binder_alloc_mmap_handler: 6267 20001000-20004000 already mapped failed -16 [ 750.703038] binder: send failed reply for transaction 210, target dead 02:00:08 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 750.770884] binder: 6284:6291 got reply transaction with no transaction stack [ 750.791743] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 750.793149] binder: release 6284:6291 transaction 214 out, still active 02:00:08 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x47, 0x2f) 02:00:08 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800f000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 750.835856] binder: undelivered TRANSACTION_COMPLETE 02:00:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3f, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b26"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:09 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 750.871118] binder: send failed reply for transaction 214, target dead 02:00:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xe000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 750.958275] binder_alloc: binder_alloc_mmap_handler: 6296 20001000-20004000 already mapped failed -16 02:00:09 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x48, 0x2f) [ 751.016474] binder: BINDER_SET_CONTEXT_MGR already set [ 751.034626] binder: 6302:6309 ioctl 40046207 0 returned -16 [ 751.034630] binder: BINDER_SET_CONTEXT_MGR already set [ 751.034834] binder: 6296:6303 ioctl 40046207 0 returned -16 [ 751.054268] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:09 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000a000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:09 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xf000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 751.109618] binder: 6302:6315 got reply transaction with no transaction stack 02:00:09 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x7fff) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:09 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x49, 0x2f) 02:00:09 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008007d0d000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 751.260424] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 751.291511] binder_alloc: binder_alloc_mmap_handler: 6327 20001000-20004000 already mapped failed -16 02:00:09 executing program 4: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffff9c, 0x0, 0x13, &(0x7f0000000000)='selfsecurity^nodev\x00'}, 0x30) r1 = getpgid(0xffffffffffffffff) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) r2 = syz_open_procfs(r1, &(0x7f0000000180)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x8400200) r4 = msgget(0x0, 0x10) syz_open_dev$vcsa(&(0x7f0000000600)='/dev/vcsa#\x00', 0xffff, 0x3a400) connect$inet(r2, &(0x7f0000000580)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000002c0)={{{@in=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@initdev}}, &(0x7f0000000080)=0xe8) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000003c0)={{{@in=@multicast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@loopback}}, &(0x7f00000001c0)=0xe8) getgroups(0x5, &(0x7f00000004c0)=[0xffffffffffffffff, 0xee01, 0xee00, 0xffffffffffffffff, 0xee01]) msgctl$IPC_SET(r4, 0x1, &(0x7f0000000500)={{0x7, r5, r6, r7, r8, 0x80, 0xfffffffffffffff7}, 0x7, 0x3, 0x4, 0x3, 0x84d, 0x50, r1, r1}) preadv(r2, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$NBD_CLEAR_QUE(r2, 0xab05) 02:00:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x10000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 751.369983] binder: BINDER_SET_CONTEXT_MGR already set [ 751.409924] binder: 6327:6331 ioctl 40046207 0 returned -16 [ 751.489867] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x3f, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b26"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:09 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x4a, 0x2f) 02:00:09 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:09 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000e000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x20000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:09 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000040)=0x7ff, 0x4) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000000)=0xb9) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 751.805171] binder_release_work: 3 callbacks suppressed [ 751.805176] binder: undelivered TRANSACTION_ERROR: 29189 [ 751.847344] binder: undelivered TRANSACTION_ERROR: 29201 [ 751.871229] binder_alloc: binder_alloc_mmap_handler: 6356 20001000-20004000 already mapped failed -16 [ 751.905236] binder: BINDER_SET_CONTEXT_MGR already set 02:00:10 executing program 4: r0 = getpgid(0x0) r1 = syz_open_procfs(r0, &(0x7f00000001c0)='attr/keycrea3\xd1\xc5\xf0\xef,te\x00') socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x40000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:10 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x4b, 0x2f) 02:00:10 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800c00e000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 751.937548] binder: 6356:6361 ioctl 40046207 0 returned -16 [ 751.964556] binder: 6368:6370 got reply transaction with no transaction stack 02:00:10 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:10 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xfffffffffffffc4c}], 0x1, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) [ 752.052217] binder_transaction: 3 callbacks suppressed [ 752.052234] binder: 6368:6370 transaction failed 29201/-71, size 0-0 line 2801 [ 752.135974] binder: BINDER_SET_CONTEXT_MGR already set [ 752.145747] binder: 6382:6387 ioctl 40046207 0 returned -16 [ 752.167493] binder: release 6368:6370 transaction 222 out, still active 02:00:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x44, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:10 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000f000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x48000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 752.179939] binder_alloc: binder_alloc_mmap_handler: 6382 20001000-20004000 already mapped failed -16 [ 752.195400] binder: undelivered TRANSACTION_COMPLETE [ 752.213128] binder: undelivered TRANSACTION_ERROR: 29201 [ 752.224412] binder: send failed reply for transaction 222, target dead 02:00:10 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x4c, 0x2f) 02:00:10 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000600)={0x0, {{0xa, 0x4e24, 0xf810, @local, 0x2}}, 0x0, 0x5, [{{0xa, 0x4e23, 0x8001, @ipv4={[], [], @remote}, 0xb8c}}, {{0xa, 0x4e22, 0x4, @remote, 0xa6}}, {{0xa, 0x4e21, 0x9, @rand_addr="cc220a1a8f7ebe50aa46406cc8310495", 0x9d}}, {{0xa, 0x4e24, 0x3716, @remote, 0x8}}, {{0xa, 0x4e24, 0x0, @ipv4={[], [], @local}, 0x7fff}}]}, 0x310) 02:00:10 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:10 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800003f000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 752.338335] binder: 6400:6401 got reply transaction with no transaction stack [ 752.355951] binder: 6400:6401 transaction failed 29201/-71, size 0-0 line 2801 [ 752.411190] binder: release 6400:6401 transaction 226 out, still active [ 752.421693] binder: undelivered TRANSACTION_COMPLETE [ 752.442114] binder: BINDER_SET_CONTEXT_MGR already set 02:00:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x4c000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:10 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x4d, 0x2f) [ 752.471879] binder: 6408:6411 ioctl 40046207 0 returned -16 [ 752.494932] binder: BINDER_SET_CONTEXT_MGR already set [ 752.503220] binder: 6408:6414 ioctl 40046207 20000140 returned -16 02:00:10 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$NBD_SET_SOCK(r2, 0xab00, r2) ioctl$NBD_SET_SOCK(r0, 0xab00, r2) 02:00:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x44, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:10 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000060000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 752.551241] binder: undelivered TRANSACTION_ERROR: 29201 [ 752.559262] binder: send failed reply for transaction 226, target dead [ 752.569012] binder: BINDER_SET_CONTEXT_MGR already set [ 752.586281] binder: 6408:6414 ioctl 40046207 20000140 returned -16 02:00:10 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000d7d000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:10 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x60000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:10 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x4e, 0x2f) [ 752.704576] binder: 6431:6432 got reply transaction with no transaction stack 02:00:10 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$KVM_ASSIGN_PCI_DEVICE(r0, 0x8040ae69, &(0x7f0000000040)={0x8, 0x2c68, 0x3, 0x5, 0x40}) [ 752.780115] binder: 6431:6432 transaction failed 29201/-71, size 0-0 line 2801 [ 752.825536] binder: release 6431:6432 transaction 230 out, still active [ 752.835701] binder: undelivered TRANSACTION_COMPLETE 02:00:10 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000ec0000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x44, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 752.872028] binder: BINDER_SET_CONTEXT_MGR already set 02:00:11 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x65580000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 752.919499] binder: undelivered TRANSACTION_ERROR: 29201 [ 752.925614] binder: send failed reply for transaction 230, target dead [ 752.934715] binder: 6446:6447 ioctl 40046207 0 returned -16 02:00:11 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x4f, 0x2f) 02:00:11 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000f0000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x68000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 753.014697] binder: 6458:6461 got reply transaction with no transaction stack [ 753.047957] binder: 6458:6461 transaction failed 29201/-71, size 0-0 line 2801 02:00:11 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 753.092400] binder: release 6458:6461 transaction 234 out, still active [ 753.107487] binder: undelivered TRANSACTION_COMPLETE 02:00:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x46, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 753.187297] binder: BINDER_SET_CONTEXT_MGR already set [ 753.192630] binder: 6475:6476 ioctl 40046207 0 returned -16 [ 753.192635] binder: undelivered TRANSACTION_ERROR: 29201 [ 753.192666] binder: send failed reply for transaction 234, target dead 02:00:11 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000040030000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:11 executing program 4: r0 = gettid() socket$l2tp(0x18, 0x1, 0x1) r1 = syz_open_procfs(r0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x1000000000000002, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000100)="d6dded1150b788642829dfe6a9e146f8b50ec0f2a0b8d38f297775b807eb95d1807d56ab31af976199050c4f73a9419baedef944bc2841acab68c07d1cce936307df850f4d16f5a9e509d65af215b42084c6e2ec3c93ac831d4a458edb31ad5617983595cc55ec41612aaac7fced88244946618370dc5d7b1dc59cc369bb01653730f214f3865ad0cd70f849941c397c70fe4b30830d83b4c0fc0a6816ca8e86b0a7a2371d4f7d5256283dd74dafb3f69a74cccf7203ef419662513c17a9c1255fd54b66e68a62df915a9552f1beec1bd01c5d87dfa3f63162111a06e3158c35660a367d82eb1390", 0xe8) preadv(r1, &(0x7f0000000000), 0x0, 0x0) 02:00:11 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x50, 0x2f) [ 753.285769] binder: 6482:6484 got reply transaction with no transaction stack 02:00:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x6c000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 753.328655] binder_alloc_mmap_handler: 2 callbacks suppressed [ 753.328671] binder_alloc: binder_alloc_mmap_handler: 6475 20001000-20004000 already mapped failed -16 [ 753.335805] binder: 6482:6484 transaction failed 29201/-71, size 0-0 line 2801 02:00:11 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000003400000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:11 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r1, 0x891a, &(0x7f0000000040)={'sit0\x00', {0x2, 0x4e23, @rand_addr=0x72ca}}) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) getsockopt$nfc_llcp(r0, 0x118, 0x5, &(0x7f0000000000)=""/1, 0x1) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f00000002c0)={0xb0, r2, 0x908, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4a8}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1ff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffffffff}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'netdevsim0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x100}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x609}]}, 0xb0}, 0x1, 0x0, 0x0, 0x20004080}, 0x4000) [ 753.424795] validate_nla: 7 callbacks suppressed [ 753.424803] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 753.433736] binder: release 6482:6484 transaction 237 out, still active [ 753.444173] binder: undelivered TRANSACTION_COMPLETE 02:00:11 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:11 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x51, 0x2f) 02:00:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x46, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x74000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:11 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000380)={&(0x7f0000000000), 0xc, &(0x7f0000000340)={&(0x7f00000001c0)={0x178, r2, 0x0, 0x70bd25, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x23}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, [], 0x10}}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x4}}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DAEMON={0x6c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'caif0\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x5}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xbf}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x18}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x22, 0x1}}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x30, 0x8}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xadf}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x40}]}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x68a}]}]}, 0x178}, 0x1, 0x0, 0x0, 0x40}, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000100)=""/191, 0xfeff}], 0x1, 0xffffffffffffffff) [ 753.528617] binder: undelivered TRANSACTION_ERROR: 29201 [ 753.534175] binder: send failed reply for transaction 237, target dead 02:00:11 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800fffff00000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 753.631183] binder: 6512:6513 got reply transaction with no transaction stack [ 753.636091] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 753.649460] binder: BINDER_SET_CONTEXT_MGR already set 02:00:11 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x52, 0x2f) [ 753.683159] binder: 6511:6517 ioctl 40046207 0 returned -16 [ 753.699619] binder: 6512:6513 transaction failed 29201/-71, size 0-0 line 2801 [ 753.715420] binder: 6511:6526 ioctl 40086602 20000140 returned -22 [ 753.726436] binder: release 6512:6513 transaction 240 out, still active [ 753.737664] binder: undelivered TRANSACTION_COMPLETE 02:00:11 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$FS_IOC_ENABLE_VERITY(r1, 0x6685) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x46, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 753.764650] binder_alloc: binder_alloc_mmap_handler: 6511 20001000-20004000 already mapped failed -16 [ 753.785916] binder: BINDER_SET_CONTEXT_MGR already set [ 753.809152] binder: undelivered TRANSACTION_ERROR: 29201 02:00:11 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000100843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 753.814824] binder: send failed reply for transaction 240, target dead [ 753.822108] binder: 6511:6517 ioctl 40046207 0 returned -16 02:00:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x7a000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 753.857324] binder: 6511:6536 ioctl 40086602 20000140 returned -22 02:00:12 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x53, 0x2f) [ 753.910162] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 753.922549] binder: 6540:6542 got reply transaction with no transaction stack 02:00:12 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40087602, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:12 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 753.985426] binder: 6540:6542 transaction failed 29201/-71, size 0-0 line 2801 02:00:12 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000200843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 754.046265] binder: release 6540:6542 transaction 243 out, still active [ 754.053048] binder: undelivered TRANSACTION_COMPLETE 02:00:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x81000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x47, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d18"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 754.102370] binder: BINDER_SET_CONTEXT_MGR already set [ 754.130285] binder: undelivered TRANSACTION_ERROR: 29201 [ 754.137192] binder: send failed reply for transaction 243, target dead [ 754.145969] binder: 6552:6555 ioctl 40046207 0 returned -16 02:00:12 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x54, 0x2f) [ 754.176110] binder: 6552:6561 ioctl 40087602 20000140 returned -22 02:00:12 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = getpgid(0xffffffffffffffff) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x10, &(0x7f0000000000)={0x8}) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0x49f}], 0x1, 0x0) 02:00:12 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000400843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 754.227273] binder_alloc: binder_alloc_mmap_handler: 6552 20001000-20004000 already mapped failed -16 [ 754.242478] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 754.288130] binder: 6565:6566 got reply transaction with no transaction stack 02:00:12 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000800843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 754.339528] binder: 6565:6566 transaction failed 29201/-71, size 0-0 line 2801 02:00:12 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x55, 0x2f) 02:00:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x88a8ffff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 754.384877] binder: release 6565:6566 transaction 246 out, still active [ 754.396765] binder: undelivered TRANSACTION_COMPLETE 02:00:12 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:12 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_mreq(r0, 0x0, 0x24, &(0x7f0000000040)={@multicast2, @local}, &(0x7f00000000c0)=0x8) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000140)=0x8000) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@remote, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@initdev}}, &(0x7f0000000000)=0xe8) r3 = getgid() write$FUSE_CREATE_OPEN(r0, &(0x7f00000003c0)={0xa0, 0x0, 0x6, {{0x5, 0x2, 0x8001, 0xf800000000000000, 0x4, 0x9, {0x6, 0xfffffffffffffffd, 0x7, 0x80000000, 0x80000000, 0x2, 0x3, 0x7, 0x1, 0xf57d, 0xff, r2, r3, 0x100000000, 0x4}}}}, 0xa0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 754.428278] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x47, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d18"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 754.513330] binder: undelivered TRANSACTION_ERROR: 29201 [ 754.525433] binder: send failed reply for transaction 246, target dead 02:00:12 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x56, 0x2f) [ 754.563817] binder_alloc: binder_alloc_mmap_handler: 6591 20001000-20004000 already mapped failed -16 02:00:12 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000a00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 754.608543] binder: BINDER_SET_CONTEXT_MGR already set 02:00:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x9effffff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:12 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000000)={0x0, 0x4}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000100)=@assoc_id=r2, &(0x7f0000000140)=0x4) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) connect$rxrpc(r0, &(0x7f0000000180)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e22, 0xfff, @mcast1, 0x8}}, 0x24) [ 754.632165] binder: 6591:6594 ioctl 40046207 0 returned -16 [ 754.649268] binder: BINDER_SET_CONTEXT_MGR already set [ 754.683262] binder: 6597:6600 ioctl 40046207 0 returned -16 [ 754.704895] binder: 6597:6610 transaction failed 29189/-22, size 0-0 line 2896 02:00:12 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000e00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:12 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x80086601, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 754.737950] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:12 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x57, 0x2f) [ 754.783625] binder: 6597:6610 got reply transaction with no transaction stack [ 754.798925] binder: 6597:6610 transaction failed 29201/-71, size 0-0 line 2801 02:00:12 executing program 4: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) sendmsg$nfc_llcp(r0, &(0x7f0000000040)={&(0x7f0000000100)={0x27, 0x0, 0x2, 0x5, 0x7, 0x9, "a56f88e523fc7b9eca623056648303e8af87214e63b556bd84c5dce87b1749a900000000000001ffa65ab69316b40fe3b347457d564e5d2ee153a0a19b8d6d", 0x4}, 0x60, &(0x7f0000000180)=[{&(0x7f0000000ac0)="d188c50a01f93add7f867b40d0135d80de4f9d9c3d06bdbb08be40dae66b568189dccdfd7e22a4c8bdac9828f4ed93a72c39caaf57c99ddf426371a638b81c9b858a674a8c1b0b3b8f2fc358606704f1ca8f1a8d0ba922066d3ce744d5cced641f84755291dadb57c1c6f8bf724977312a97b8f7c75e7524626868c14a1b2032ac507d140cd42cd0df6b86413413d2c4dc919035d8b8572220a9d8cb0914286bf40cb7919ddfa9907edee998f86a39e908838851230b", 0xb6}, {&(0x7f00000008c0)="e78452ffddf06d962bb97c53abb7308fa18da1e7cde733a05bd5361b9a864f3afcfd7e7786135d5ecc63103dff09d6754a3d3cd3a0148ef48485f425b972c6980198110cf2fd3d5e69f9b3f3a1c83ba95d69372f6ddccca8fdb1e8ab9a2e203cbf6cdd83f7b45338ac21e137d37b8c79cdfdecc5ba937a150b25b1499cbe7a5f22f72b1915d15a97f9a869d2f37e010d57b88ca9b28d135752785788f2018a4cc59aeba1a0ac030783951241351843f59610d6f907749cc81ac15f38a4eaa1a1d23589ce0915550f88a0cc0582fc8bc5e51ce7f3c23373369827b0e4377d56f3cb9d5081a2813926f0936c8bae949a18df9c9407f02e2c7960412525e1", 0xfd}, {&(0x7f00000009c0)="032425561c3898f22a8eb127295ea7b1dd6929881ef82d6081bc79488a635f65f41443d01c831cd7bc34aff046c03161aa80a19a5d5350e04127f0da681f435ca322ffd1e26f3894414acdbefcbe063f19bcbe9c208557b173ed699899115120cd5ae4d5facf0d230d81b4d15a22506fa075c39b08bc913bb4c36a8b6fd22c7b57d392126b14490e2bbf3495fde303f7b570555afb6872fc338715fb2909dd0041ca9c15d8695e9c1d5d7a50c2d08111c7056afefe218b53a520d318fff020013571f7424f88fe7995184082", 0xffffffd9}, {&(0x7f0000000600)="4e3afb297761b1428fda38f895a2613eef378b54a00f5db8fe9de2b4cbef720d86b723feb786934cc8407e9e15adb502d7ff247160f5554eb0eeb3d20000389dc0c5c3976ece4d6330ab22560f9c4dc0101a9eb445a951a47edd95c94d755b43caec354856a3e15fad68f20c684768e0db3a758ab5c2c9485c97d2c5d083f89d21453c1b690acc77bb1d936dd9e082bbeec36bbb9b8d8e1c826bf041154fcaa0f2ae6f41b2bd2e", 0xa7}, {&(0x7f00000006c0)="439c4f57a95c4c6d1eec4aae661a5d9ec5006a95454877b893a73327f908cd9320e4ee08c47c0590c77d475838c7dbf5e67bb7c364b33b6978fa09f1a4125c4d0608157ee30d407da58961b2515937758757a7948b6aedfe2236b1d5ca9e099e4662dd4157ccc94566153f48bc493c38430aeb14a46f96a7c335072d23b50b77f56ba6cd7abfd220a2c59e648a9acf5e53c0d32df1aa98e8d61d79d5911d69724eeb77eaa2da70f64e92a084245decd17827d80b2713a62c019276781d873ca68e7a01cbcb4f0f683cb7ebd8dc085040d47dbafce180c077ce7d7be4ef43a89ebcf7a6ac7ec5a1466a9237a2a3bfa24aceba963788349958", 0xf8}], 0x5, &(0x7f00000007c0)={0xf0, 0x111, 0x40, "062d9ca833e20f890b06cc0fb94a9dfe465b858f9f6889d8a1ec9ab86589a25f8e4a1761dee1ac0f0395c24f639dccafea3bc95f7e15c8148580964e4ef5d8fec71fdd02d76337ce52adb54040911e438d0efbe012c67ac107c1c19135a1c61fd8cac9d3dc5fc1454f813a9ac010a7bab87cc34d3e33f5f2a4b06143d80d718cbfd368f2452d774e8b87d78ba1c4c0f0dd40ef316cbfc44ef3e009df186d02d30ab281b3d1c7e491f1146c1fc6f452c6b33724c90dca3a4a174a3281a1a1d4301c251f5a5a6973d852063366f43d7e24a548cfdfea2b6ffeb980"}, 0xf0, 0x40001}, 0x80) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0xff) socket$vsock_dgram(0x28, 0x2, 0x0) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xa9070000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:13 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000f00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 754.863647] binder: 6620:6621 ioctl 80086601 20000140 returned -22 [ 754.910400] binder_alloc: binder_alloc_mmap_handler: 6620 20001000-20004000 already mapped failed -16 [ 754.920256] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:13 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x58, 0x2f) [ 754.972021] binder: BINDER_SET_CONTEXT_MGR already set [ 754.989399] binder: 6620:6629 ioctl 80086601 20000140 returned -22 [ 755.024525] binder: 6620:6621 ioctl 40046207 0 returned -16 02:00:13 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000001000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:13 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x60000000000000) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xf0ffffff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x47, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d18"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:13 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x59, 0x2f) 02:00:13 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x80087601, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 755.478967] binder: 6648:6649 ioctl 80087601 20000140 returned -22 [ 755.495486] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 755.499575] binder: BINDER_SET_CONTEXT_MGR already set [ 755.519896] binder_alloc: binder_alloc_mmap_handler: 6648 20001000-20004000 already mapped failed -16 02:00:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xfeff0000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:13 executing program 4: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f0000000100)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0x2}], 0x1, 0x0) 02:00:13 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x5a, 0x2f) 02:00:13 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000003f00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 755.551692] binder: 6655:6657 ioctl 40046207 0 returned -16 [ 755.551938] binder: BINDER_SET_CONTEXT_MGR already set [ 755.580007] binder_alloc: 6648: binder_alloc_buf, no vma [ 755.583824] binder: 6648:6664 ioctl 80087601 20000140 returned -22 [ 755.586654] binder: 6648:6649 ioctl 40046207 0 returned -16 [ 755.651401] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 755.660628] binder: 6655:6661 got reply transaction with no transaction stack 02:00:13 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x5b, 0x2f) 02:00:13 executing program 4: getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000003c0)={{{@in6=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@empty}}, &(0x7f00000004c0)=0xe8) syz_mount_image$vfat(&(0x7f0000000100)='vfat\x00', &(0x7f0000000140)='./file0\x00', 0x100000001, 0x2, &(0x7f00000001c0)=[{&(0x7f0000000180)="1eb05b377b815e0eb09b02eb7b2eb5226eaa", 0x12}, {&(0x7f00000002c0)="893b941a8b0127e433aa72a9f80458c719f4039c8fb3181c1a96a15602620504ed9b138047e8a89ab9ba35d9f77f5d84e2f2a4e3eb79e97ef79fc54fca83aabbb375df5aae0afe7976cbe158813a21bf48e6c8449c630c5bccb1dc15f9d2a96b568ef99a24f10ca126c84151bbecc41315bc657a971c7246980155b3f4587eac1b86713b63d6ed7c10fe0e252f3637e629760368955c61b9189be7cf85ed28ed3e9326bb7264d480aeafd377baf267bc291904cec9906ef426d20d2ead55aec834aa5f0ee1", 0xc5, 0x1}], 0x8, &(0x7f0000000780)=ANY=[@ANYBLOB='nnonumtail=1,shortname=lower,uni_xlate=0,shortname=win95,nfs,rodir,shortname=win95,shortname=winnt,utf8=1,iocharset=macinuit,dont_appraise,permit_directio,uid>', @ANYRESDEC=r0, @ANYBLOB="a2db0b88e9089156e0b02d1f2a1b71cbe680800558ed006adfe63a62e59284b7e5e8ba7a6e11fda9f52cc85d6e1276cd6e9895ac7810a7511e5e173f9401000d481bc1701a95c5fb7b95d7"]) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000700)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000006c0)={0xffffffffffffffff}, 0x13f, 0x1009}}, 0x20) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f0000000740)={0xb, 0x10, 0xfa00, {&(0x7f0000000600), r2, 0xd26}}, 0x18) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000040)={0xf000000, 0xffffffffffffff53, 0x5, [], &(0x7f0000000000)={0x9b0bfa, 0x2, [], @ptr=0xe7a}}) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) prctl$PR_SET_FPEMU(0xa, 0x2) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:13 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xff0f0000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:13 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000006000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 755.811329] FAT-fs (loop4): Unrecognized mount option "nnonumtail=1" or missing value [ 755.864241] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 755.892795] binder_alloc: binder_alloc_mmap_handler: 6691 20001000-20004000 already mapped failed -16 [ 755.924566] binder: BINDER_SET_CONTEXT_MGR already set [ 755.948007] binder: 6691:6692 ioctl 40046207 0 returned -16 02:00:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:14 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x5c, 0x2f) 02:00:14 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000000d7d00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:14 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xffffa888}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:14 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f0000000040), 0x1, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000000)=0x19, 0x4) socket$rxrpc(0x21, 0x2, 0x2) 02:00:14 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 756.335197] binder_alloc: binder_alloc_mmap_handler: 6704 20001000-20004000 already mapped failed -16 [ 756.365497] binder: BINDER_SET_CONTEXT_MGR already set 02:00:14 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f0000000000)='\x00', 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$RTC_VL_CLR(r0, 0x7014) 02:00:14 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800ffffff9e00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:14 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x5d, 0x2f) [ 756.385998] binder: 6704:6712 ioctl 40046207 0 returned -16 [ 756.392098] binder: BINDER_SET_CONTEXT_MGR already set [ 756.417493] binder: 6717:6718 ioctl 40046207 0 returned -16 02:00:14 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xfffff000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:14 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:14 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000000ec000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 756.585441] binder_alloc: binder_alloc_mmap_handler: 6735 20001000-20004000 already mapped failed -16 [ 756.607357] binder: BINDER_SET_CONTEXT_MGR already set [ 756.612666] binder: 6735:6736 ioctl 40046207 0 returned -16 02:00:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:15 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$isdn(0x22, 0x3, 0x37) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) open(&(0x7f00000001c0)='./file1\x00', 0x101200, 0x2c) fchdir(r1) open$dir(&(0x7f0000000000)='./file1\x00', 0x3ffe, 0x80) clock_gettime(0x0, &(0x7f0000000180)) getsockopt$inet_mreqsrc(r0, 0x0, 0x2d, &(0x7f00000002c0)={@loopback, @dev}, &(0x7f0000000300)=0xc) rt_sigtimedwait(&(0x7f0000000040)={0x81}, &(0x7f0000000100), &(0x7f0000000340)={0x0, 0x989680}, 0x8) ioctl$KVM_SMI(r0, 0xaeb7) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:15 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x5e, 0x2f) 02:00:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xffffff7f}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:15 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800fffffff000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:15 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 757.172779] binder_release_work: 4 callbacks suppressed [ 757.172785] binder: undelivered TRANSACTION_ERROR: 29189 [ 757.209030] binder_alloc: binder_alloc_mmap_handler: 6746 20001000-20004000 already mapped failed -16 02:00:15 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x5f, 0x2f) 02:00:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xffffff9e}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 757.271326] binder: BINDER_SET_CONTEXT_MGR already set 02:00:15 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000f0ffff00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 757.307171] binder: 6746:6749 ioctl 40046207 0 returned -16 [ 757.308319] binder: release 6758:6759 transaction 261 out, still active 02:00:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 757.337319] audit: type=1804 audit(1550973615.441:70): pid=6767 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir649998763/syzkaller.sFoAPO/1491/file1" dev="sda1" ino=17345 res=1 [ 757.381279] binder: undelivered TRANSACTION_COMPLETE 02:00:15 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:15 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x60, 0x2f) [ 757.411497] binder: release 6758:6759 transaction 261 in, still active 02:00:15 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') statx(r0, &(0x7f0000000100)='./file0\x00', 0x4100, 0xfff, &(0x7f00000002c0)) accept4$inet(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10, 0x800) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) stat(&(0x7f0000000140)='./file1\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0, 0x0}, &(0x7f0000000400)=0xc) write$FUSE_ATTR(r0, &(0x7f0000000440)={0x78, 0x0, 0x5, {0x1507, 0x400, 0x0, {0x3, 0x5, 0x6, 0xffffffffffffa3aa, 0x4, 0x939b, 0x200, 0x0, 0x4, 0x8, 0x8001, r3, r4, 0x5, 0x4}}}, 0x78) setsockopt$IP_VS_SO_SET_FLUSH(r2, 0x0, 0x485, 0x0, 0x0) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xfffffff0}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 757.465777] binder: send failed reply for transaction 261, target dead [ 757.499479] binder: release 6775:6778 transaction 263 out, still active [ 757.501999] binder: BINDER_SET_CONTEXT_MGR already set [ 757.523313] binder: 6779:6780 ioctl 40046207 0 returned -16 [ 757.529754] binder: undelivered TRANSACTION_COMPLETE 02:00:15 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008007fffffff00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 757.577398] binder: 6779 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 757.577412] binder: 6779:6786 ioctl c018620c 20000140 returned -22 02:00:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 02:00:15 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x61, 0x2f) [ 757.629031] binder: release 6775:6778 transaction 263 in, still active [ 757.652625] binder: send failed reply for transaction 263, target dead 02:00:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x4000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:15 executing program 4: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x100, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x6685) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 757.739611] binder: 6797:6799 ioctl c0306201 0 returned -14 02:00:15 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008009effffff00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:15 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x62, 0x2f) [ 757.792220] binder: BINDER_SET_CONTEXT_MGR already set [ 757.793124] binder: 6779 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 757.793136] binder: 6779:6786 ioctl c018620c 20000140 returned -22 02:00:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x40030000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 757.846606] binder: release 6797:6799 transaction 265 out, still active [ 757.875202] binder: 6779:6780 ioctl 40046207 0 returned -16 [ 757.881094] binder: undelivered TRANSACTION_COMPLETE [ 757.919319] binder: release 6797:6799 transaction 265 in, still active [ 757.936569] binder: send failed reply for transaction 265, target dead 02:00:16 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 02:00:16 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x4, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e24, 0xffffffff, @rand_addr="7adf1cab4313b95787d58887d6099243", 0x9}}, 0x200, 0x401}, &(0x7f0000000000)=0x90) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000380)={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x22}}, {0x307, @dev={[], 0xe}}, 0x4, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x11}}, 'bridge0\x00'}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000002c0)={r2, @in={{0x2, 0x4e22, @empty}}, 0x0, 0xa7}, &(0x7f0000000040)=0x90) 02:00:16 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800f0ffffff00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:16 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x63, 0x2f) [ 758.067163] binder: BINDER_SET_CONTEXT_MGR already set 02:00:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xf0ffffffffffff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 758.108886] binder: 6822:6823 ioctl 40046207 0 returned -16 [ 758.137716] binder: 6824:6828 ioctl c0306201 0 returned -14 02:00:16 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 758.170551] binder: release 6824:6828 transaction 268 out, still active [ 758.180973] binder: undelivered TRANSACTION_COMPLETE 02:00:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 02:00:16 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000002000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:16 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x64, 0x2f) [ 758.242565] binder: release 6824:6828 transaction 268 in, still active [ 758.259632] binder: send failed reply for transaction 268, target dead 02:00:16 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, &(0x7f0000000000)) 02:00:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x100000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:16 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306202, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:16 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000004000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:16 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x65, 0x2f) [ 758.425794] binder: 6848:6853 ioctl c0306201 0 returned -14 [ 758.445614] binder: release 6848:6853 transaction 271 out, still active [ 758.452393] binder: undelivered TRANSACTION_COMPLETE 02:00:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x200000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 758.570245] binder: BINDER_SET_CONTEXT_MGR already set 02:00:16 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) clone(0x204000, &(0x7f0000000100)="3e2c7952f6e6204b70b191d939ca953bc06d9fce06a0de1ed7addcd1fd031c1c6746908c558914b9e9a01f809105e239d47cb4c594186c6b778e240ea07daf3b52dfd231386331e602ef449197e9b7010ebabb8d2d25177b984f3ce8b04029c1eae89fef53aa179016a8a27bf5c8416ca0d6b38ff8f44823742d09170e13adefa217b615b4cb98e6c6f42da5d5f97f32cc3b34113a442ecd836aff6d66cac42fcf77685bea1afc202d", &(0x7f0000000000), &(0x7f0000000040), &(0x7f00000002c0)="326c1a36d0791fdfdc7770e9fec7dc83c2e6c365c111fc46b6088ff9e510ced07335f9801a379287de617c1be2d16484e7991eda35970f66541babf822529846594aa9e0ba9c71d63ae219617c676ce85eb64e31d0e2a2a2a8b91b46fffa") ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x10000000) [ 758.592296] validate_nla: 10 callbacks suppressed [ 758.592305] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 758.601869] binder: release 6848:6853 transaction 271 in, still active [ 758.611929] binder: 6860:6866 ioctl 40046207 0 returned -16 [ 758.626834] binder: send failed reply for transaction 271, target dead [ 758.634315] binder: 6860:6875 ioctl c0306202 20000140 returned -22 [ 758.654299] binder_alloc_mmap_handler: 3 callbacks suppressed [ 758.654313] binder_alloc: binder_alloc_mmap_handler: 6860 20001000-20004000 already mapped failed -16 02:00:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x300000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:16 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000008000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 758.702218] binder: undelivered TRANSACTION_COMPLETE 02:00:16 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x66, 0x2f) [ 758.734241] binder: BINDER_SET_CONTEXT_MGR already set 02:00:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 758.768292] binder: 6860:6866 ioctl 40046207 0 returned -16 [ 758.786830] binder: send failed reply for transaction 273, target dead 02:00:16 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000a000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 758.822474] binder: 6860:6889 ioctl c0306202 20000140 returned -22 [ 758.829450] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x400000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 758.914369] binder: undelivered TRANSACTION_COMPLETE [ 758.991783] binder: send failed reply for transaction 275, target dead [ 759.025625] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 02:00:17 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306203, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:17 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x67, 0x2f) 02:00:17 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000e000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:17 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x2a) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x500000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 759.151121] binder: undelivered TRANSACTION_COMPLETE 02:00:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, 0x0}) [ 759.199482] binder: send failed reply for transaction 277, target dead [ 759.236289] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:17 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x68, 0x2f) 02:00:17 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000f000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 759.250354] binder: 6918:6923 ioctl c0306203 20000140 returned -22 [ 759.267693] binder_alloc: binder_alloc_mmap_handler: 6918 20001000-20004000 already mapped failed -16 02:00:17 executing program 4: r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000040)=0x1c, 0x800) getsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000000100)=""/246, &(0x7f00000002c0)=0xf6) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x2000009) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000600)=""/4096) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r1, 0x7709, 0x0) [ 759.312882] binder: BINDER_SET_CONTEXT_MGR already set 02:00:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x600000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 759.352937] binder: 6928:6929 ioctl 40046207 0 returned -16 [ 759.353452] binder: 6918:6934 ioctl c0306203 20000140 returned -22 [ 759.359699] binder: BINDER_SET_CONTEXT_MGR already set 02:00:17 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000010000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 759.419248] binder_alloc: 6918: binder_alloc_buf, no vma [ 759.427239] binder_transaction: 3 callbacks suppressed [ 759.427256] binder: 6928:6938 transaction failed 29189/-3, size 0-0 line 3035 [ 759.440268] binder: 6918:6923 ioctl 40046207 0 returned -16 02:00:17 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x69, 0x2f) 02:00:17 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306204, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:17 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x400, 0x0) ioctl$KVM_GET_IRQCHIP(r0, 0xc208ae62, &(0x7f0000000100)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={0x0, r0, 0x0, 0xe, &(0x7f0000000040)='\xcf,mime_type-\xe9\x00', 0xffffffffffffffff}, 0x30) setpriority(0x1, r1, 0x4) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000300)='/dev/dlm_plock\x00', 0x4000, 0x0) preadv(r2, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 759.485273] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x700000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:17 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000060000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 759.642954] binder: 6954:6959 ioctl c0306204 20000140 returned -22 [ 759.675163] binder_alloc: binder_alloc_mmap_handler: 6954 20001000-20004000 already mapped failed -16 02:00:17 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x6a, 0x2f) [ 759.699234] binder: BINDER_SET_CONTEXT_MGR already set [ 759.704741] binder: 6954:6965 ioctl c0306204 20000140 returned -22 [ 759.726173] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 759.734891] binder: 6954:6963 ioctl 40046207 0 returned -16 02:00:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, 0x0}) 02:00:18 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000100)=0xc) write$P9_RGETLOCK(r0, &(0x7f0000000140)={0x1e, 0x37, 0x2, {0x0, 0x6, 0x3ff, r3}}, 0x1e) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000000)={0x1, 0xf8000000000, 0x7cb25d3a, 0xb6e, 0x8, 0x400, 0x1f, 0x0, 0x9, 0x80000001, 0xf0d6, 0x5}) 02:00:18 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000f0000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x800000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:18 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x6b, 0x2f) 02:00:18 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306205, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 760.104797] binder: undelivered TRANSACTION_ERROR: 29189 [ 760.163855] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 760.182667] binder: 6976:6980 ioctl c0306205 20000140 returned -22 [ 760.199759] binder: BINDER_SET_CONTEXT_MGR already set 02:00:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xa00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:18 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000000a0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:18 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) pwrite64(r1, &(0x7f0000000000)="d1d9df5b8506df7103f6e384153c1fd680f61b91ee2df195411e536b5e2876a479868624b6fe2cf8361134d833545ec35034c0cd3966cbeacf48efab4285e0ecd3e331b896320c3f602329d042b4b35838bc02b62e76031aaa28cc1da808ddfd66cac86b", 0x64, 0x0) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:18 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x6c, 0x2f) [ 760.220592] binder: 6988:6990 ioctl 40046207 0 returned -16 [ 760.244834] binder_alloc: binder_alloc_mmap_handler: 6976 20001000-20004000 already mapped failed -16 [ 760.295122] binder: BINDER_SET_CONTEXT_MGR already set [ 760.295136] binder: 6976:6991 ioctl c0306205 20000140 returned -22 02:00:18 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400204) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 760.343526] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 760.381159] binder: 6976:6980 ioctl 40046207 0 returned -16 [ 760.381214] binder: send failed reply for transaction 282 to 6988:6990 02:00:18 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 760.571910] binder: 7013:7016 ioctl c0306207 20000140 returned -22 [ 760.589926] binder_alloc: binder_alloc_mmap_handler: 7013 20001000-20004000 already mapped failed -16 [ 760.599860] binder: 7013:7018 ioctl c0306207 20000140 returned -22 [ 760.604203] binder: BINDER_SET_CONTEXT_MGR already set [ 760.611874] binder: 7013:7016 ioctl 40046207 0 returned -16 02:00:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, 0x0}) 02:00:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xc00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:19 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x6d, 0x2f) 02:00:19 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800007d0d0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:19 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$rose(r0, 0x104, 0x3, &(0x7f0000000000)=0x1ff, 0x4) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:19 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x3f00, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 760.991657] binder: undelivered TRANSACTION_COMPLETE [ 760.996917] binder: undelivered TRANSACTION_ERROR: 29189 [ 761.074754] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 761.102365] binder: BINDER_SET_CONTEXT_MGR already set [ 761.114855] binder: 7030:7033 ioctl 40046207 0 returned -16 02:00:19 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000000e0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:19 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x6e, 0x2f) [ 761.122586] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:19 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='n\x00\x00\x04\x00a(\x15\x80\"m\x1dh\x0f\xe2\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) keyctl$session_to_parent(0x12) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:19 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000c00e0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xe00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:19 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x6f, 0x2f) [ 761.849869] binder_alloc: binder_alloc_mmap_handler: 7021 20001000-20004000 already mapped failed -16 [ 761.863185] binder: BINDER_SET_CONTEXT_MGR already set [ 761.869571] binder: 7021:7061 ioctl 40046207 0 returned -16 [ 761.869734] binder: send failed reply for transaction 285 to 7030:7033 02:00:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xf00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:20 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) epoll_create1(0x80000) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f0000000140)={'filter\x00'}, &(0x7f00000000c0)=0x54) 02:00:20 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000000f0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:20 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x70, 0x2f) 02:00:20 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x1000000, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:20 executing program 2: r0 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = gettid() madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x2000000000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) ioctl$KVM_GET_IRQCHIP(r0, 0xc208ae62, &(0x7f0000000080)={0x0, 0x0, @ioapic}) process_vm_writev(r1, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) [ 761.895913] binder: undelivered TRANSACTION_COMPLETE [ 761.901145] binder: undelivered TRANSACTION_ERROR: 29189 02:00:20 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x71, 0x2f) 02:00:20 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000003f0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x1000000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:20 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000040)={0x8, 0x15, 0x16, 0x1f, 0x1, 0x3, 0x6, 0x9b}) ioctl$int_out(r0, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:20 executing program 2: 02:00:20 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x72, 0x2f) 02:00:20 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000600000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:20 executing program 2: 02:00:20 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0), 0x0, 0x0) 02:00:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x2000000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:20 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x3f000000, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:20 executing program 2: 02:00:20 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x73, 0x2f) 02:00:20 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000d7d0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x4000000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:20 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x4b564ff7}]}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 762.786823] binder_alloc: binder_alloc_mmap_handler: 7066 20001000-20004000 already mapped failed -16 [ 762.796596] binder: BINDER_SET_CONTEXT_MGR already set [ 762.801891] binder: 7066:7118 ioctl 40046207 0 returned -16 02:00:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x4800000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:21 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x74, 0x2f) 02:00:21 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000ec00000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:21 executing program 2: 02:00:21 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0), 0x100000000000024b, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x0, 0x30}, &(0x7f0000000040)=0xc) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000100)={r2, @in6={{0xa, 0x4e24, 0x80000001, @dev={0xfe, 0x80, [], 0x18}, 0x80}}, 0x6d, 0x7ff}, 0x90) 02:00:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x4c00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:21 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0xfdfdffff, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:21 executing program 2: 02:00:21 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x75, 0x2f) 02:00:21 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x80000000002, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000100)={0x16, 0x98, 0xfa00, {&(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0xffffffffffffffff, 0x0, 0x1, @ib={0x1b, 0x6, 0x3ff, {"104e6840e85462877a78e0ff0d5d7147"}, 0x6f8, 0x0, 0x7fffffff}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f00000001c0)={0x11, 0x10, 0xfa00, {&(0x7f0000000000), r2}}, 0x18) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000200)=0xfff, 0x4) preadv(r1, &(0x7f0000002b80)=[{&(0x7f00000008c0)=""/14}, {&(0x7f0000000900)=""/63}, {&(0x7f0000000940)=""/4096}, {&(0x7f0000001940)=""/30}, {&(0x7f0000001980)=""/71}, {&(0x7f0000001a00)=""/4096}, {&(0x7f0000002a00)=""/198}, {&(0x7f0000002b00)=""/29}, {&(0x7f0000002b40)=""/57}], 0x9, 0x0) 02:00:21 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000f00000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x6000000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 763.734636] binder_alloc: binder_alloc_mmap_handler: 7133 20001000-20004000 already mapped failed -16 [ 763.744217] binder: BINDER_SET_CONTEXT_MGR already set [ 763.750527] binder: 7133:7159 ioctl 40046207 0 returned -16 02:00:21 executing program 2: [ 763.815997] validate_nla: 9 callbacks suppressed [ 763.816007] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:21 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000400300843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:22 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x76, 0x2f) 02:00:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x6558000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:22 executing program 4: r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x400, 0xc0080) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0xffffffffffffffff, 0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) preadv(r1, &(0x7f00000002c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000140)={0x4, 0x3, 0x8007, 0x9, 0xfffffffffffffffc, 0xdc1, 0x10000, 0x10000, 0x0}, &(0x7f0000000180)=0x20) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f00000001c0)={r3, 0x0, 0x81}, 0x8) 02:00:22 executing program 2: [ 764.043848] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:22 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0xfeffffff, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:22 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000034000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:22 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x77, 0x2f) 02:00:22 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$bt_rfcomm(r0, &(0x7f0000000040)={0x1f, {0xfffffffffffffffb, 0x20d, 0x3, 0xde}, 0x9}, 0xa) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000000)=0x400, 0x4) 02:00:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x6800000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:22 executing program 2: [ 764.667609] binder_alloc: binder_alloc_mmap_handler: 7171 20001000-20004000 already mapped failed -16 [ 764.677213] binder: BINDER_SET_CONTEXT_MGR already set [ 764.682502] binder: 7171:7197 ioctl 40046207 0 returned -16 02:00:22 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 764.757008] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x6c00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:22 executing program 2: 02:00:22 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000fffff000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:22 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x78, 0x2f) 02:00:23 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000001843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 764.965547] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:23 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0xfffffdfd, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:23 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) accept$unix(r0, &(0x7f0000000000)=@abs, &(0x7f0000000100)=0x6e) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:23 executing program 2: 02:00:23 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x79, 0x2f) 02:00:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x7400000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:23 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000002843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 765.598932] binder_alloc: binder_alloc_mmap_handler: 7200 20001000-20004000 already mapped failed -16 02:00:23 executing program 2: [ 765.679081] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:23 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000004843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:23 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x7a, 0x2f) 02:00:23 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x16, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x7a00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:23 executing program 2: [ 765.936514] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:24 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0xfffffffe, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:24 executing program 2: clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x2c) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x1f, r0, 0x0, 0x0) 02:00:24 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x7b, 0x2f) 02:00:24 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000008843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:24 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x8100000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:24 executing program 4: r0 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x8549, 0x2) getsockopt$rose(r0, 0x104, 0x7, &(0x7f00000002c0), &(0x7f0000000300)=0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_script(0xffffffffffffff9c, &(0x7f0000000100)={'#! ', './file0', [{0x20, 'net/raw6\x00'}, {}], 0xa, "835e51abb1703a74f4945f0eeacd338e13ae44828dbacb58014c68f95ed44581ba18b8813d07e250f8667129fd5ba7fc31edfc85210f0c066095d9f77c04f4a07aabd41ec2290a2779a2316c05d14bbbfb976d26644b6a5558ed036049004d573c02f2dd139f8b1c31b7994240e61ed4598d677a12626b396f29d8a279e042f2e5636904679a6bbe0fb035f292189c292499138db814fd009651a2875e493be8d601adf210512f866c9064a82f7bf35b8815cd7cbd2e0a63ac3476cac59d446d041c30100921cffd3cbe82b9bf297a907eae6cc355ec7b720a11d87659b5"}, 0xf4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x0, 0x80) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 766.535542] binder_alloc: binder_alloc_mmap_handler: 7250 20001000-20004000 already mapped failed -16 [ 766.545173] binder: BINDER_SET_CONTEXT_MGR already set [ 766.550464] binder: 7250:7276 ioctl 40046207 0 returned -16 02:00:24 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000000000a843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 766.635411] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:24 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x20, r1, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80000000}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x40) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f00000003c0)=0x1000400) sendto$llc(r0, &(0x7f0000000440)="1e969323b59450b5a5a69fb8b7c8729920e3b7c62f097a3e77013ff75dbe0d31b77c7898e14fd6ad2a2197da97d786004316028fb9b1e8c9e7202bdb1bebc0297556ca4cdff036566c82f110acd4309aad5c6991c137b5669cbc6fe94e043e9144d9c66af415f8f3ede9a6ed3ac4e3fdcee9dab6f1ba42438ab7ff937143fc6fba2ab3b6e92e64571396874c06ba12912a1caa8d47e512bc82ee58d4ffd5b663197102b46ecaae53c11a501ab7b07124049da0be08c5868104365a38936662d4c20c50e4e1a48fbb69c425e2c9ba24baa94240f4cce4792d9b159ac5ead162c705deb468b31f69105084f8ccec13c6536ef43df3f8abe0ba057cb65a0f293d", 0xff, 0x40, &(0x7f0000000300)={0x1a, 0x101, 0x1f, 0x506, 0x8, 0x8001, @remote}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400202) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000200}, 0xc, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="28bd5d8498b3f103bacec9200974d9c38ad1c2", @ANYRES16=r2, @ANYBLOB="080429bd7000fedbdf2501000000000000000c410000000c001473797a3100000000"], 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x1) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:24 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x7c, 0x2f) 02:00:24 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x88a8ffff00000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:24 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") mkdir(0x0, 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) 02:00:24 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000000000e843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 766.888162] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:25 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x100000000000000, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:25 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x7d, 0x2f) 02:00:25 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x9effffff00000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:25 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000000000f843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:25 executing program 2: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x9) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) getsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, &(0x7f0000000480)=0x5, &(0x7f0000000700)=0x4) write$UHID_SET_REPORT_REPLY(r1, &(0x7f00000000c0)=ANY=[], 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000880)='mounts\x00') socket$inet_udplite(0x2, 0x2, 0x88) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) write$P9_RGETLOCK(r0, &(0x7f00000000c0)={0x25, 0x37, 0x2, {0x0, 0x8001, 0x85f5, 0x0, 0x7, 'mounts\x00'}}, 0x25) ioctl$RTC_AIE_ON(r2, 0x7001) preadv(r2, &(0x7f0000000480), 0x1000000000000237, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$bt_rfcomm(0x1f, 0x0, 0x3) [ 767.455574] binder_alloc: binder_alloc_mmap_handler: 7292 20001000-20004000 already mapped failed -16 [ 767.465851] binder: BINDER_SET_CONTEXT_MGR already set [ 767.471207] binder: 7292:7327 ioctl 40046207 0 returned -16 02:00:25 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x7e, 0x2f) [ 767.549704] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xa907000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:25 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000010843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:25 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mincore(&(0x7f0000ffc000/0x4000)=nil, 0x4000, &(0x7f0000000000)=""/21) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:25 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000000003f843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:25 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x82, 0x2f) [ 767.783552] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:26 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x3f00000000000000, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:26 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) clock_gettime(0x0, &(0x7f0000007540)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000007380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20, &(0x7f0000007580)={r1, r2+30000000}) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") 02:00:26 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xf0ffffff00000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:26 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000060843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:26 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x83, 0x2f) [ 768.378262] binder_alloc: binder_alloc_mmap_handler: 7338 20001000-20004000 already mapped failed -16 [ 768.387816] binder: BINDER_SET_CONTEXT_MGR already set [ 768.393109] binder: 7338:7374 ioctl 40046207 0 returned -16 02:00:26 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x84, 0x2f) 02:00:26 executing program 4: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)=0x0) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x260542) write(r1, &(0x7f0000000080)="12b35efe3956f18391e61792e496715e6b84972f07865d68a018e864ea202ca8b421e6cb57", 0x25) r2 = syz_open_procfs(r0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xfeff000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:26 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000d7d843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:26 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x85, 0x2f) 02:00:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xff0f000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 768.845096] protocol 88fb is buggy, dev hsr_slave_0 [ 768.850460] protocol 88fb is buggy, dev hsr_slave_1 [ 768.855610] protocol 88fb is buggy, dev hsr_slave_0 [ 768.860651] protocol 88fb is buggy, dev hsr_slave_1 [ 769.304417] binder_alloc: binder_alloc_mmap_handler: 7389 20001000-20004000 already mapped failed -16 [ 769.314034] binder: BINDER_SET_CONTEXT_MGR already set [ 769.320360] binder: 7389:7419 ioctl 40046207 0 returned -16 02:00:27 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0xfdfdffff00000000, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:27 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000ffffff9e843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:27 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@loopback, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@remote}}, &(0x7f0000000140)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000003c0)={{{@in=@multicast2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) mount$9p_virtio(&(0x7f0000000000)='keyring!\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x0, &(0x7f00000004c0)={'trans=virtio,', {[{@version_u='version=9p2000.u'}, {@cache_mmap='cache=mmap'}, {@access_uid={'access', 0x3d, r2}}], [{@obj_user={'obj_user'}}, {@smackfshat={'smackfshat', 0x3d, 'net/raw6\x00'}}, {@fowner_eq={'fowner', 0x3d, r3}}, {@smackfsdef={'smackfsdef', 0x3d, 'net/raw6\x00'}}]}}) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xffffff7f00000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:27 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x86, 0x2f) 02:00:27 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r2 = accept(r1, 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000140)={{{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@empty}}, &(0x7f0000000240)=0xe8) accept4(r2, &(0x7f0000000040)=@hci, &(0x7f00000000c0)=0x80, 0x80800) socket$key(0xf, 0x3, 0x2) clock_gettime(0x0, &(0x7f00000002c0)) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000400)=@add_del={0x2, &(0x7f0000000100)='hwsim0\x00'}) sendmsg$can_bcm(r2, &(0x7f00000003c0)={&(0x7f0000000280)={0x1d, r3}, 0x10, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="010000600100000001000060270300002e94b94ae6c2660fe3919858782bb3c7c5e92960abe6c31e8022e7afccf67a155ba3104ffe1bdf779111207ab5c1ef2c689973c38bf497e92740adc2d6a15c6e"], 0x1}, 0x1, 0x0, 0x0, 0x4040000}, 0x8880) 02:00:27 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000ec0843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 769.426296] validate_nla: 3 callbacks suppressed [ 769.426305] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:27 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x87, 0x2f) 02:00:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0xfffffffffffff000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:27 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000fffffff0843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:27 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) sync_file_range(r1, 0x6, 0x4, 0x2) 02:00:27 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)=0x0) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x260542) write(r1, &(0x7f0000000080)="12b35efe3956f18391e61792e496715e6b84972f07865d68a018e864ea202ca8b421e6cb57", 0x25) r2 = syz_open_procfs(r0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 769.680388] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:28 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0xfeffffff00000000, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:28 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x88, 0x2f) 02:00:28 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000f0ffff843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x0, 0x0}) 02:00:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:28 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)=0x0) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x260542) write(r1, &(0x7f0000000080)="12b35efe3956f18391e61792e496715e6b84972f07865d68a018e864ea202ca8b421e6cb57", 0x25) r2 = syz_open_procfs(r0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 770.270280] binder_alloc: binder_alloc_mmap_handler: 7433 20001000-20004000 already mapped failed -16 [ 770.279884] binder: BINDER_SET_CONTEXT_MGR already set [ 770.286455] binder: 7433:7463 ioctl 40046207 0 returned -16 02:00:28 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800007fffffff843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 770.377434] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 770.388113] binder_thread_release: 6 callbacks suppressed [ 770.388137] binder: release 7468:7475 transaction 296 out, still active [ 770.416369] binder: BINDER_SET_CONTEXT_MGR already set [ 770.421672] binder: 7473:7478 ioctl 40046207 0 returned -16 02:00:28 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x89, 0x2f) 02:00:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 770.434599] binder: undelivered TRANSACTION_COMPLETE 02:00:28 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)=0x0) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x260542) write(r1, &(0x7f0000000080)="12b35efe3956f18391e61792e496715e6b84972f07865d68a018e864ea202ca8b421e6cb57", 0x25) r2 = syz_open_procfs(r0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:28 executing program 4 (fault-call:6 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 770.469600] binder: release 7468:7475 transaction 296 in, still active [ 770.482763] binder_alloc: binder_alloc_mmap_handler: 7473 20001000-20004000 already mapped failed -16 [ 770.507142] binder: send failed reply for transaction 296, target dead 02:00:28 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x630b}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:28 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)=0x0) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x260542) write(r1, &(0x7f0000000080)="12b35efe3956f18391e61792e496715e6b84972f07865d68a018e864ea202ca8b421e6cb57", 0x25) r2 = syz_open_procfs(r0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) preadv(r2, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:28 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800009effffff843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 770.611397] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 770.626030] FAULT_INJECTION: forcing a failure. [ 770.626030] name failslab, interval 1, probability 0, space 0, times 0 [ 770.675156] CPU: 1 PID: 7493 Comm: syz-executor.4 Not tainted 5.0.0-rc7+ #85 [ 770.682382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 770.691742] Call Trace: [ 770.694351] dump_stack+0x172/0x1f0 [ 770.698000] should_fail.cold+0xa/0x1b [ 770.701908] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 770.707023] ? lock_downgrade+0x810/0x810 [ 770.711191] ? ___might_sleep+0x163/0x280 [ 770.715359] __should_failslab+0x121/0x190 [ 770.715379] should_failslab+0x9/0x14 [ 770.715397] kmem_cache_alloc_trace+0x2d1/0x760 [ 770.723418] ? kasan_check_read+0x11/0x20 [ 770.732235] ? do_raw_spin_unlock+0x57/0x270 [ 770.736682] ? _raw_spin_unlock+0x2d/0x50 [ 770.740849] binder_transaction+0x886/0x6890 [ 770.745272] ? debug_smp_processor_id+0x1c/0x20 [ 770.749952] ? perf_trace_lock_acquire+0xf5/0x580 [ 770.754810] ? mark_held_locks+0x100/0x100 [ 770.759082] ? __might_fault+0x12b/0x1e0 [ 770.763155] ? find_held_lock+0x35/0x130 [ 770.765126] binder: BINDER_SET_CONTEXT_MGR already set [ 770.767240] ? binder_deferred_func+0xea0/0xea0 [ 770.767273] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 770.772617] binder: 7500:7501 ioctl 40046207 0 returned -16 [ 770.777199] ? _copy_from_user+0xdd/0x150 [ 770.777220] binder_thread_write+0x64a/0x2820 [ 770.777236] ? debug_smp_processor_id+0x1c/0x20 [ 770.777250] ? perf_trace_lock_acquire+0xf5/0x580 [ 770.777274] ? binder_transaction+0x6890/0x6890 [ 770.788445] binder: 7500:7501 ERROR: BC_REGISTER_LOOPER called without request [ 770.788492] ? __might_fault+0x12b/0x1e0 [ 770.822724] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 770.828269] ? _copy_from_user+0xdd/0x150 [ 770.832430] binder_ioctl+0x13b9/0x1b79 [ 770.836423] ? kasan_check_read+0x11/0x20 [ 770.839682] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 770.840595] ? binder_thread_write+0x2820/0x2820 [ 770.840615] ? mark_held_locks+0x100/0x100 [ 770.840648] ? debug_smp_processor_id+0x1c/0x20 [ 770.840667] ? __fget+0x340/0x540 [ 770.865111] ? __might_sleep+0x95/0x190 [ 770.869116] ? binder_thread_write+0x2820/0x2820 [ 770.873893] do_vfs_ioctl+0xd6e/0x1390 [ 770.877792] ? selinux_file_ioctl+0x46f/0x5e0 [ 770.882295] ? selinux_file_ioctl+0x125/0x5e0 [ 770.886800] ? ioctl_preallocate+0x210/0x210 [ 770.891223] ? selinux_file_mprotect+0x620/0x620 [ 770.895999] ? iterate_fd+0x360/0x360 [ 770.899825] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 770.905391] ? fput+0x128/0x1a0 [ 770.908686] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 770.914235] ? security_file_ioctl+0x93/0xc0 [ 770.918674] ksys_ioctl+0xab/0xd0 [ 770.922157] __x64_sys_ioctl+0x73/0xb0 02:00:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:28 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000f0ffffff843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 770.926064] do_syscall_64+0x103/0x610 [ 770.930001] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 770.935226] RIP: 0033:0x457e29 [ 770.938441] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 770.957339] RSP: 002b:00007f257a13cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 770.957356] RAX: ffffffffffffffda RBX: 00007f257a13cc90 RCX: 0000000000457e29 02:00:29 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x8a, 0x2f) 02:00:29 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)=0x0) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x260542) write(r1, &(0x7f0000000080)="12b35efe3956f18391e61792e496715e6b84972f07865d68a018e864ea202ca8b421e6cb57", 0x25) r2 = syz_open_procfs(r0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) preadv(r2, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 770.957365] RDX: 0000000020000600 RSI: 00000000c0306201 RDI: 0000000000000004 [ 770.957374] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 770.957383] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f257a13d6d4 [ 770.957392] R13: 00000000004bf15a R14: 00000000004d0b00 R15: 0000000000000005 02:00:29 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x8b, 0x2f) 02:00:29 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000020000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:29 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)=0x0) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x260542) write(r1, &(0x7f0000000080)="12b35efe3956f18391e61792e496715e6b84972f07865d68a018e864ea202ca8b421e6cb57", 0x25) r2 = syz_open_procfs(r0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) preadv(r2, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 771.095560] binder: 7489:7493 transaction failed 29201/-12, size 0-0 line 2975 [ 771.108450] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 771.129470] binder: send failed reply for transaction 299 to 7489:7493 [ 771.177695] binder: undelivered TRANSACTION_COMPLETE [ 771.182975] binder: undelivered TRANSACTION_ERROR: 29201 02:00:29 executing program 4 (fault-call:6 fault-nth:1): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 771.250869] binder: undelivered TRANSACTION_ERROR: 29190 [ 771.337754] FAULT_INJECTION: forcing a failure. [ 771.337754] name failslab, interval 1, probability 0, space 0, times 0 [ 771.351234] CPU: 0 PID: 7531 Comm: syz-executor.4 Not tainted 5.0.0-rc7+ #85 [ 771.358441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 771.367800] Call Trace: [ 771.370402] dump_stack+0x172/0x1f0 [ 771.374049] should_fail.cold+0xa/0x1b [ 771.377972] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 771.383114] ? lock_downgrade+0x810/0x810 [ 771.387298] ? ___might_sleep+0x163/0x280 [ 771.391461] __should_failslab+0x121/0x190 [ 771.395708] should_failslab+0x9/0x14 [ 771.399524] kmem_cache_alloc_trace+0x2d1/0x760 [ 771.404253] ? lockdep_init_map+0x10c/0x5b0 [ 771.408595] binder_transaction+0x965/0x6890 [ 771.413014] ? debug_smp_processor_id+0x1c/0x20 [ 771.417694] ? perf_trace_lock_acquire+0xf5/0x580 [ 771.422543] ? mark_held_locks+0x100/0x100 [ 771.426825] ? __might_fault+0x12b/0x1e0 [ 771.430898] ? find_held_lock+0x35/0x130 [ 771.435011] ? binder_deferred_func+0xea0/0xea0 [ 771.439701] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 771.445247] ? _copy_from_user+0xdd/0x150 [ 771.449413] binder_thread_write+0x64a/0x2820 [ 771.453917] ? debug_smp_processor_id+0x1c/0x20 [ 771.458624] ? perf_trace_lock_acquire+0xf5/0x580 [ 771.463474] ? binder_transaction+0x6890/0x6890 [ 771.468147] ? __might_fault+0x12b/0x1e0 [ 771.472240] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 771.477786] ? _copy_from_user+0xdd/0x150 [ 771.481979] binder_ioctl+0x13b9/0x1b79 [ 771.485969] ? kasan_check_read+0x11/0x20 [ 771.490133] ? binder_thread_write+0x2820/0x2820 [ 771.494915] ? mark_held_locks+0x100/0x100 [ 771.499193] ? debug_smp_processor_id+0x1c/0x20 [ 771.504225] ? __fget+0x340/0x540 [ 771.507697] ? __might_sleep+0x95/0x190 [ 771.511681] ? binder_thread_write+0x2820/0x2820 [ 771.516447] do_vfs_ioctl+0xd6e/0x1390 [ 771.520343] ? selinux_file_ioctl+0x46f/0x5e0 [ 771.524838] ? selinux_file_ioctl+0x125/0x5e0 [ 771.529331] ? ioctl_preallocate+0x210/0x210 [ 771.533762] ? selinux_file_mprotect+0x620/0x620 [ 771.538522] ? iterate_fd+0x360/0x360 [ 771.542310] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 771.547844] ? fput+0x128/0x1a0 [ 771.551121] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 771.556655] ? security_file_ioctl+0x93/0xc0 [ 771.561058] ksys_ioctl+0xab/0xd0 [ 771.564509] __x64_sys_ioctl+0x73/0xb0 [ 771.568399] do_syscall_64+0x103/0x610 [ 771.572290] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 771.577462] RIP: 0033:0x457e29 [ 771.580641] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 771.599535] RSP: 002b:00007f257a13cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 771.607235] RAX: ffffffffffffffda RBX: 00007f257a13cc90 RCX: 0000000000457e29 [ 771.614499] RDX: 0000000020000600 RSI: 00000000c0306201 RDI: 0000000000000004 [ 771.621751] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 771.629012] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f257a13d6d4 [ 771.636281] R13: 00000000004bf15a R14: 00000000004d0b00 R15: 0000000000000005 [ 771.647351] binder_alloc: binder_alloc_mmap_handler: 7500 20001000-20004000 already mapped failed -16 [ 771.651418] binder: 7527:7531 transaction failed 29201/-12, size 0-0 line 2986 [ 771.659228] binder: BINDER_SET_CONTEXT_MGR already set [ 771.664617] binder: send failed reply for transaction 302 to 7527:7531 [ 771.674673] binder: 7500:7538 ERROR: BC_REGISTER_LOOPER called without request [ 771.678881] binder: 7500:7537 ioctl 40046207 0 returned -16 02:00:29 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x630d}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:29 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x8c, 0x2f) 02:00:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:29 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)=0x0) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x260542) write(r1, &(0x7f0000000080)="12b35efe3956f18391e61792e496715e6b84972f07865d68a018e864ea202ca8b421e6cb57", 0x25) r2 = syz_open_procfs(r0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r2, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:29 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000040000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 771.687452] binder: undelivered TRANSACTION_COMPLETE [ 771.694817] binder: undelivered TRANSACTION_ERROR: 29201 02:00:29 executing program 4 (fault-call:6 fault-nth:2): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:29 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000080000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 771.783991] binder: undelivered TRANSACTION_ERROR: 29190 [ 771.792098] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:29 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)=0x0) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x260542) write(r1, &(0x7f0000000080)="12b35efe3956f18391e61792e496715e6b84972f07865d68a018e864ea202ca8b421e6cb57", 0x25) r2 = syz_open_procfs(r0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r2, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:29 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x8d, 0x2f) [ 771.911482] binder: BINDER_SET_CONTEXT_MGR already set 02:00:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 771.948540] binder: 7551:7557 ioctl 40046207 0 returned -16 02:00:30 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)=0x0) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x260542) write(r1, &(0x7f0000000080)="12b35efe3956f18391e61792e496715e6b84972f07865d68a018e864ea202ca8b421e6cb57", 0x25) r2 = syz_open_procfs(r0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r2, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:30 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000000a0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 772.030995] binder: 7551:7563 got reply transaction with no transaction stack [ 772.061241] binder: 7551:7563 transaction failed 29201/-71, size 0-0 line 2801 [ 772.098962] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:30 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x6312}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:30 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x8e, 0x2f) 02:00:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:30 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)) r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x260542) write(r0, &(0x7f0000000080)="12b35efe3956f18391e61792e496715e6b84972f07865d68a018e864ea202ca8b421e6cb57", 0x25) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:30 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000000e0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 772.576812] binder_alloc: binder_alloc_mmap_handler: 7546 20001000-20004000 already mapped failed -16 [ 772.586967] binder: BINDER_SET_CONTEXT_MGR already set [ 772.592432] binder: 7546:7579 ioctl 40046207 0 returned -16 [ 772.599450] binder: send failed reply for transaction 305 to 7551:7563 [ 772.680021] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 772.695438] binder: undelivered TRANSACTION_COMPLETE [ 772.700652] binder: undelivered TRANSACTION_ERROR: 29189 [ 772.718699] binder: 7592:7593 unknown command 25362 02:00:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:30 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x8f, 0x2f) 02:00:30 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000000f0000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 772.748143] binder: undelivered TRANSACTION_ERROR: 29201 02:00:30 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)) r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x260542) write(r0, &(0x7f0000000080)="12b35efe3956f18391e61792e496715e6b84972f07865d68a018e864ea202ca8b421e6cb57", 0x25) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xa}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 772.795830] binder: 7592:7593 ioctl c0306201 20000140 returned -22 [ 772.822059] binder_alloc: binder_alloc_mmap_handler: 7592 20001000-20004000 already mapped failed -16 [ 772.867802] binder: BINDER_SET_CONTEXT_MGR already set [ 772.881137] binder: 7592:7593 ioctl 40046207 0 returned -16 [ 772.898689] binder: BINDER_SET_CONTEXT_MGR already set [ 772.908878] binder: 7592:7609 unknown command 25362 02:00:31 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)) r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x260542) write(r0, &(0x7f0000000080)="12b35efe3956f18391e61792e496715e6b84972f07865d68a018e864ea202ca8b421e6cb57", 0x25) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:31 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000100000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 772.931551] binder: 7602:7606 ioctl 40046207 0 returned -16 [ 772.931583] binder: 7592:7609 ioctl c0306201 20000140 returned -22 [ 772.956852] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 772.983720] binder: 7602:7606 transaction failed 29189/-22, size 0-0 line 2896 02:00:31 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40046302}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xc}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:31 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x90, 0x2f) [ 773.084926] binder: 7602:7621 got reply transaction with no transaction stack 02:00:31 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000600000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:31 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)=0x0) syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x260542) r1 = syz_open_procfs(r0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 773.138523] binder: 7602:7621 transaction failed 29201/-71, size 0-0 line 2801 [ 773.164873] binder: BC_ACQUIRE_RESULT not supported [ 773.207257] binder: 7623:7625 ioctl c0306201 20000140 returned -22 [ 773.237767] binder_alloc: binder_alloc_mmap_handler: 7623 20001000-20004000 already mapped failed -16 [ 773.281187] binder: BINDER_SET_CONTEXT_MGR already set [ 773.299961] binder: 7623:7625 ioctl 40046207 0 returned -16 [ 773.319443] binder: BC_ACQUIRE_RESULT not supported [ 773.336750] binder: 7623:7635 ioctl c0306201 20000140 returned -22 02:00:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x2, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xe}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:31 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000f00000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:31 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x91, 0x2f) 02:00:31 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:31 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40046304}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 773.689345] binder: undelivered TRANSACTION_ERROR: 29189 [ 773.704796] binder: undelivered TRANSACTION_ERROR: 29201 02:00:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:31 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000a00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 773.802572] binder: BINDER_SET_CONTEXT_MGR already set [ 773.815444] binder: 7644:7654 ioctl 40046207 0 returned -16 02:00:31 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x92, 0x2f) 02:00:32 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000001c0)) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:32 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000007d0d00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 774.582902] binder_alloc: binder_alloc_mmap_handler: 7649 20001000-20004000 already mapped failed -16 [ 774.592519] binder: BINDER_SET_CONTEXT_MGR already set [ 774.595884] binder_alloc: binder_alloc_mmap_handler: 7644 20001000-20004000 already mapped failed -16 [ 774.604105] binder: 7649:7679 ioctl 40046207 0 returned -16 [ 774.608035] binder: send failed reply for transaction 313 to 7644:7654 [ 774.620262] binder_alloc: 7644: binder_alloc_buf, no vma [ 774.625864] binder: 7644:7681 transaction failed 29189/-3, size 0-0 line 3035 02:00:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x4b47, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:32 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:32 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x93, 0x2f) 02:00:32 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000e00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x48}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:32 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40046307}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 774.635242] binder: undelivered TRANSACTION_ERROR: 29189 [ 774.640740] binder: undelivered TRANSACTION_COMPLETE [ 774.657360] binder: undelivered TRANSACTION_ERROR: 29189 [ 774.752196] binder: 7688:7692 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 774.765535] validate_nla: 4 callbacks suppressed [ 774.765544] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 774.781872] binder: BINDER_SET_CONTEXT_MGR already set 02:00:32 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:32 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000c00e00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 774.800871] binder: 7687:7695 ioctl 40046207 0 returned -16 02:00:32 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x94, 0x2f) 02:00:33 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4c}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 774.889545] binder: 7687:7701 ioctl 4b47 20000600 returned -22 02:00:33 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000f00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 775.000735] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 775.538739] binder_alloc: binder_alloc_mmap_handler: 7688 20001000-20004000 already mapped failed -16 [ 775.548348] binder: 7688:7724 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 775.553244] binder_alloc: binder_alloc_mmap_handler: 7687 20001000-20004000 already mapped failed -16 [ 775.557559] binder: send failed reply for transaction 318 to 7687:7701 [ 775.569274] binder_alloc: 7687: binder_alloc_buf, no vma 02:00:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x4b49, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:33 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x95, 0x2f) 02:00:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:33 executing program 2: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:33 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000003f00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:33 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40086303}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 775.582252] binder: 7687:7725 transaction failed 29189/-3, size 0-0 line 3035 [ 775.590957] binder: 7687:7725 ioctl 4b47 20000600 returned -22 [ 775.597737] binder: undelivered TRANSACTION_COMPLETE [ 775.704729] binder: 7730:7736 BC_FREE_BUFFER u0000000000000000 no match [ 775.720260] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x68}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:33 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000006000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:33 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x96, 0x2f) 02:00:33 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 775.775990] binder: BINDER_SET_CONTEXT_MGR already set [ 775.795404] binder: 7734:7745 ioctl 40046207 0 returned -16 02:00:34 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 775.871400] binder: 7734:7753 ioctl 4b49 20000600 returned -22 02:00:34 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x97, 0x2f) [ 775.956601] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 776.495926] binder_alloc: binder_alloc_mmap_handler: 7730 20001000-20004000 already mapped failed -16 [ 776.505643] binder: BINDER_SET_CONTEXT_MGR already set [ 776.511151] binder: 7730:7771 ioctl 40046207 0 returned -16 [ 776.511471] binder: 7730:7772 BC_FREE_BUFFER u0000000000000000 no match [ 776.524106] binder: send failed reply for transaction 322 to 7734:7745 [ 776.560809] binder_alloc: binder_alloc_mmap_handler: 7734 20001000-20004000 already mapped failed -16 [ 776.572112] binder_alloc: 7734: binder_alloc_buf, no vma [ 776.578103] binder: 7734:7774 transaction failed 29189/-3, size 0-0 line 3035 [ 776.586216] binder: 7734:7774 ioctl 4b49 20000600 returned -22 [ 776.592434] binder: undelivered TRANSACTION_COMPLETE [ 776.598168] binder_release_work: 2 callbacks suppressed [ 776.598174] binder: undelivered TRANSACTION_ERROR: 29189 02:00:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x541b, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:34 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000000d7d00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:34 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6c}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:34 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x98, 0x2f) 02:00:34 executing program 2: r0 = syz_open_procfs(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:34 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x4008630a}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 776.619411] binder: undelivered TRANSACTION_ERROR: 29189 02:00:34 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x99, 0x2f) [ 776.708205] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 776.708454] binder: BC_ATTEMPT_ACQUIRE not supported [ 776.727188] binder: BINDER_SET_CONTEXT_MGR already set [ 776.734302] binder: 7778:7782 ioctl c0306201 20000140 returned -22 02:00:34 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000000ec000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 776.759187] binder: 7783:7788 ioctl 40046207 0 returned -16 [ 776.775447] binder_alloc: binder_alloc_mmap_handler: 7778 20001000-20004000 already mapped failed -16 02:00:34 executing program 2: r0 = syz_open_procfs(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:34 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x74}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 776.809680] binder_alloc: 7778: binder_alloc_buf, no vma [ 776.821969] binder: BINDER_SET_CONTEXT_MGR already set 02:00:35 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x9a, 0x2f) [ 776.880567] binder: 7778:7782 ioctl 40046207 0 returned -16 [ 776.885192] binder: BC_ATTEMPT_ACQUIRE not supported [ 776.891869] binder: 7778:7802 ioctl c0306201 20000140 returned -22 [ 776.902408] binder: 7783:7796 transaction failed 29189/-3, size 0-0 line 3035 [ 776.915158] binder: 7783:7803 ioctl 541b 20000600 returned -22 02:00:35 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000000f000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 776.945432] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:35 executing program 2: r0 = syz_open_procfs(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:35 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40086310}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7a}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:35 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000200843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:35 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x9b, 0x2f) [ 777.521895] binder_alloc: binder_alloc_mmap_handler: 7783 20001000-20004000 already mapped failed -16 [ 777.531649] binder_alloc: 7783: binder_alloc_buf, no vma [ 777.537357] binder: 7783:7803 transaction failed 29189/-3, size 0-0 line 3035 [ 777.544799] binder: 7783:7803 ioctl 541b 20000600 returned -22 [ 777.555432] binder: undelivered TRANSACTION_ERROR: 29189 [ 777.560970] binder: undelivered TRANSACTION_ERROR: 29189 [ 777.619367] binder: 7821:7828 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 777.655461] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:35 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:35 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000400843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 777.672731] binder: BINDER_SET_CONTEXT_MGR already set 02:00:35 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x9c, 0x2f) 02:00:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 777.704786] binder: 7825:7834 ioctl 40046207 0 returned -16 [ 777.779990] binder_alloc: binder_alloc_mmap_handler: 7825 20001000-20004000 already mapped failed -16 02:00:35 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 777.842899] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 777.850896] binder: BINDER_SET_CONTEXT_MGR already set [ 777.871448] binder: 7825:7850 ioctl 40046207 0 returned -16 [ 777.871930] binder: release 7825:7836 transaction 330 out, still active [ 777.884449] binder: undelivered TRANSACTION_COMPLETE 02:00:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 777.903785] binder: release 7825:7834 transaction 331 out, still active [ 777.929483] binder: undelivered TRANSACTION_COMPLETE 02:00:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x5450, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:36 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000800843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 778.001634] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 778.114391] binder: BINDER_SET_CONTEXT_MGR already set [ 778.129067] binder: 7864:7873 ioctl 40046207 0 returned -16 02:00:36 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x400c630e}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:36 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x9d, 0x2f) 02:00:36 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x500}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:36 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000a00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 778.403486] binder_alloc: binder_alloc_mmap_handler: 7821 20001000-20004000 already mapped failed -16 [ 778.413101] binder: BINDER_SET_CONTEXT_MGR already set [ 778.417994] binder: 7821:7879 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 778.425172] binder: 7821:7876 ioctl 40046207 0 returned -16 [ 778.426325] binder: send failed reply for transaction 330, target dead [ 778.438392] binder: send failed reply for transaction 331, target dead [ 778.445373] binder: send failed reply for transaction 332 to 7864:7873 [ 778.500128] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:36 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:36 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000e00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:36 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x9e, 0x2f) [ 778.559923] binder: 7886:7900 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 02:00:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x600}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:36 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x5451, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:37 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000f00843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 778.913403] binder: BINDER_SET_CONTEXT_MGR already set [ 778.918780] binder: 7864:7875 ioctl 40046207 0 returned -16 [ 778.919691] binder: undelivered TRANSACTION_COMPLETE [ 778.941788] binder: undelivered TRANSACTION_ERROR: 29189 [ 778.947685] binder: release 7864:7941 transaction 334 out, still active [ 778.965026] binder: undelivered TRANSACTION_COMPLETE [ 779.018322] binder: BINDER_SET_CONTEXT_MGR already set [ 779.023660] binder: 7948:7950 ioctl 40046207 0 returned -16 02:00:37 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x400c630f}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x700}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:37 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x9f, 0x2f) 02:00:37 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:37 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000001000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 779.354548] binder: BINDER_SET_CONTEXT_MGR already set [ 779.354558] binder: 7886:7953 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 779.360076] binder: 7886:7952 ioctl 40046207 0 returned -16 [ 779.373965] binder: send failed reply for transaction 334, target dead [ 779.380978] binder: send failed reply for transaction 335 to 7948:7950 02:00:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7a9}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:37 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:37 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xa0, 0x2f) 02:00:37 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000006000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 779.509992] binder: 7960:7965 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 02:00:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xa00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x5452, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:37 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000000f000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 779.815613] binder_alloc_mmap_handler: 2 callbacks suppressed [ 779.815628] binder_alloc: binder_alloc_mmap_handler: 7948 20001000-20004000 already mapped failed -16 [ 779.831331] binder: BINDER_SET_CONTEXT_MGR already set [ 779.837911] binder: 7948:7951 ioctl 40046207 0 returned -16 [ 779.839075] binder: release 7948:7987 transaction 337 out, still active [ 779.857586] binder: undelivered TRANSACTION_COMPLETE [ 779.864612] binder: undelivered TRANSACTION_COMPLETE [ 779.872437] binder: undelivered TRANSACTION_ERROR: 29189 [ 779.919686] binder: BINDER_SET_CONTEXT_MGR already set [ 779.925208] binder: 7992:7993 ioctl 40046207 0 returned -16 02:00:38 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40106308}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:38 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xa1, 0x2f) 02:00:38 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xc00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:38 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000000000a843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 780.298037] binder_alloc: binder_alloc_mmap_handler: 7960 20001000-20004000 already mapped failed -16 [ 780.307712] binder: 7960:7997 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 780.313978] binder: BINDER_SET_CONTEXT_MGR already set [ 780.320405] binder: 7960:7996 ioctl 40046207 0 returned -16 [ 780.320611] binder: send failed reply for transaction 337, target dead [ 780.332853] binder: send failed reply for transaction 338 to 7992:7993 02:00:38 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:38 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000007d0d843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:38 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xa2, 0x2f) [ 780.452256] binder: 8002:8009 BC_INCREFS_DONE node 339 has no pending increfs request [ 780.452385] validate_nla: 4 callbacks suppressed [ 780.452393] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xe00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:38 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 780.698442] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 780.719235] binder_alloc: binder_alloc_mmap_handler: 7992 20001000-20004000 already mapped failed -16 [ 780.742258] binder: BINDER_SET_CONTEXT_MGR already set [ 780.754642] binder: 7992:7995 ioctl 40046207 0 returned -16 [ 780.776108] binder: undelivered TRANSACTION_COMPLETE [ 780.781232] binder: undelivered TRANSACTION_ERROR: 29189 02:00:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x5460, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:38 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000000000e843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 780.805115] binder: release 7992:8027 transaction 340 out, still active [ 780.811881] binder: undelivered TRANSACTION_COMPLETE [ 780.898477] binder: BINDER_SET_CONTEXT_MGR already set [ 780.903863] binder: 8036:8038 ioctl 40046207 0 returned -16 02:00:39 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40106309}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:39 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xa3, 0x2f) 02:00:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:39 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:39 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000000c00e843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 781.243788] binder_alloc: binder_alloc_mmap_handler: 8002 20001000-20004000 already mapped failed -16 [ 781.253347] binder: BINDER_SET_CONTEXT_MGR already set [ 781.254314] binder: 8002:8041 BC_INCREFS_DONE u0000000000000000 no match [ 781.265299] binder: 8002:8040 ioctl 40046207 0 returned -16 [ 781.267602] binder: send failed reply for transaction 340, target dead [ 781.278473] binder: send failed reply for transaction 341 to 8036:8038 02:00:39 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 781.348155] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:39 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000000000f843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:39 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xa4, 0x2f) [ 781.427725] binder: 8050:8053 BC_ACQUIRE_DONE node 342 has no pending acquire request 02:00:39 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000000003f843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 781.563147] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 781.694550] binder_alloc: binder_alloc_mmap_handler: 8036 20001000-20004000 already mapped failed -16 [ 781.708630] binder: BINDER_SET_CONTEXT_MGR already set [ 781.714102] binder: 8036:8039 ioctl 40046207 0 returned -16 [ 781.720768] binder: undelivered TRANSACTION_COMPLETE [ 781.726039] binder: undelivered TRANSACTION_ERROR: 29189 02:00:39 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xa5, 0x2f) 02:00:39 executing program 2: syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 781.743378] binder: release 8036:8074 transaction 343 out, still active [ 781.750319] binder: undelivered TRANSACTION_COMPLETE 02:00:40 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40406300}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x40046205, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:40 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000060843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:40 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xa6, 0x2f) 02:00:40 executing program 2: syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 782.208033] binder_alloc: binder_alloc_mmap_handler: 8050 20001000-20004000 already mapped failed -16 [ 782.217816] binder: 8050:8086 BC_ACQUIRE_DONE u0000000000000000 no match [ 782.223731] binder: BINDER_SET_CONTEXT_MGR already set [ 782.231042] binder: 8050:8085 ioctl 40046207 0 returned -16 [ 782.231265] binder: send failed reply for transaction 343, target dead [ 782.328695] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 782.338460] binder_alloc: binder_alloc_mmap_handler: 8088 20001000-20004000 already mapped failed -16 02:00:40 executing program 2: syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:40 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xa7, 0x2f) [ 782.383042] binder_alloc: 8088: binder_alloc_buf, no vma [ 782.391205] binder: BINDER_SET_CONTEXT_MGR already set 02:00:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4800}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:40 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000d7d843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 782.425372] binder: 8088:8100 transaction failed 29189/-3, size 0-0 line 3035 [ 782.439530] binder: 8098:8101 ioctl 40046207 0 returned -16 [ 782.440724] binder: BINDER_SET_CONTEXT_MGR already set [ 782.463945] binder: 8088:8094 ioctl 40046207 0 returned -16 [ 782.469873] binder_alloc: 8088: binder_alloc_buf, no vma [ 782.505203] binder: release 8088:8094 transaction 345 out, still active [ 782.511984] binder: undelivered TRANSACTION_COMPLETE [ 782.515314] binder: 8098:8105 transaction failed 29189/-3, size 0-0 line 3035 [ 782.530687] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 782.548418] binder: undelivered TRANSACTION_ERROR: 29189 02:00:40 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, 0x0, 0x0, 0x0) [ 782.560353] binder: release 8088:8094 transaction 345 in, still active [ 782.568181] binder_alloc: binder_alloc_mmap_handler: 8098 20001000-20004000 already mapped failed -16 02:00:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 782.604202] binder: send failed reply for transaction 345, target dead [ 782.610660] binder: 8098:8119 got transaction to context manager from process owning it [ 782.655061] binder: BINDER_SET_CONTEXT_MGR already set [ 782.667167] binder: 8098:8119 transaction failed 29201/-22, size 0-0 line 2887 [ 782.683279] binder: 8121:8122 ioctl 40046207 0 returned -16 02:00:40 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40406301}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:40 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xa8, 0x2f) 02:00:40 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000ec0843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4c00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:40 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, 0x0, 0x0, 0x0) [ 782.726595] binder: 8121:8128 transaction failed 29189/-22, size 0-0 line 2896 [ 782.812639] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:40 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xa9, 0x2f) [ 782.861068] binder: BINDER_SET_CONTEXT_MGR already set 02:00:41 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e000900080000000000f0843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 782.881407] binder: 8138:8139 ioctl 40046207 0 returned -16 02:00:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5865}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 782.931428] binder: 8138:8147 got reply transaction with no transaction stack 02:00:41 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, 0x0, 0x0, 0x0) 02:00:41 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xaa, 0x2f) 02:00:41 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000002843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 782.989673] binder: 8138:8147 transaction failed 29201/-71, size 0-0 line 2801 [ 782.992267] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 783.043255] binder_alloc: binder_alloc_mmap_handler: 8138 20001000-20004000 already mapped failed -16 [ 783.122604] binder: BINDER_SET_CONTEXT_MGR already set [ 783.148635] binder: 8138:8139 ioctl 40046207 0 returned -16 [ 783.169744] binder: 8138:8165 got reply transaction with no transaction stack [ 783.183228] binder: 8138:8165 transaction failed 29201/-71, size 0-0 line 2801 [ 783.446416] binder_alloc: binder_alloc_mmap_handler: 8121 20001000-20004000 already mapped failed -16 [ 783.456007] binder: BINDER_SET_CONTEXT_MGR already set [ 783.461293] binder: 8121:8128 ioctl 40046207 0 returned -16 [ 783.461317] binder_alloc: 8121: binder_alloc_buf, no vma [ 783.472865] binder: 8121:8169 transaction failed 29189/-3, size 0-0 line 3035 [ 783.480539] binder: BINDER_SET_CONTEXT_MGR already set [ 783.485938] binder: 8121:8169 ioctl 40046207 20000600 returned -16 02:00:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:41 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0), 0x0, 0x0) 02:00:41 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000004843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:41 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xab, 0x2f) 02:00:41 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40486311}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 783.492425] binder: undelivered TRANSACTION_ERROR: 29189 [ 783.498111] binder: undelivered TRANSACTION_ERROR: 29189 [ 783.538691] binder: 8173:8175 got transaction to context manager from process owning it [ 783.548486] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 783.573901] binder: 8173:8175 transaction failed 29201/-22, size 0-0 line 2887 [ 783.585970] binder: BINDER_SET_CONTEXT_MGR already set 02:00:41 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000008843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:41 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0), 0x0, 0x0) 02:00:41 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xac, 0x2f) 02:00:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6558}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 783.616839] binder: 8182:8183 ioctl 40046207 0 returned -16 [ 783.627231] binder: BINDER_SET_CONTEXT_MGR already set [ 783.651350] binder: 8173:8175 ioctl 40046207 0 returned -16 [ 783.681375] binder: 8182:8185 transaction failed 29189/-22, size 0-0 line 2896 [ 783.703695] binder: 8173:8184 transaction failed 29189/-22, size 0-0 line 2896 02:00:41 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000000000a843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:41 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0), 0x0, 0x0) [ 783.770652] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x40049409, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:42 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper={0x40486312}], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:42 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xad, 0x2f) 02:00:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6800}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:42 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{0x0}], 0x1, 0x0) 02:00:42 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000000000e843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 784.373335] binder_alloc: 8182: binder_alloc_buf, no vma [ 784.379225] binder: undelivered TRANSACTION_ERROR: 29189 [ 784.384741] binder: undelivered TRANSACTION_ERROR: 29189 02:00:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6c00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:42 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e0009000800000000000f843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 784.458186] binder: 8218:8221 got reply transaction with no transaction stack [ 784.498257] binder: BINDER_SET_CONTEXT_MGR already set 02:00:42 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xae, 0x2f) 02:00:42 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{0x0}], 0x1, 0x0) [ 784.525171] binder: 8218:8227 got reply transaction with no transaction stack [ 784.535180] binder: 8223:8225 ioctl 40046207 0 returned -16 [ 784.535477] binder: BINDER_SET_CONTEXT_MGR already set 02:00:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7400}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:42 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000010843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 784.649374] binder_alloc: 8218: binder_alloc_buf, no vma [ 784.659997] binder: 8218:8221 ioctl 40046207 0 returned -16 [ 784.677775] binder_alloc: 8223: binder_alloc_buf, no vma [ 784.725129] binder: undelivered TRANSACTION_ERROR: 29189 [ 784.730865] binder: undelivered TRANSACTION_ERROR: 29189 02:00:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x40086602, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:42 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{0x0}], 0x1, 0x0) 02:00:42 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x3f00, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:42 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xaf, 0x2f) 02:00:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7a00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:42 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000060843a9e986c0872183b", 0x2e}], 0x1}, 0x0) 02:00:43 executing program 2 (fault-call:3 fault-nth:0): r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 784.894540] binder: 8255:8263 ioctl 40086602 20000600 returned -22 [ 784.926038] binder_alloc_mmap_handler: 4 callbacks suppressed [ 784.926056] binder_alloc: binder_alloc_mmap_handler: 8255 20001000-20004000 already mapped failed -16 02:00:43 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0c72183b", 0x2e}], 0x1}, 0x0) [ 784.926799] binder: BINDER_SET_CONTEXT_MGR already set 02:00:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8100}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:43 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xb0, 0x2f) [ 784.977014] FAULT_INJECTION: forcing a failure. [ 784.977014] name failslab, interval 1, probability 0, space 0, times 0 [ 784.997297] binder: 8255:8272 ioctl 40086602 20000600 returned -22 [ 785.006359] binder: 8260:8265 ioctl 40046207 0 returned -16 [ 785.012187] binder: BINDER_SET_CONTEXT_MGR already set [ 785.035647] binder: 8255:8263 ioctl 40046207 0 returned -16 [ 785.056069] CPU: 0 PID: 8269 Comm: syz-executor.2 Not tainted 5.0.0-rc7+ #85 [ 785.063077] binder: release 8255:8263 transaction 368 in, still active [ 785.063299] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 785.070522] binder_alloc: 8255: binder_alloc_buf, no vma [ 785.079293] Call Trace: [ 785.079320] dump_stack+0x172/0x1f0 [ 785.079343] should_fail.cold+0xa/0x1b [ 785.079362] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 785.079378] ? lock_downgrade+0x810/0x810 [ 785.079397] ? ___might_sleep+0x163/0x280 [ 785.079415] __should_failslab+0x121/0x190 [ 785.079434] should_failslab+0x9/0x14 [ 785.079450] kmem_cache_alloc_node_trace+0x270/0x720 [ 785.079468] ? __might_fault+0x12b/0x1e0 [ 785.079489] __kmalloc_node+0x3d/0x70 [ 785.086463] binder: send failed reply for transaction 368 to 8255:8263 [ 785.087509] kvmalloc_node+0x68/0x100 [ 785.087528] ? seq_dentry+0x2d0/0x2d0 [ 785.087545] seq_read+0x832/0x1130 [ 785.093909] binder: undelivered TRANSACTION_COMPLETE [ 785.095056] ? seq_dentry+0x2d0/0x2d0 [ 785.095073] proc_reg_read+0x1fa/0x2c0 [ 785.095111] ? proc_reg_unlocked_ioctl+0x2a0/0x2a0 [ 785.095135] ? rw_verify_area+0x118/0x360 [ 785.105149] binder: undelivered TRANSACTION_ERROR: 29189 [ 785.108514] do_iter_read+0x4a9/0x660 [ 785.108530] ? dup_iter+0x260/0x260 [ 785.108555] vfs_readv+0xf0/0x160 [ 785.185278] ? compat_rw_copy_check_uvector+0x3f0/0x3f0 [ 785.190648] ? kasan_check_read+0x11/0x20 [ 785.194804] ? __fget+0x367/0x540 [ 785.198267] ? iterate_fd+0x360/0x360 [ 785.202072] ? check_preemption_disabled+0x48/0x290 [ 785.207121] ? wait_for_completion+0x440/0x440 [ 785.211710] ? __fget_light+0x1a9/0x230 [ 785.215693] do_preadv+0x1c4/0x280 [ 785.219237] ? do_readv+0x290/0x290 [ 785.222868] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 785.227628] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 785.232387] ? do_syscall_64+0x26/0x610 [ 785.236363] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 785.241725] ? do_syscall_64+0x26/0x610 [ 785.245708] __x64_sys_preadv+0x9a/0xf0 [ 785.249685] do_syscall_64+0x103/0x610 [ 785.253580] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 785.258767] RIP: 0033:0x457e29 [ 785.261965] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 02:00:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xa907}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:43 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0xf}], 0x1}, 0x0) [ 785.280863] RSP: 002b:00007fdb837dcc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 785.288569] RAX: ffffffffffffffda RBX: 00007fdb837dcc90 RCX: 0000000000457e29 [ 785.295834] RDX: 0000000000000001 RSI: 00000000200005c0 RDI: 0000000000000003 [ 785.303113] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 785.310380] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdb837dd6d4 [ 785.317650] R13: 00000000004c4933 R14: 00000000004d8210 R15: 0000000000000006 [ 785.329126] binder_alloc: binder_alloc_mmap_handler: 8260 20001000-20004000 already mapped failed -16 [ 785.437684] binder: undelivered TRANSACTION_ERROR: 29189 02:00:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x40087602, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:43 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x14}], 0x1}, 0x0) 02:00:43 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x1000000, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:43 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xb1, 0x2f) 02:00:43 executing program 2 (fault-call:3 fault-nth:1): r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 785.563287] validate_nla: 6 callbacks suppressed [ 785.563297] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 785.617571] FAULT_INJECTION: forcing a failure. [ 785.617571] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 785.629407] CPU: 0 PID: 8306 Comm: syz-executor.2 Not tainted 5.0.0-rc7+ #85 [ 785.636602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 785.645962] Call Trace: [ 785.645992] dump_stack+0x172/0x1f0 [ 785.646022] should_fail.cold+0xa/0x1b [ 785.656121] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 785.661236] ? mark_held_locks+0x100/0x100 [ 785.661256] ? debug_smp_processor_id+0x1c/0x20 [ 785.661278] should_fail_alloc_page+0x50/0x60 [ 785.661294] __alloc_pages_nodemask+0x1a1/0x710 [ 785.661309] ? find_held_lock+0x35/0x130 [ 785.673988] binder: BINDER_SET_CONTEXT_MGR already set [ 785.674690] ? __alloc_pages_slowpath+0x2900/0x2900 [ 785.693692] cache_grow_begin+0x9c/0x8c0 [ 785.697765] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 785.703309] ? check_preemption_disabled+0x48/0x290 [ 785.703333] kmem_cache_alloc_node_trace+0x658/0x720 [ 785.703351] ? __might_fault+0x12b/0x1e0 [ 785.703373] __kmalloc_node+0x3d/0x70 [ 785.721331] kvmalloc_node+0x68/0x100 [ 785.722895] binder: 8304:8307 ioctl 40046207 0 returned -16 [ 785.725147] ? seq_dentry+0x2d0/0x2d0 [ 785.725165] seq_read+0x832/0x1130 [ 785.725198] ? seq_dentry+0x2d0/0x2d0 [ 785.725215] proc_reg_read+0x1fa/0x2c0 [ 785.725236] ? proc_reg_unlocked_ioctl+0x2a0/0x2a0 [ 785.725256] ? rw_verify_area+0x118/0x360 [ 785.738064] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 785.738285] do_iter_read+0x4a9/0x660 [ 785.744706] binder: send failed reply for transaction 372 to 8304:8311 [ 785.745965] ? dup_iter+0x260/0x260 [ 785.745993] vfs_readv+0xf0/0x160 [ 785.746013] ? compat_rw_copy_check_uvector+0x3f0/0x3f0 [ 785.746032] ? kasan_check_read+0x11/0x20 [ 785.746053] ? __fget+0x367/0x540 [ 785.746070] ? iterate_fd+0x360/0x360 [ 785.746100] ? check_preemption_disabled+0x48/0x290 [ 785.746121] ? wait_for_completion+0x440/0x440 [ 785.746141] ? __fget_light+0x1a9/0x230 [ 785.751080] binder: 8299:8302 ioctl c0306201 20000140 returned -14 02:00:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfeff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:43 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x30}], 0x1}, 0x0) 02:00:43 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xb2, 0x2f) [ 785.755214] do_preadv+0x1c4/0x280 [ 785.755233] ? do_readv+0x290/0x290 [ 785.755249] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 785.755265] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 785.755282] ? do_syscall_64+0x26/0x610 [ 785.766846] binder: 8304:8311 ioctl 40087602 20000600 returned -22 [ 785.773092] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 785.773117] ? do_syscall_64+0x26/0x610 [ 785.773137] __x64_sys_preadv+0x9a/0xf0 [ 785.798969] binder_alloc: binder_alloc_mmap_handler: 8299 20001000-20004000 already mapped failed -16 [ 785.801932] do_syscall_64+0x103/0x610 [ 785.801955] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 785.801970] RIP: 0033:0x457e29 [ 785.828710] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 785.837498] RSP: 002b:00007fdb837dcc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 785.837514] RAX: ffffffffffffffda RBX: 00007fdb837dcc90 RCX: 0000000000457e29 02:00:43 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0xc0}], 0x1}, 0x0) 02:00:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xff0f}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 785.837523] RDX: 0000000000000001 RSI: 00000000200005c0 RDI: 0000000000000003 [ 785.837532] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 785.837542] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdb837dd6d4 [ 785.837550] R13: 00000000004c4933 R14: 00000000004d8210 R15: 0000000000000006 [ 785.868599] binder_alloc: binder_alloc_mmap_handler: 8304 20001000-20004000 already mapped failed -16 02:00:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xb3, 0x2f) [ 785.998753] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 786.012386] binder: 8304:8324 ioctl 40087602 20000600 returned -22 [ 786.046454] binder: undelivered TRANSACTION_COMPLETE 02:00:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x4020940d, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:44 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x223}], 0x1}, 0x0) 02:00:44 executing program 2 (fault-call:3 fault-nth:2): r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:44 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x3f000000, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfffe}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xb4, 0x2f) [ 786.185755] FAULT_INJECTION: forcing a failure. [ 786.185755] name failslab, interval 1, probability 0, space 0, times 0 [ 786.216474] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 786.248804] binder: BINDER_SET_CONTEXT_MGR already set [ 786.255385] CPU: 0 PID: 8337 Comm: syz-executor.2 Not tainted 5.0.0-rc7+ #85 [ 786.262591] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 786.271953] Call Trace: [ 786.274564] dump_stack+0x172/0x1f0 [ 786.278213] should_fail.cold+0xa/0x1b [ 786.282137] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 786.287261] ? lock_downgrade+0x810/0x810 [ 786.291426] ? ___might_sleep+0x163/0x280 [ 786.295588] __should_failslab+0x121/0x190 [ 786.299841] should_failslab+0x9/0x14 [ 786.303661] kmem_cache_alloc_trace+0x2d1/0x760 [ 786.308339] ? kasan_unpoison_shadow+0x35/0x50 [ 786.308359] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 786.308470] rt_acct_proc_show+0x4f/0x370 [ 786.308495] seq_read+0x4db/0x1130 [ 786.318189] ? seq_dentry+0x2d0/0x2d0 [ 786.318206] proc_reg_read+0x1fa/0x2c0 [ 786.318228] ? proc_reg_unlocked_ioctl+0x2a0/0x2a0 [ 786.318248] ? rw_verify_area+0x118/0x360 [ 786.318267] do_iter_read+0x4a9/0x660 [ 786.318283] ? dup_iter+0x260/0x260 [ 786.350109] vfs_readv+0xf0/0x160 [ 786.353591] ? compat_rw_copy_check_uvector+0x3f0/0x3f0 [ 786.358971] ? kasan_check_read+0x11/0x20 [ 786.363147] ? __fget+0x367/0x540 [ 786.366611] ? iterate_fd+0x360/0x360 [ 786.370424] ? check_preemption_disabled+0x48/0x290 [ 786.375456] ? wait_for_completion+0x440/0x440 [ 786.380058] ? __fget_light+0x1a9/0x230 [ 786.384066] do_preadv+0x1c4/0x280 [ 786.387640] ? do_readv+0x290/0x290 [ 786.391281] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 786.396055] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 786.400840] ? do_syscall_64+0x26/0x610 [ 786.404826] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 786.410202] ? do_syscall_64+0x26/0x610 [ 786.410725] binder: 8342:8345 ioctl 40046207 0 returned -16 [ 786.414194] __x64_sys_preadv+0x9a/0xf0 [ 786.414215] do_syscall_64+0x103/0x610 [ 786.414234] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 786.432954] RIP: 0033:0x457e29 02:00:44 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0xec0}], 0x1}, 0x0) 02:00:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xb5, 0x2f) 02:00:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x34000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 786.436156] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 786.455066] RSP: 002b:00007fdb837dcc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 786.457008] binder: send failed reply for transaction 376 to 8342:8349 [ 786.462792] RAX: ffffffffffffffda RBX: 00007fdb837dcc90 RCX: 0000000000457e29 [ 786.462801] RDX: 0000000000000001 RSI: 00000000200005c0 RDI: 0000000000000003 [ 786.462811] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 786.462820] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdb837dd6d4 02:00:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xb6, 0x2f) [ 786.462830] R13: 00000000004c4933 R14: 00000000004d8210 R15: 0000000000000006 [ 786.478686] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 786.496056] binder_alloc: binder_alloc_mmap_handler: 8342 20001000-20004000 already mapped failed -16 02:00:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:44 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x33fe0}], 0x1}, 0x0) [ 786.552867] binder: 8338:8343 ioctl c0306201 20000140 returned -14 [ 786.587415] binder_alloc: binder_alloc_mmap_handler: 8338 20001000-20004000 already mapped failed -16 [ 786.606737] binder: undelivered TRANSACTION_COMPLETE [ 786.623063] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x80086601, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:44 executing program 2 (fault-call:3 fault-nth:3): r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:44 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2000002e}], 0x1}, 0x0) [ 786.659932] binder: BINDER_SET_CONTEXT_MGR already set [ 786.670056] binder: 8338:8343 ioctl 40046207 0 returned -16 [ 786.676769] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:44 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0xfdfdffff, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xb7, 0x2f) 02:00:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x400300}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 786.787395] binder: 8382:8383 ioctl 80086601 20000600 returned -22 [ 786.828202] FAULT_INJECTION: forcing a failure. [ 786.828202] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 786.840041] CPU: 1 PID: 8381 Comm: syz-executor.2 Not tainted 5.0.0-rc7+ #85 [ 786.847237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 786.856603] Call Trace: [ 786.859209] dump_stack+0x172/0x1f0 [ 786.862864] should_fail.cold+0xa/0x1b [ 786.866779] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 786.871907] should_fail_alloc_page+0x50/0x60 [ 786.875133] binder: BINDER_SET_CONTEXT_MGR already set [ 786.876413] __alloc_pages_nodemask+0x1a1/0x710 [ 786.876505] ? percpu_ref_put_many+0x94/0x190 [ 786.876526] ? __alloc_pages_slowpath+0x2900/0x2900 [ 786.881908] binder: 8388:8390 ioctl 40046207 0 returned -16 [ 786.886478] cache_grow_begin+0x9c/0x8c0 [ 786.886496] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 786.886511] ? check_preemption_disabled+0x48/0x290 [ 786.886533] kmem_cache_alloc_trace+0x67f/0x760 [ 786.886550] ? kasan_unpoison_shadow+0x35/0x50 [ 786.894689] binder_alloc: binder_alloc_mmap_handler: 8382 20001000-20004000 already mapped failed -16 [ 786.896060] rt_acct_proc_show+0x4f/0x370 [ 786.896097] seq_read+0x4db/0x1130 [ 786.902019] binder: BINDER_SET_CONTEXT_MGR already set [ 786.905872] ? seq_dentry+0x2d0/0x2d0 [ 786.905890] proc_reg_read+0x1fa/0x2c0 [ 786.905911] ? proc_reg_unlocked_ioctl+0x2a0/0x2a0 [ 786.905932] ? rw_verify_area+0x118/0x360 [ 786.911567] binder: 8382:8383 ioctl 40046207 0 returned -16 [ 786.916473] do_iter_read+0x4a9/0x660 [ 786.916489] ? dup_iter+0x260/0x260 [ 786.916516] vfs_readv+0xf0/0x160 [ 786.916534] ? compat_rw_copy_check_uvector+0x3f0/0x3f0 [ 786.916551] ? kasan_check_read+0x11/0x20 [ 786.921372] binder_alloc: 8382: binder_alloc_buf, no vma [ 786.925789] ? __fget+0x367/0x540 [ 786.925811] ? iterate_fd+0x360/0x360 [ 786.925825] ? check_preemption_disabled+0x48/0x290 [ 786.925844] ? wait_for_completion+0x440/0x440 [ 786.925864] ? __fget_light+0x1a9/0x230 [ 786.935543] binder: 8382:8391 ioctl 80086601 20000600 returned -22 [ 786.939349] do_preadv+0x1c4/0x280 02:00:45 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x7ffff000}], 0x1}, 0x0) [ 786.939369] ? do_readv+0x290/0x290 [ 786.939385] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 786.939401] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 786.939417] ? do_syscall_64+0x26/0x610 [ 786.943297] binder: release 8382:8383 transaction 378 out, still active [ 786.948217] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 786.948233] ? do_syscall_64+0x26/0x610 [ 786.948255] __x64_sys_preadv+0x9a/0xf0 [ 786.948275] do_syscall_64+0x103/0x610 [ 786.948295] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 786.948306] RIP: 0033:0x457e29 02:00:45 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xb8, 0x2f) [ 786.948322] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 786.952245] binder: undelivered TRANSACTION_COMPLETE [ 786.955988] RSP: 002b:00007fdb837dcc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 786.956003] RAX: ffffffffffffffda RBX: 00007fdb837dcc90 RCX: 0000000000457e29 [ 786.956013] RDX: 0000000000000001 RSI: 00000000200005c0 RDI: 0000000000000003 02:00:45 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xb9, 0x2f) 02:00:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0x80087601, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 786.956022] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 786.956032] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdb837dd6d4 [ 786.956042] R13: 00000000004c4933 R14: 00000000004d8210 R15: 0000000000000006 [ 787.056686] binder_release_work: 3 callbacks suppressed [ 787.056692] binder: undelivered TRANSACTION_ERROR: 29189 [ 787.153072] binder: release 8382:8383 transaction 378 in, still active [ 787.170052] binder: send failed reply for transaction 378, target dead 02:00:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0ffff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:45 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0xfffffdef}], 0x1}, 0x0) 02:00:45 executing program 2 (fault-call:3 fault-nth:4): r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 787.186223] binder: 8401:8402 ioctl 80087601 20000600 returned -22 [ 787.217299] binder_alloc: binder_alloc_mmap_handler: 8401 20001000-20004000 already mapped failed -16 [ 787.252466] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 787.260586] binder: BINDER_SET_CONTEXT_MGR already set [ 787.275470] binder: 8401:8402 ioctl 40046207 0 returned -16 [ 787.282559] FAULT_INJECTION: forcing a failure. [ 787.282559] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 787.294372] CPU: 0 PID: 8413 Comm: syz-executor.2 Not tainted 5.0.0-rc7+ #85 [ 787.294386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 787.294396] Call Trace: [ 787.313534] dump_stack+0x172/0x1f0 [ 787.317179] should_fail.cold+0xa/0x1b [ 787.321080] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 787.326215] ? mark_held_locks+0x100/0x100 [ 787.330461] ? debug_smp_processor_id+0x1c/0x20 [ 787.335149] should_fail_alloc_page+0x50/0x60 [ 787.339652] __alloc_pages_nodemask+0x1a1/0x710 [ 787.344329] ? find_held_lock+0x35/0x130 [ 787.344348] ? __alloc_pages_slowpath+0x2900/0x2900 [ 787.344381] cache_grow_begin+0x9c/0x8c0 [ 787.357486] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 787.363039] ? check_preemption_disabled+0x48/0x290 [ 787.368075] kmem_cache_alloc_node_trace+0x658/0x720 [ 787.368106] ? kfree+0x173/0x230 [ 787.368124] ? kvfree+0x61/0x70 [ 787.379874] __kmalloc_node+0x3d/0x70 [ 787.383690] kvmalloc_node+0xbd/0x100 [ 787.387507] seq_read+0x3f2/0x1130 [ 787.391072] ? seq_dentry+0x2d0/0x2d0 [ 787.394899] proc_reg_read+0x1fa/0x2c0 [ 787.394923] ? proc_reg_unlocked_ioctl+0x2a0/0x2a0 [ 787.394944] ? rw_verify_area+0x118/0x360 [ 787.394963] do_iter_read+0x4a9/0x660 [ 787.411697] ? dup_iter+0x260/0x260 [ 787.415224] binder_alloc: 8401: binder_alloc_buf, no vma [ 787.415342] vfs_readv+0xf0/0x160 [ 787.415362] ? compat_rw_copy_check_uvector+0x3f0/0x3f0 [ 787.424260] ? kasan_check_read+0x11/0x20 [ 787.424283] ? __fget+0x367/0x540 [ 787.424303] ? iterate_fd+0x360/0x360 [ 787.437328] binder: 8401:8421 ioctl 80087601 20000600 returned -22 [ 787.441022] ? check_preemption_disabled+0x48/0x290 [ 787.441044] ? wait_for_completion+0x440/0x440 [ 787.441065] ? __fget_light+0x1a9/0x230 [ 787.460945] do_preadv+0x1c4/0x280 [ 787.464508] ? do_readv+0x290/0x290 [ 787.468144] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 787.468162] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 787.468178] ? do_syscall_64+0x26/0x610 [ 787.468196] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 787.477696] ? do_syscall_64+0x26/0x610 [ 787.490981] __x64_sys_preadv+0x9a/0xf0 [ 787.494970] do_syscall_64+0x103/0x610 02:00:45 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x2}, 0x0) 02:00:45 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xba, 0x2f) [ 787.498880] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 787.504078] RIP: 0033:0x457e29 [ 787.504110] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 787.504121] RSP: 002b:00007fdb837dcc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 787.513254] binder: release 8401:8402 transaction 381 out, still active [ 787.526222] RAX: ffffffffffffffda RBX: 00007fdb837dcc90 RCX: 0000000000457e29 [ 787.526231] RDX: 0000000000000001 RSI: 00000000200005c0 RDI: 0000000000000003 [ 787.526240] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 787.526249] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdb837dd6d4 [ 787.526259] R13: 00000000004c4933 R14: 00000000004d8210 R15: 0000000000000006 [ 787.583614] binder: undelivered TRANSACTION_COMPLETE [ 787.595921] binder: undelivered TRANSACTION_ERROR: 29189 [ 787.601538] binder: release 8401:8402 transaction 381 in, still active [ 787.628296] binder: send failed reply for transaction 381, target dead [ 787.673453] binder_alloc: binder_alloc_mmap_handler: 8388 20001000-20004000 already mapped failed -16 02:00:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:45 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xbb, 0x2f) 02:00:45 executing program 2 (fault-call:3 fault-nth:5): r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:45 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x3}, 0x0) 02:00:45 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0xfeffffff, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 787.795780] binder_alloc: binder_alloc_mmap_handler: 8435 20001000-20004000 already mapped failed -16 [ 787.812888] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 787.826067] FAULT_INJECTION: forcing a failure. [ 787.826067] name failslab, interval 1, probability 0, space 0, times 0 [ 787.843668] binder: BINDER_SET_CONTEXT_MGR already set [ 787.855383] CPU: 0 PID: 8447 Comm: syz-executor.2 Not tainted 5.0.0-rc7+ #85 [ 787.862599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 787.871952] Call Trace: [ 787.874561] dump_stack+0x172/0x1f0 [ 787.878208] should_fail.cold+0xa/0x1b [ 787.882131] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 787.887246] ? lock_downgrade+0x810/0x810 [ 787.891411] ? ___might_sleep+0x163/0x280 [ 787.895573] __should_failslab+0x121/0x190 [ 787.899824] should_failslab+0x9/0x14 [ 787.903641] kmem_cache_alloc_trace+0x2d1/0x760 [ 787.908321] ? kasan_unpoison_shadow+0x35/0x50 [ 787.912918] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 787.918041] rt_acct_proc_show+0x4f/0x370 [ 787.922209] seq_read+0x4db/0x1130 [ 787.925777] ? seq_dentry+0x2d0/0x2d0 [ 787.929593] proc_reg_read+0x1fa/0x2c0 [ 787.933498] ? proc_reg_unlocked_ioctl+0x2a0/0x2a0 [ 787.938446] ? rw_verify_area+0x118/0x360 [ 787.942611] do_iter_read+0x4a9/0x660 [ 787.946426] ? dup_iter+0x260/0x260 [ 787.950073] vfs_readv+0xf0/0x160 [ 787.953557] ? compat_rw_copy_check_uvector+0x3f0/0x3f0 [ 787.958930] ? kasan_check_read+0x11/0x20 [ 787.963107] ? __fget+0x367/0x540 [ 787.966574] ? iterate_fd+0x360/0x360 [ 787.970388] ? check_preemption_disabled+0x48/0x290 [ 787.975901] ? wait_for_completion+0x440/0x440 [ 787.980503] ? __fget_light+0x1a9/0x230 [ 787.984493] do_preadv+0x1c4/0x280 [ 787.988045] ? do_readv+0x290/0x290 [ 787.991682] ? trace_hardirqs_on_thunk+0x1a/0x1c 02:00:46 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x8}, 0x0) 02:00:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xbc, 0x2f) 02:00:46 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x300}, 0x0) 02:00:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xbd, 0x2f) [ 787.996448] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 788.001216] ? do_syscall_64+0x26/0x610 [ 788.005206] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 788.010577] ? do_syscall_64+0x26/0x610 [ 788.014568] __x64_sys_preadv+0x9a/0xf0 [ 788.018554] do_syscall_64+0x103/0x610 [ 788.022457] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 788.027644] RIP: 0033:0x457e29 02:00:46 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0xffffff1f}, 0x0) [ 788.027661] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 788.027669] RSP: 002b:00007fdb837dcc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 788.027684] RAX: ffffffffffffffda RBX: 00007fdb837dcc90 RCX: 0000000000457e29 [ 788.027693] RDX: 0000000000000001 RSI: 00000000200005c0 RDI: 0000000000000003 [ 788.027702] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 788.027711] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdb837dd6d4 [ 788.027721] R13: 00000000004c4933 R14: 00000000004d8210 R15: 0000000000000006 02:00:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xbe, 0x2f) 02:00:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 788.095302] binder: 8435:8436 ioctl 40046207 0 returned -16 [ 788.101427] binder: release 8435:8436 transaction 385 in, still active [ 788.109200] binder_alloc: 8435: binder_alloc_buf, no vma [ 788.114690] binder_transaction: 9 callbacks suppressed [ 788.114708] binder: 8435:8455 transaction failed 29189/-3, size 0-0 line 3035 [ 788.132373] binder: send failed reply for transaction 385 to 8435:8436 [ 788.148491] binder: undelivered TRANSACTION_COMPLETE [ 788.172734] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 788.185516] binder: undelivered TRANSACTION_ERROR: 29189 02:00:46 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0xfffffdfd, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 788.227936] binder: undelivered TRANSACTION_ERROR: 29189 02:00:46 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x2}, 0x0) 02:00:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:46 executing program 2 (fault-call:3 fault-nth:6): r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xbf, 0x2f) 02:00:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 788.404330] binder: BINDER_SET_CONTEXT_MGR already set [ 788.424772] binder: 8489:8496 ioctl 40046207 0 returned -16 [ 788.444339] binder: send failed reply for transaction 389 to 8489:8496 02:00:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:46 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x4}, 0x0) [ 788.454059] binder: 8484:8490 ioctl c0306201 20000140 returned -14 [ 788.465985] binder: BINDER_SET_CONTEXT_MGR already set [ 788.471295] binder: 8484:8490 ioctl 40046207 0 returned -16 02:00:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xc0, 0x2f) 02:00:46 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:46 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0xfffffffe, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:46 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x8}, 0x0) 02:00:46 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xc1, 0x2f) 02:00:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:47 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0x200002bf}], 0x1, 0x0) 02:00:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:47 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xa}, 0x0) 02:00:47 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xc2, 0x2f) [ 789.163303] binder: BINDER_SET_CONTEXT_MGR already set [ 789.168783] binder: 8489:8505 ioctl 40046207 0 returned -16 [ 789.168958] binder: send failed reply for transaction 391 to 8489:8541 [ 789.179805] binder: undelivered TRANSACTION_COMPLETE [ 789.187777] binder: 8529:8532 ioctl c0306201 20000140 returned -14 [ 789.187998] binder: undelivered TRANSACTION_ERROR: 29201 [ 789.202205] binder: undelivered TRANSACTION_COMPLETE [ 789.207765] binder: undelivered TRANSACTION_ERROR: 29201 02:00:47 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x100000000000000, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:47 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xe}, 0x0) 02:00:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:47 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xc3, 0x2f) [ 789.334253] binder: BINDER_SET_CONTEXT_MGR already set 02:00:47 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0x7ffff000}], 0x1, 0x0) [ 789.386372] binder: 8552:8558 ioctl 40046207 0 returned -16 [ 789.413714] binder: BINDER_SET_CONTEXT_MGR already set [ 789.424794] binder_alloc: 8552: binder_alloc_buf, no vma [ 789.432654] binder: 8556:8557 ioctl 40046207 0 returned -16 [ 789.455798] binder: release 8552:8558 transaction 393 out, still active [ 789.468546] binder: 8552:8559 transaction failed 29189/-3, size 0-0 line 3035 [ 789.477247] binder: undelivered TRANSACTION_COMPLETE 02:00:47 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xf}, 0x0) 02:00:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 789.484820] binder: BINDER_SET_CONTEXT_MGR already set [ 789.499268] binder: 8556:8566 ioctl 40046207 0 returned -16 [ 789.505411] binder: release 8552:8558 transaction 393 in, still active 02:00:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc018620b, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:47 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xc4, 0x2f) [ 789.542857] binder: send failed reply for transaction 393, target dead [ 789.582966] binder: undelivered TRANSACTION_ERROR: 29189 02:00:47 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x3f00000000000000, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:47 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x2, 0x0) [ 789.699463] binder: BINDER_SET_CONTEXT_MGR already set [ 789.720310] binder: 8584:8592 ioctl 40046207 0 returned -16 [ 789.738477] binder_alloc: 8584: binder_alloc_buf, no vma 02:00:47 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x10}, 0x0) 02:00:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xa000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 789.751222] binder: BINDER_SET_CONTEXT_MGR already set [ 789.756112] binder: 8584:8593 transaction failed 29189/-3, size 0-0 line 3035 02:00:47 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xc5, 0x2f) [ 789.803903] binder: 8591:8595 ioctl 40046207 0 returned -16 [ 789.814769] binder: release 8584:8590 transaction 396 out, still active [ 789.829420] binder: undelivered TRANSACTION_COMPLETE 02:00:47 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x8, 0x0) 02:00:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc018620c, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 789.850022] binder: undelivered TRANSACTION_ERROR: 29189 [ 789.853580] binder: BINDER_SET_CONTEXT_MGR already set [ 789.869351] binder: 8591:8604 ioctl 40046207 0 returned -16 [ 789.891429] binder: release 8584:8590 transaction 396 in, still active 02:00:48 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x60}, 0x0) [ 789.925676] binder: send failed reply for transaction 396, target dead 02:00:48 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0xfdfdffff00000000, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xc000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 789.989537] binder: 8615 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 789.989551] binder: 8615:8616 ioctl c018620c 20000600 returned -22 02:00:48 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xc6, 0x2f) 02:00:48 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x300, 0x0) [ 790.050890] binder_alloc_mmap_handler: 7 callbacks suppressed [ 790.050907] binder_alloc: binder_alloc_mmap_handler: 8615 20001000-20004000 already mapped failed -16 [ 790.081745] binder: BINDER_SET_CONTEXT_MGR already set 02:00:48 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xf0}, 0x0) [ 790.105699] binder: 8623:8627 ioctl 40046207 0 returned -16 [ 790.128554] binder: BINDER_SET_CONTEXT_MGR already set [ 790.142376] binder_alloc: binder_alloc_mmap_handler: 8623 20001000-20004000 already mapped failed -16 [ 790.172668] binder: 8615:8616 ioctl 40046207 0 returned -16 [ 790.179455] binder_alloc: 8615: binder_alloc_buf, no vma [ 790.196024] binder: BINDER_SET_CONTEXT_MGR already set 02:00:48 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xc7, 0x2f) [ 790.224637] binder: 8615 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 790.224652] binder: 8615:8626 ioctl c018620c 20000600 returned -22 [ 790.238059] binder: 8623:8627 ioctl 40046207 0 returned -16 [ 790.244832] binder: 8615:8638 transaction failed 29189/-3, size 0-0 line 3035 [ 790.267853] binder: release 8615:8616 transaction 399 out, still active 02:00:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xe000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:48 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xa00}, 0x0) 02:00:48 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0xf000, 0x0) [ 790.275945] binder: undelivered TRANSACTION_COMPLETE [ 790.289205] binder: release 8615:8616 transaction 399 in, still active [ 790.306889] binder: send failed reply for transaction 399, target dead [ 790.330031] binder: undelivered TRANSACTION_ERROR: 29189 02:00:48 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0xfeffffff00000000, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0189436, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:48 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0xfffff000, 0x0) 02:00:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 790.490051] binder: BINDER_SET_CONTEXT_MGR already set [ 790.504609] binder: 8663:8665 ioctl 40046207 0 returned -16 02:00:48 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xd7d}, 0x0) 02:00:48 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xc8, 0x2f) [ 790.536527] binder: send failed reply for transaction 402 to 8663:8668 [ 790.554542] binder: 8660:8664 ioctl c0306201 20000140 returned -14 [ 790.599200] validate_nla: 10 callbacks suppressed [ 790.599209] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 790.611829] binder_alloc: binder_alloc_mmap_handler: 8660 20001000-20004000 already mapped failed -16 02:00:48 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xe00}, 0x0) [ 790.646069] binder: BINDER_SET_CONTEXT_MGR already set [ 790.655579] binder: 8660:8664 ioctl 40046207 0 returned -16 02:00:48 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0xffffff1f, 0x0) 02:00:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:48 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1811"}) 02:00:48 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xc9, 0x2f) 02:00:48 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xec0}, 0x0) 02:00:49 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0xfffffffffffff000, 0x0) [ 790.851877] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 791.280856] binder_alloc: binder_alloc_mmap_handler: 8663 20001000-20004000 already mapped failed -16 [ 791.290638] binder: BINDER_SET_CONTEXT_MGR already set [ 791.296191] binder: 8663:8668 ioctl 40046207 0 returned -16 [ 791.296654] binder_alloc: binder_alloc_mmap_handler: 8691 20001000-20004000 already mapped failed -16 [ 791.303991] binder: undelivered TRANSACTION_COMPLETE [ 791.312172] binder: BINDER_SET_CONTEXT_MGR already set [ 791.324183] binder: undelivered TRANSACTION_ERROR: 29201 02:00:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc020660b, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:49 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xca, 0x2f) 02:00:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:49 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xf00}, 0x0) 02:00:49 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x2) [ 791.330073] binder: 8691:8696 ioctl 40046207 0 returned -16 02:00:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000002c0)={&(0x7f0000003000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000005000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff2000/0xd000)=nil, &(0x7f0000000500)="0b84e5c0ec58e35e4b6f69eb6aca9696694c8a27b6378e69bf895d92d72a4c1ae5fdfec5b7ec224e4bdcb584a9ec8047a18ecd57f00f36074bf92d1abd99ed584ed8a0bb004c24f828f4305aac86a9136baabef07208b3e4c409ecfddd195f930568fb9fd177fbd5db245aa3952a8c1f32b04302aede5a9b49e59ee47e1acfef1f29c472bce7bceecd50bce61647b1c6cbd666ddf9c3226eebc01e6fa737d4d906323eca8793f49de503dbf490cd974b5b0b808c24138e208602a9b10252162abda86f037c632d7a35df6b81249dbf0123dae08392aed5c1042e1ebedbddc70dda4283f273dd0263e30f52481039219105a0a2a3babc1741ded18cc3e272b14fa6b44f994b5ebe54439cac5d7b712e30b690a6eaae96211155d51030b7bd74825ac97347d128ea39a27f24debfdc53b068867bf6c03114a5ab0740466a3b47b4e3ae95c0e9a04fdc50bad16f87a951611970c6fc29a5c02458ad7dc434c7626c11095892a3c9445de99864c14c5fdf1539c3342b790d30f7ae29e0af0c2629e7c043940e0b141eeef2b13f38ed24679576a90426409db69f824e8a79eb5d9ef7edb92b6de9d97e4df51e1ff302d88684f5ac79ed5b5cbc240d99789280b43ef7b4f967229edbd339d7c41593d739e4826bd81394133cddc331ec5bdf7a050d793c9809e583751d7285c5477ba5327bc4089e533f3fe777158d38523356c47e319921994c56f697bd1dfbc970940bb9aab6327f128067a39216ce8fcc26fa0644318bd16b18f7ef069625fb68b689f4cc9233989360baaf12b6d427ef483262715120ae942dd23f988f449eb2137a1aa60edaf7e4a0053e24311987612e978a5ce6fe30b3550c040c93c198e88fca5ecbb89c300ec9323304e6462b3cec9879c4123889eb179b5b7cd463ad8a9c8c6ecb768e9a851d421c69e720cbfcd2db7cb56d166504736496df94b3a8370094710aa1acaa9d759cbd4256e11cfd0c626b8bedf14c4a6557319748683c0ebc0cd370a7f8fb1501f9761d1e76a994ada72904ac304bd07bd02bab13eed272262cccd84fa27503a9a5e40832a435eeb27a0c82f64769dad334855d18692ce300ee0fda3d1aaebd60e4161dbfc7adcbc2ab3576532535fc75ade1d872814fb469e5fc2a1e120f641aedb8f335b5e3d7457d96ce0e15260b71621d9221091c38296ac36811f4c4685045131e691c078125c4c9c05a5d7442425f5982c1dd7603d35cc740ed8de8df4a761d5ae1a3f24fa5034cb8952be30237b46cd5830b24eb193f49e24a8d2e4a1c2b41078314a918c5e340527a0b4f84256d1e6c24b99053a6243c962633138eaa3389ee8c1177ddfe62008214fa3e4d67baf9a6dbbaa3685ceb78a54f211cc558954fdfc029184935e6f494b33b06072a1fe769ce5eae97b8143c9fadb0578c6e316faef99d67becfc523b9927a0f5fdc27f3d927529738c638fe022f7034c5368f5993f691fbac973ee5c4d4a43d4c98331dede2d55a8505a72ea14f67b94939537112c5ce60cab9765f38c228f892da38603eb97c308909c1429e6c625566f3e877aacb743c73fda89b5c8aaa411a5ee802311a328c9c8dde6f7ff2da6ff5a9e6f1705051a99cfddaa0f9ccbff901d6397cb47fdd0ca8d999d0dfeb2dbf44bce6c623aaabfa6d1d7bb09b03f8215c1c5cc3d04b22c6bd92e08a4e2d71efef8a63915086ab1abeeb3181239556e6699aaf3f1cb025f906a75c2db81e4509077f9bbfe0ed06f78f01d6b08addd90c3361b41223436eb3b4d5a3b26a234ec124494689cf8a9a5b817235caa9b612b5caf004100361a2d5675240cfc5653c1885fb9a6a49ba434fa39a32c4ebf37bbb9a1d6727a1fb33a0b8b96baf8cbccfba3e450f513c638b69082c2fabdad29b37341965ff8400984086f6854faeda382ba138be4193e2ef6ae303164339e5d63c289a79459013f7573d620c83d8773867a1fe7506c1f9c8fe4f48c355c2a428d7e5a38abf63f1a0051382f904bf0bdc2313ef8f2db16962b451266f67dff4123930a7d979e82cc7e424d7e0e4c290c76172a1307b2ced53a4eb825ba0e4aca1b4324ee3e6532dfcaeee1ab2726eb07d3631dfb80921c0a2749f0af414c3e4024740bceb7042eb11f110cf4bb8fb180c24295fa2bb9637ec86799816f52c7572d3e69168b3ae881aed01a5afccf0ddc9a05ffe79f39d15d97fd3c953c3e4bfa48a8040f54145045eacac8f12d7140c0f4113306c47e8cb147cd59eadff63c8c3d7e55e2d78209a1222221c69ce588b2928a6668913f9226856104b193fe129ea9708c82b9768e57a27311c021873a91a9b73b7f30c3c220fa4ef7c47d1577db48400d51c62e996544d04f67664a5295e711038149d8432526abe8ae132c6e7036efd4c4fcee72d9aecbe13680dd34149792d181f84445d693be1cd733d6f6cd2e1c05ba462965f79f031caf1da93bf1b965e183f5436a4d799acc8bbab3e2ea97f0d6a5c6d89ffcd4b4d38dad300f1a3470326820e1beee67f0f8c7fe6bbf43a694186227207b8fea918592265229e65615d4a23b83959a3d8d83227d26147c4323b0f3e96a3c20fdf2730f70ce229c9ac091bffd52e4cfcedad82409db5ee1943a2c842908a567fc85279501723b189e7212ce8fc02baf5939458e713846b40f419aa778c759bf7cfa9511bdfa51e427092a2337552ac351dc263e0ed0bee65b4b8dbdf95086fc2c75d5a2bd48d2738f3ca102758c674005c7933a151374161938a7538999e1d72d96044d9900dfe13a4a7bc8de3b0d6987defd556a1f3aa7e7114a65eb0983cb4a79dee504cb4a7d473e03562665b5e5ec839f420b47fbb96013ae9d7a345d6a9eb1ba6cc7ab71b51bd6e9c970ed7ecb31e71bd9fb9c8132ad3eedd9f6a3be2d30a56ef7141778356ad0a72014f605b5cea2b73fa0711c45298b0413076e6360891f28ba49582df7ef512f4185f574637aee91c45bbf0e4700968f58c42c1403e0cbcf93b3cb6c21242a24483d8c777ddf960696e7d8d958570798ae096841da8f7394424d8f04e0ba0f2939e14a24f1bcb99fd14ff9f49a8c3b087e4787ab058e1add53bf5fa1b3079e52522c7611cec98660b5a8e9c51fe1d52f78947f3d8972379e202fadc616a07fa148931bb067482257a84bbbaf8961c6dd353f5c82bfec999f1edca4b0e45f12908b39ad2a7e0a423e4bfa7ca692cd549fc984bfcafab62bfb059c6dedd2ca63a4e865cd598406875fdd89262ba894f09be6a7e3c71d87131dacb73fb118c58ec0d61e3c8a51eb4d7ca2ce0ae49651608afd497aed94c8eb51d4e8dc62d5bb1b0f095671abed0b459ad37e3c42c5e8b606f61a25f249185e6c4f045ac942c742fea04a830a7bf4d983ce0f730f02b54c9c4b78b91c620f65383ce911bf2f7e2bb9d4219f027f5812a60168520b58147af302942d7b12e43fc9109f62968f5b2deaf5d12c5769e0664ed72f0e3135ed34127b5ad1ee0e53e11b7237d3f26381f4a3af48c01e86c2c7b61f686651d5583b271a0ffccb3d61dd4405a29dafc6829bfa049a6a1fe49c02d7adff9b8b1c3fecc089dbb0a956f3efe4eb84dce025df6e570555ec0fd0b2596600191084071b71c72e725794871a1ad4f8de591755f310b96a11b55d4eec847887cbf1d7983a0fe4bbdf9207c4cbba32816e18782bd454b6a152ff50ca28583d5d1cd485d2e959a8894db3dc4aaeb5a2628effe15eacd27f77d388e12430342867eb859d7681a51cf55408a03b2163d0a7e577a869d36c6ca1317e6eeb04c6a4d8ae0566e8aa724eb132950f8b9e80ccff699649eaa943bc79081880e60185f414cfadb99715ea86bf11e5304825affa02929b3f5560017c5ff7c24fbd946a88034b012c496b2aa2ad079a9a9dfa5709f39e6d571bd48165186434ee87f6f1be840f97383c019b1a319c357fae0f695686fda14e92aa823efcfffd8f62dd54a58dc559ecd20afee6eb7483657208507985bdef272476bcba6a3a32bedcb961c310b47dd2792cc055f8c6a46539e88ba3452c7cd626aaca8b2e690a100216fa063cfe04ab3570642e3b612dfa16f6135dc9cb0ab750468e421e569737e2c20e933b98aa98865f38b9276b9aa678475dd0df979cae52f5528b3b31de5a9b88ae069ea2ca1df9da6e59a62c2f1327c6569b8da510db11f3b98b9532ee820ad139544b2bac5c3290a039c6aefa51a9347dc5087f88e070ea148ac1322c512521b97e0985a19de491fc5cf50914345f12dc9761150a309a7514fec44c1a19e2b09058625599c56b96c7940935ef57c2b7b0024df696169359ec80eb6df3af50045e4085952ed73bc6bcfd89ceee0bd353f8c6dd61c7bd7ed6ae9e3fab931a2849ce6fd1fc1fb48f5fadd6ca56f57010b9fd7765ae6444651516d4e052d688f14cb02992e0b79906037b4466ef026113f1fbe59b19ee3a7aa3c7697427610ebc606c2366da4f01d2c20dacc465eb2e520d97077184a0008ba718a2caecc8e982fcbfd59cc17f34d862ea0e6add39a31655cb2f74b72af5e25e911faca58cf93b8ff3b3b8623ae3b47bac42c9590f2930c0839bd33b1d0b090510280d5f802e81dd5ce5a09e0cff6225f719eed9e2678298f25153713e1b71410ead9e7377ff4925b7a535668be2eb1cb3d631694b95a8638d9fc208af747eaf43409c11c6c55948bbd4d1fbb03d3c7de0aba2c09e3bd4f00e50e310c484473d431cf55c1e9b903ddbfc01ee8e1128a9795ba5ca3631148f53c1fe4f432b9900b4c64aff458d7712688186fce69045f02f487125c274986a934717343f4a3398326844646e754e689789bae506b045699ab2ee078ce3070ce9e1e1560163789f8c77d70724c7d7c3c0a7bbff67292d5bfd01696f51f2d21e90050219a795dfa2fe086764fd4bba105c082d79525066467ccc70daaf93ef5eddcd7eb3298b2a42cdca996090f1eb3f63bf248dd3a36a31be4793a7f5f875dfae3c7d3d3c6ff4b4a1324bcd247df020af91042d8f37e5efaaa4c9bd86afb5afc1455a46419de6949859091ffb5666e1c7c8bb7e64d2151ed919ef96637009d71db4445adc31175108b1dddf21c35d9e7e07e684bea926439a381609807dbe6cd54d111c1f28963d984d97bfd428e1a4e7c6279804aec25094be0c2a5718352724b6882d1379fa32810ab664c52288e6ab28dc461b6b10f085cc37326041c9373f74fb72a28596f407ca5e7111b52cd57ccbddf11a80b3266646cedc873571d54b26562033cc3e3430ed644fe8533f923832e5c9a2ada95af764e779d6013db605e7120bb3dd043dbff0f3d1d95bf45b8244a7cdb4fc5d37ef8220748ee2ff8236d533d48e6f4a72e489245c9188f535b54b0dec7214d2dec31c1f75604ac3bb5014482f13718676ff575a46b6c22fb95379a7853a061992e751a218392c26fa7dab03d8796de72546e6797fc4e54d56bcbe42515a4e671e6ae78bb036a45c4fefc17914a02ffa24f128bb8e08c99376120ab39cff0a454a13c9b6e3558c9c6f34a9cec71c734e05a130cfd2ffb060e10bf6a2385a5fe7dade23db44a0aa2287479e4990da62a8540d8b1845cdf08fa52341537993cb2f004fbd8494a2263470976b1b112ca39177ecb1461459fe47ea56d2233cb089bc5d8ca21336c480bdd2d95f771513d645ebb33bc955ef1469c54fb0dc18cbf9469ee09e0870b4e068ee3d63aaa9213d8bd9afc699454c66b6b029f2c4aafdabcb47844de8765f6397953ac754a58241b7c0e73a810cb12a6b2fb37d9daa8f7", 0x1000, r0}, 0x68) r2 = syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x7ff, 0x10000) ioctl$VIDIOC_G_CTRL(r2, 0xc008561b, &(0x7f0000000380)={0x9, 0x4d5}) ioctl$TUNSETNOCSUM(r2, 0x400454c8, 0x1) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) sendmsg$key(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="02090000210000002abd7000fedbdf251d001800017fde0038a5c75894afe26f20d5852204edaac82ef68aa1c7cb52a9ecc36026bda971b3ab38bf9a812d0428644da07ef7fa7927835dbb6390e5925a349c0c06f292af3fa6486fd8416decb874c021ee5b6da574005f848993da1adbc2fe9dadd3b2563ca904d45bd44f81c6b5a6becb2fd93cb8fbd84dbc556890ff5aa111e4ca0966409357675a9909a54dc58689da61cde0cfe293803abd0547574526ee54070bdfba2a86335fd493304eaf1ba647ae90d4293070b374b68c247160689d5ca211b6c0aab63e13e92637916b411b6b2410c07a9500010000000000003b742f04ff000002001000000004d5000004d600000000"], 0x108}}, 0x80) ioctl$EVIOCGBITSW(r3, 0x80404525, &(0x7f0000000340)=""/17) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 791.372738] binder: release 8691:8696 transaction 404 in, still active [ 791.382440] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 791.409559] binder: send failed reply for transaction 404 to 8663:8710 02:00:49 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xcb, 0x2f) [ 791.437871] binder: undelivered TRANSACTION_COMPLETE 02:00:49 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x3f00}, 0x0) 02:00:49 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x8) 02:00:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 791.471683] binder_alloc: binder_alloc_mmap_handler: 8724 20001000-20004000 already mapped failed -16 [ 791.516721] binder: BINDER_SET_CONTEXT_MGR already set [ 791.541987] binder: BINDER_SET_CONTEXT_MGR already set [ 791.560934] binder: 8724:8725 ioctl 40046207 0 returned -16 [ 791.584942] binder: 8728:8733 ioctl 40046207 0 returned -16 [ 791.592786] binder_alloc: 8724: binder_alloc_buf, no vma [ 791.603033] binder_alloc: binder_alloc_mmap_handler: 8728 20001000-20004000 already mapped failed -16 [ 791.618785] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 791.623718] binder: 8724:8738 transaction failed 29189/-3, size 0-0 line 3035 02:00:49 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xcc, 0x2f) [ 791.627901] binder: release 8724:8725 transaction 406 in, still active 02:00:49 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x10) [ 791.664471] binder: send failed reply for transaction 406 to 8724:8725 [ 791.704298] binder: undelivered TRANSACTION_COMPLETE 02:00:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306202, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:49 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x6000}, 0x0) 02:00:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) timerfd_settime(r2, 0x1, &(0x7f00000000c0)={{r3, r4+10000000}}, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c610001"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x48000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:49 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xcd, 0x2f) [ 791.857044] binder: 8758:8760 ioctl c0306202 20000600 returned -22 02:00:50 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x7d0d}, 0x0) 02:00:50 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x4000) [ 791.900327] binder: BINDER_SET_CONTEXT_MGR already set [ 791.911019] binder_alloc: binder_alloc_mmap_handler: 8758 20001000-20004000 already mapped failed -16 [ 791.923990] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 791.955712] binder: 8761:8768 ioctl 40046207 0 returned -16 [ 791.961494] binder: BINDER_SET_CONTEXT_MGR already set [ 791.972470] binder: 8761:8768 unknown command 16802060 [ 791.976376] binder: 8758:8760 ioctl 40046207 0 returned -16 [ 791.978108] binder: 8758:8776 ioctl c0306202 20000600 returned -22 02:00:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4c000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:50 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xce, 0x2f) [ 792.020005] binder: 8761:8768 ioctl c0306201 20000140 returned -22 [ 792.036361] binder: release 8758:8760 transaction 410 out, still active [ 792.043153] binder: undelivered TRANSACTION_COMPLETE [ 792.049065] binder_alloc: 8758: binder_alloc_buf, no vma [ 792.052929] binder_alloc: binder_alloc_mmap_handler: 8761 20001000-20004000 already mapped failed -16 [ 792.054573] binder: 8758:8769 transaction failed 29189/-3, size 0-0 line 3035 [ 792.081912] binder: BINDER_SET_CONTEXT_MGR already set 02:00:50 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xc00e}, 0x0) [ 792.116507] binder: 8761:8768 ioctl 40046207 0 returned -16 [ 792.116558] binder_release_work: 3 callbacks suppressed [ 792.116565] binder: undelivered TRANSACTION_ERROR: 29189 [ 792.139143] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 792.150596] binder: release 8758:8760 transaction 410 in, still active 02:00:50 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x1000000) 02:00:50 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xcf, 0x2f) 02:00:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc030620a, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 792.170066] binder: send failed reply for transaction 410, target dead 02:00:50 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x40, 0x0) ioctl$IMADDTIMER(r1, 0x80044940, &(0x7f00000000c0)=0x32) ioctl$PPPIOCSDEBUG(r1, 0x40047440, &(0x7f0000000040)=0x100000000) getsockopt$IP_VS_SO_GET_SERVICES(r1, 0x0, 0x482, &(0x7f0000000500)=""/4096, &(0x7f0000000100)=0x1000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000180)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\b\x00\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 792.293206] binder: 8799:8803 ioctl c030620a 20000600 returned -22 [ 792.347272] binder: BINDER_SET_CONTEXT_MGR already set 02:00:50 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xd0, 0x2f) 02:00:50 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xf000}, 0x0) [ 792.372870] binder_alloc: binder_alloc_mmap_handler: 8799 20001000-20004000 already mapped failed -16 [ 792.383768] binder: 8805:8806 ioctl 40046207 0 returned -16 [ 792.396899] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 792.412610] binder: BINDER_SET_CONTEXT_MGR already set 02:00:50 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x2000000) [ 792.424745] binder: 8805:8806 unknown command 2048 [ 792.434715] binder: 8799:8803 ioctl 40046207 0 returned -16 [ 792.462057] binder: 8805:8806 ioctl c0306201 20000140 returned -22 [ 792.464199] binder_alloc: 8799: binder_alloc_buf, no vma 02:00:50 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xd1, 0x2f) [ 792.497189] binder: BINDER_SET_CONTEXT_MGR already set [ 792.511783] binder: 8799:8811 transaction failed 29189/-3, size 0-0 line 3035 [ 792.515910] binder: 8805:8816 ioctl 40046207 0 returned -16 [ 792.519231] binder: release 8799:8803 transaction 413 out, still active 02:00:50 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x34000}, 0x0) [ 792.552696] binder: undelivered TRANSACTION_COMPLETE 02:00:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x65580000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 792.573226] binder: undelivered TRANSACTION_ERROR: 29189 02:00:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306212, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:50 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r1 = accept4(0xffffffffffffff9c, &(0x7f0000000000)=@isdn, &(0x7f00000000c0)=0x80, 0x80800) setsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000100)=0x4, 0x4) 02:00:50 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x8000000) [ 792.627410] binder: release 8799:8803 transaction 413 in, still active [ 792.657109] binder: send failed reply for transaction 413, target dead 02:00:50 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xd2, 0x2f) [ 792.714277] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:50 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x400300}, 0x0) [ 792.762743] binder: 8842:8845 unknown command 0 [ 792.777307] binder: BINDER_SET_CONTEXT_MGR already set [ 792.787273] binder: 8842:8845 ioctl c0306201 20000140 returned -22 [ 792.814085] binder: 8841:8846 ioctl 40046207 0 returned -16 [ 792.814593] binder: BINDER_SET_CONTEXT_MGR already set [ 792.852380] binder: 8842:8850 unknown command 0 02:00:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x68000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:50 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x10000000) [ 792.863299] binder: 8842:8850 ioctl c0306201 20000140 returned -22 02:00:51 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xf0ffff}, 0x0) 02:00:51 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xd3, 0x2f) [ 792.913575] binder_alloc: 8842: binder_alloc_buf, no vma [ 792.932162] binder: 8842:8845 ioctl 40046207 0 returned -16 02:00:51 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x80400, 0x0) accept4$tipc(r1, &(0x7f0000000040)=@name, &(0x7f00000000c0)=0x10, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000100)) ioctl$NBD_CLEAR_SOCK(r1, 0xab04) write$nbd(r1, &(0x7f0000000180)={0x67446698, 0x1, 0x2, 0x3, 0x3, "6ae75aa614377c7827bd4aef745467ff51888d456c0303c2a376d7eea9db4c739cd532d0bddd3c1406a625d40b53c8168cb6c50a37692ed0ec2a892d409ccd39223996cae382f52518771cf2f4f35a4dd99275feaff34836b77b42011e2fe353abe1298060cb816ebbecd2f16ecb7c12f49474bef02d331a7ecc9d0951488645301fddac2071796838ff2ab319b36b8bf4b6504f0a56cfd4f5"}, 0xa9) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 792.956396] binder: 8841:8854 transaction failed 29189/-3, size 0-0 line 3035 [ 792.976690] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 792.998602] binder: 8841:8863 ioctl c0306212 20000600 returned -22 02:00:51 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x40000000) 02:00:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6c000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 793.186787] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306225, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:51 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x1000000}, 0x0) 02:00:51 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xd4, 0x2f) 02:00:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x74000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:51 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x100000000000000) [ 793.570385] binder: BINDER_SET_CONTEXT_MGR already set [ 793.575894] binder: 8841:8863 ioctl 40046207 0 returned -16 [ 793.576124] binder: 8841:8888 ioctl c0306212 20000600 returned -22 [ 793.582638] binder: BINDER_SET_CONTEXT_MGR already set [ 793.594017] binder: 8876:8878 ioctl 40046207 0 returned -16 [ 793.594142] binder: undelivered TRANSACTION_ERROR: 29189 02:00:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) munlock(&(0x7f0000000000/0x4000)=nil, 0x4000) [ 793.641994] binder: release 8876:8878 transaction 418 in, still active [ 793.662792] binder: send failed reply for transaction 418 to 8841:8888 02:00:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7a000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 793.702007] binder: undelivered TRANSACTION_COMPLETE [ 793.716746] binder: 8903:8904 ioctl c0306225 20000600 returned -22 [ 793.726166] binder: undelivered TRANSACTION_ERROR: 29189 02:00:51 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xd5, 0x2f) 02:00:51 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x2000000}, 0x0) 02:00:51 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x200000000000000) [ 793.759807] binder: BINDER_SET_CONTEXT_MGR already set [ 793.777898] binder: 8903:8904 ioctl 40046207 0 returned -16 [ 793.807824] binder_alloc: 8903: binder_alloc_buf, no vma [ 793.814309] binder: BINDER_SET_CONTEXT_MGR already set [ 793.856368] binder: 8905:8909 ioctl 40046207 0 returned -16 [ 793.857060] binder: 8903:8906 transaction failed 29189/-3, size 0-0 line 3035 [ 793.862313] binder: 8903:8920 ioctl c0306225 20000600 returned -22 02:00:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x81000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 793.904400] binder: release 8903:8904 transaction 420 out, still active [ 793.913653] binder: undelivered TRANSACTION_COMPLETE [ 793.922331] binder: BINDER_SET_CONTEXT_MGR already set 02:00:52 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xd6, 0x2f) 02:00:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306251, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 793.947460] binder: undelivered TRANSACTION_ERROR: 29189 [ 793.954305] binder: 8905:8909 ioctl 40046207 0 returned -16 [ 793.965269] binder: send failed reply for transaction 420, target dead 02:00:52 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x4000000}, 0x0) 02:00:52 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cgroup.events\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000000c0)={0x401, 0x2002, 0x1, r1}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1c630000664408fc5bb1c63dd1a3d8070bb5b14f7fb58f3c8978c5fb3380066f13274a104894691552b86992c43d4fc606cf192499f13bf7c243f3971d340737e5e50f19fc510889fb8e07d74c4e1b5d9a464df4a5918dc4bb710fe5b45619c98280c6bd71526edf8a184674a7b91e1b5933b77ca82135dffe3fea060a81cffa022fe22c35fd7e125795fcacbc28289f45bea9ae3a4fc6aec2fb7287b1bff3b1623a9da87e10973db34e89cfd3f0ce18f7b6ca543fc32ce48fdcc4b4df4df6a0acb9554650ac"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:52 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x800000000000000) 02:00:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88a8ffff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 794.093975] binder: 8928:8939 ioctl c0306251 20000600 returned -22 02:00:52 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xd7, 0x2f) 02:00:52 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x8000000}, 0x0) [ 794.146547] binder: BINDER_SET_CONTEXT_MGR already set [ 794.146570] binder_alloc: 8928: binder_alloc_buf, no vma [ 794.155729] binder: 8928:8939 ioctl 40046207 0 returned -16 [ 794.179144] binder: BINDER_SET_CONTEXT_MGR already set 02:00:52 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x1000000000000000) [ 794.224236] binder: 8935:8942 ioctl 40046207 0 returned -16 [ 794.258202] binder: 8928:8943 transaction failed 29189/-3, size 0-0 line 3035 [ 794.266018] binder: 8935:8957 unknown command 25372 02:00:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9effffff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:52 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xa000000}, 0x0) 02:00:52 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xd8, 0x2f) [ 794.282754] binder: 8935:8957 ioctl c0306201 20000140 returned -22 [ 794.305366] binder: 8928:8954 ioctl c0306251 20000600 returned -22 [ 794.311647] binder: undelivered TRANSACTION_COMPLETE [ 794.317556] binder: undelivered TRANSACTION_ERROR: 29189 [ 794.323049] binder: send failed reply for transaction 423, target dead 02:00:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306252, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xa9070000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:52 executing program 0: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:52 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x4000000000000000) 02:00:52 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xe000000}, 0x0) 02:00:52 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xd9, 0x2f) [ 794.580628] binder: 8976:8981 ioctl c0306252 20000600 returned -22 02:00:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0ffffff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:52 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f00000001c0)={0x0, 0x80000, r0}) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f00000002c0)={0x0, 0x0, 0x3}) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f0000000300)={r1, r2}) readlinkat(r0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=""/115, 0x73) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000000)={{0x2, 0x4e23, @local}, {0x307}, 0x20, {0x2, 0x4e21, @rand_addr=0x7fffffff}, 'veth0\x00'}) [ 794.637088] binder: BINDER_SET_CONTEXT_MGR already set [ 794.642429] binder: 8976:8981 ioctl 40046207 0 returned -16 [ 794.649699] binder: BINDER_SET_CONTEXT_MGR already set [ 794.668362] binder: 8986:8989 ioctl 40046207 0 returned -16 [ 794.678058] binder_alloc: 8976: binder_alloc_buf, no vma 02:00:52 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xf000000}, 0x0) [ 794.716566] binder: 8976:8990 transaction failed 29189/-3, size 0-0 line 3035 [ 794.716682] binder: 8976:8999 ioctl c0306252 20000600 returned -22 02:00:52 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xda, 0x2f) [ 794.763639] binder: undelivered TRANSACTION_COMPLETE [ 794.770571] binder: undelivered TRANSACTION_ERROR: 29189 [ 794.795861] binder: send failed reply for transaction 427, target dead 02:00:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfeff0000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:52 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PPPIOCATTACH(r0, 0x4004743d, &(0x7f0000000000)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x51, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:52 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x10000000}, 0x0) [ 794.982244] binder_alloc: 9017: binder_alloc_buf, no vma [ 795.013312] binder: 9017:9022 transaction failed 29189/-3, size 0-0 line 3035 [ 795.047530] binder: send failed reply for transaction 430 to 9017:9022 [ 795.073177] binder_alloc_mmap_handler: 8 callbacks suppressed [ 795.073195] binder_alloc: binder_alloc_mmap_handler: 9017 20001000-20004000 already mapped failed -16 [ 795.102324] binder: BINDER_SET_CONTEXT_MGR already set [ 795.108149] binder: 9017:9022 ioctl 40046207 0 returned -16 [ 795.108674] binder_alloc: 9017: binder_alloc_buf, no vma [ 795.119661] binder: 9017:9029 transaction failed 29189/-3, size 0-0 line 3035 [ 795.127501] binder: 9017:9029 got reply transaction with no transaction stack [ 795.134786] binder: 9017:9029 transaction failed 29201/-71, size 0-0 line 2801 [ 795.142373] binder: undelivered TRANSACTION_COMPLETE [ 795.147579] binder: undelivered TRANSACTION_ERROR: 29189 [ 795.153064] binder: undelivered TRANSACTION_ERROR: 29201 [ 795.158620] binder: undelivered TRANSACTION_ERROR: 29189 02:00:53 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) clock_nanosleep(0x7, 0x0, &(0x7f0000000000), &(0x7f0000000040)) 02:00:53 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xdb, 0x2f) 02:00:53 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x3f000000}, 0x0) 02:00:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xff0f0000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:53 executing program 2: recvmsg(0xffffffffffffff9c, &(0x7f0000000140)={&(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f0000000100)=[{&(0x7f00000002c0)=""/187, 0xbb}, {&(0x7f0000000080)=""/32, 0x20}], 0x2, &(0x7f0000000380)=""/255, 0xff}, 0x2001) accept$nfc_llcp(r0, &(0x7f0000000480), &(0x7f00000001c0)=0x60) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$VIDIOC_DV_TIMINGS_CAP(r1, 0xc0905664, &(0x7f0000000500)={0x0, 0x0, [], @raw_data=[0x6, 0xf02, 0x7, 0x33, 0x5, 0x7fffffff, 0x8, 0x0, 0x800, 0x3f, 0x3, 0x1f, 0x1ff, 0x3ff, 0x40, 0x1, 0x7fffffff, 0x20, 0x7, 0x3, 0x8, 0x5, 0x5, 0x6, 0x3, 0x1, 0x1, 0xffffffff, 0xffffffff, 0x4e, 0x0, 0x1]}) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x52, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 795.426403] binder_alloc: binder_alloc_mmap_handler: 8986 20001000-20004000 already mapped failed -16 02:00:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffa888}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:53 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xdc, 0x2f) [ 795.528214] binder_alloc: 9037: binder_alloc_buf, no vma [ 795.554817] binder: BINDER_SET_CONTEXT_MGR already set [ 795.561912] binder: 9037:9043 transaction failed 29189/-3, size 0-0 line 3035 [ 795.569599] binder: 9041:9046 ioctl 40046207 0 returned -16 02:00:53 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x60000000}, 0x0) [ 795.585335] binder: send failed reply for transaction 435 to 9037:9043 [ 795.622300] binder_alloc: binder_alloc_mmap_handler: 9037 20001000-20004000 already mapped failed -16 02:00:53 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000002c0)={0x0, 0x0, 0x5, 0x0, [], [{0x37, 0x5b, 0x9, 0x5, 0x3, 0x1}, {0x8, 0x7b, 0x1000, 0x6, 0x400, 0x80000001}], [[], [], [], [], []]}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 795.662268] validate_nla: 9 callbacks suppressed [ 795.662277] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 795.690961] binder: BINDER_SET_CONTEXT_MGR already set 02:00:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfffff000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 795.711801] binder: 9037:9043 ioctl 40046207 0 returned -16 [ 795.732580] binder_alloc: 9037: binder_alloc_buf, no vma 02:00:53 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x7d0d0000}, 0x0) [ 795.759250] binder: 9037:9064 transaction failed 29189/-3, size 0-0 line 3035 [ 795.792242] binder: 9037:9051 got reply transaction with no transaction stack [ 795.832365] binder: 9037:9051 transaction failed 29201/-71, size 0-0 line 2801 [ 795.839297] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:54 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xdd, 0x2f) 02:00:54 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fadvise64(r1, 0x0, 0x100000001, 0x0) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:54 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x9effffff}, 0x0) 02:00:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffff7f}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:54 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) ioctl$PPPIOCGMRU(r2, 0x80047453, &(0x7f0000000080)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) sendto$llc(r2, &(0x7f0000000180)="a1d56d7e376033eb6ccb53b56ac14af66b2369e965741c49538d2e6c25b8bf4b2c4f427b06159c0ecba8665e896fdad4be7ad9d543", 0x35, 0x40004, &(0x7f00000001c0)={0x1a, 0x0, 0x5, 0x1, 0x100000000, 0x62, @broadcast}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x12a, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="08a519f3520000000ae615b63771ac29df00000000849aae667585000000145b4a65297d028cb4abb16fc0594848d5e655f05a6fd0abd11e3eeee5d7f22209876c2ba2d7baf13398fac6af2a23968a7488f1a017750131babc59a183867e2a04fc91b794139f938bbbfe73ff5003c3ad6c75ba8173deabb02de515fd669226c08a6676b7c914f70c8e2995dcb5d45557c2da6b29e0bf109adf84e2e1bc1cfdc28a6d5c3415021c387a227a5451f1aea9c70a90604add49f40a6cde59a2ce4cbf56be1fe959fa13f2b28975193864b8e5a2c4603c35cfe786442efbf9c8f269d8da5b507d688e487067912aca0a0b6a9238c88704cb3eb8f99835b3ab7e1a4ad5f694896d1044f464921b7475e29f81eb0f65f168597425e10d834e1f03bb592396770b6f86e5dcaa008e"], 0x48, 0x0, &(0x7f0000000500)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x740b422e31163e39, 0x0) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f00000002c0)={0x7, [0x14798a53, 0x1, 0x80000000, 0x3, 0x0, 0x3, 0x3ff]}, 0x12) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000100)=0x4, 0x4) ioctl$SIOCAX25OPTRT(r2, 0x89e7, &(0x7f00000000c0)={@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2, 0x56}) 02:00:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x3e0, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 796.341823] binder_alloc: binder_alloc_mmap_handler: 9041 20001000-20004000 already mapped failed -16 [ 796.405744] binder_alloc: 9077: binder_alloc_buf, no vma [ 796.426387] binder: 9077:9080 transaction failed 29189/-3, size 0-0 line 3035 [ 796.433950] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:54 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xc00e0000}, 0x0) [ 796.452434] binder: send failed reply for transaction 441 to 9077:9080 02:00:54 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') fcntl$getown(r0, 0x9) ioctl$VIDIOC_S_OUTPUT(r0, 0xc004562f, &(0x7f0000000040)=0x100000006) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) fallocate(r0, 0x32, 0x8, 0x7) [ 796.476717] binder: BINDER_SET_CONTEXT_MGR already set [ 796.482265] binder_alloc: binder_alloc_mmap_handler: 9077 20001000-20004000 already mapped failed -16 [ 796.503555] binder: 9086:9090 ioctl 40046207 0 returned -16 02:00:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffff9e}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:54 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xde, 0x2f) [ 796.524112] binder: BINDER_SET_CONTEXT_MGR already set [ 796.544898] binder: 9077:9080 ioctl 40046207 0 returned -16 [ 796.564939] binder: 9086:9090 unknown command -216423160 [ 796.584421] binder: 9077:9096 got reply transaction with no transaction stack [ 796.597563] binder: 9086:9090 ioctl c0306201 20000140 returned -22 [ 796.619821] binder_release_work: 1 callbacks suppressed [ 796.619826] binder: undelivered TRANSACTION_COMPLETE 02:00:54 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xf0ffffff}, 0x0) 02:00:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x2, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 796.622291] binder: BINDER_SET_CONTEXT_MGR already set [ 796.641800] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 796.651653] binder: 9086:9105 ioctl 40046207 0 returned -16 [ 796.671580] binder: 9086:9090 unknown command -216423160 02:00:54 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xdf, 0x2f) [ 796.702935] binder: 9086:9090 ioctl c0306201 20000140 returned -22 02:00:54 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x7ff, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a85321, &(0x7f0000000440)={{0x8, 0x8}, 'port0\x00', 0x6, 0x2100a, 0x8, 0x0, 0x200, 0x2, 0x40, 0x0, 0x1, 0x3}) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000000600)) ioctl$DRM_IOCTL_DROP_MASTER(r1, 0x641f) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) connect$llc(r1, &(0x7f0000000000)={0x1a, 0x20, 0x100000001, 0x9, 0x80000001, 0x7, @local}, 0x10) r3 = semget(0x1, 0x2, 0x101) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f00000002c0)=""/192) semctl$SETALL(r3, 0x0, 0x11, &(0x7f0000000080)=[0x3, 0x91e, 0x6, 0x0, 0x10, 0x8, 0x218c, 0x7]) fdatasync(r2) getsockopt$inet_tcp_buf(r1, 0x6, 0x1f, &(0x7f0000000380)=""/140, &(0x7f0000000100)=0x8c) accept4$bt_l2cap(r1, &(0x7f00000001c0), &(0x7f0000000040)=0xe, 0x80800) 02:00:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfffffff0}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:54 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xfffff000}, 0x0) 02:00:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000000)={0x0, r0, 0x9, 0x3, 0x100, 0x7c}) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x2, 0x110, r1, 0x62) r2 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x0, 0x8000) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000500)={'filter\x00', 0x7, 0x4, 0x490, 0x0, 0x0, 0x270, 0x3a8, 0x3a8, 0x3a8, 0x4, &(0x7f00000000c0), {[{{@arp={@remote, @local, 0xffffff00, 0xff000000, @mac, {[0xff, 0x0, 0x0, 0xff, 0xff, 0xff]}, @mac=@broadcast, {[0xff, 0xff, 0xff, 0xff, 0x0, 0xff]}, 0x9, 0x401, 0x3, 0x8, 0x1, 0x1, 'irlan0\x00', 'ip_vti0\x00', {}, {}, 0x0, 0x40}, 0xf0, 0x130}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "cebcb1be7603066c8b54d8e0a073ecb305b78993cf31981eb1a0b50a6709"}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @mac=@broadcast, @multicast2, @multicast1, 0xf, 0xffffffff}}}, {{@uncond, 0xf0, 0x138}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x5, 'syz0\x00', 0x5}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4e0) [ 796.831480] binder: 9117:9121 unknown command 16448 [ 796.848060] binder: 9117:9121 ioctl c0306201 20000600 returned -22 [ 796.863221] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 796.896748] binder_alloc: binder_alloc_mmap_handler: 9117 20001000-20004000 already mapped failed -16 02:00:55 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xe0, 0x2f) 02:00:55 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x9, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$RTC_WIE_OFF(r0, 0x7010) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 796.955304] binder: BINDER_SET_CONTEXT_MGR already set [ 796.960714] binder: 9117:9121 ioctl 40046207 0 returned -16 [ 796.969573] binder: BINDER_SET_CONTEXT_MGR already set [ 796.995187] binder: 9131:9133 ioctl 40046207 0 returned -16 02:00:55 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xffffff7f}, 0x0) [ 797.001175] binder: 9117:9129 unknown command 16448 [ 797.015189] binder: 9117:9129 ioctl c0306201 20000600 returned -22 [ 797.051026] binder_thread_release: 5 callbacks suppressed [ 797.051035] binder: release 9117:9121 transaction 446 out, still active [ 797.058002] binder: undelivered TRANSACTION_COMPLETE [ 797.090206] binder: 9131:9144 ioctl c028660f 20000000 returned -22 02:00:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40030000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x3, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:55 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x80, 0x0) [ 797.124696] binder: release 9117:9121 transaction 446 in, still active 02:00:55 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xe1, 0x2f) [ 797.189158] binder: send failed reply for transaction 446, target dead 02:00:55 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xffffff9e}, 0x0) [ 797.249890] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 797.257475] binder: 9155:9159 unknown command 64 [ 797.257491] binder: 9155:9159 ioctl c0306201 20000600 returned -22 [ 797.259713] binder_alloc: binder_alloc_mmap_handler: 9155 20001000-20004000 already mapped failed -16 [ 797.290456] binder: BINDER_SET_CONTEXT_MGR already set [ 797.296004] binder: 9155:9159 ioctl 40046207 0 returned -16 [ 797.302554] binder: 9155:9164 unknown command 64 [ 797.320909] binder: 9155:9164 ioctl c0306201 20000600 returned -22 [ 797.343012] binder: release 9155:9159 transaction 449 out, still active 02:00:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0ffffffffffff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 797.357831] binder: undelivered TRANSACTION_COMPLETE 02:00:55 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) socket$inet6(0xa, 0x4, 0x6) [ 797.385203] binder_release_work: 10 callbacks suppressed [ 797.385210] binder: undelivered TRANSACTION_ERROR: 29189 [ 797.438935] binder: release 9155:9159 transaction 449 in, still active [ 797.463068] binder: send failed reply for transaction 449, target dead [ 797.490009] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:55 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = dup3(r0, r0, 0x80000) write$P9_RVERSION(r1, &(0x7f0000000000)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:55 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xe2, 0x2f) 02:00:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:55 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xfffffff0}, 0x0) 02:00:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:55 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000080)) preadv(r0, &(0x7f0000000100)=[{&(0x7f00000002c0)=""/191, 0x57}], 0x1000000000000143, 0x0) ioctl$UI_END_FF_UPLOAD(r0, 0x406855c9, &(0x7f0000000000)={0x8, 0xc312, {0x57, 0x7fffffff, 0x6623, {0x3ff00000000000}, {0x80000000, 0x7}, @rumble={0x3, 0x6}}, {0x52, 0x8000, 0x4, {0x6, 0x100}, {0x1, 0x3}, @cond=[{0x0, 0x3, 0xb7b69e4, 0x10000, 0x1f, 0x7f}, {0x5, 0xf1a, 0x8, 0x3, 0x9}]}}) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000140)=0x0) prlimit64(r2, 0xe, 0x0, &(0x7f00000001c0)) [ 797.758293] binder_alloc: binder_alloc_mmap_handler: 9131 20001000-20004000 already mapped failed -16 [ 797.768361] binder: 9131:9144 ioctl c028660f 20000000 returned -22 [ 797.835523] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 797.855732] binder: 9189:9199 unknown command 0 [ 797.873941] binder: BINDER_SET_CONTEXT_MGR already set 02:00:56 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xe3, 0x2f) 02:00:56 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x40030000000000}, 0x0) 02:00:56 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) socket$caif_seqpacket(0x25, 0x5, 0x0) [ 797.884468] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 797.890180] binder: 9189:9199 ioctl c0306201 20000600 returned -22 [ 797.915536] binder: 9193:9202 ioctl 40046207 0 returned -16 02:00:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x200000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 797.957255] binder_alloc: binder_alloc_mmap_handler: 9193 20001000-20004000 already mapped failed -16 [ 797.986373] binder_alloc: binder_alloc_mmap_handler: 9189 20001000-20004000 already mapped failed -16 [ 798.031648] binder: BINDER_SET_CONTEXT_MGR already set 02:00:56 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xf0ffffffffffff}, 0x0) [ 798.060137] binder: BINDER_SET_CONTEXT_MGR already set [ 798.071745] binder: 9189:9199 ioctl 40046207 0 returned -16 [ 798.078898] binder: 9193:9202 ioctl 40046207 0 returned -16 [ 798.097251] binder_alloc_new_buf_locked: 3 callbacks suppressed [ 798.097260] binder_alloc: 9189: binder_alloc_buf, no vma 02:00:56 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xe4, 0x2f) [ 798.102874] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 798.117045] binder: 9189:9224 unknown command 0 02:00:56 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x800, 0x0) ioctl$sock_rose_SIOCRSCLRRT(r1, 0x89e4) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:56 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$SIOCX25SCUDMATCHLEN(r0, 0x89e7, &(0x7f0000000000)={0x2f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 798.178638] binder: undelivered TRANSACTION_ERROR: 29189 [ 798.179285] binder: 9189:9224 ioctl c0306201 20000600 returned -22 [ 798.204183] binder: release 9189:9199 transaction 453 in, still active [ 798.230489] binder: send failed reply for transaction 453 to 9189:9199 [ 798.266547] binder: undelivered TRANSACTION_COMPLETE [ 798.282225] binder: undelivered TRANSACTION_ERROR: 29189 [ 798.308741] binder: 9233:9235 ioctl c0306201 20000140 returned -14 02:00:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x5, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:56 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x100000000000000}, 0x0) 02:00:56 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xe5, 0x2f) 02:00:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:56 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$rose(r0, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f0000000000)=0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 798.352068] binder: BINDER_SET_CONTEXT_MGR already set [ 798.371183] binder: 9233:9241 ioctl c0306201 20000140 returned -14 [ 798.384680] binder: 9233:9235 ioctl 40046207 0 returned -16 02:00:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x400000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:56 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xe6, 0x2f) [ 798.520289] binder: 9254:9256 unknown command 0 [ 798.537889] binder: 9254:9256 ioctl c0306201 20000600 returned -22 02:00:56 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x200000000000000}, 0x0) 02:00:56 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/anycast6\x00') setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000200)={0x3a, @empty, 0x4e24, 0x4, 'wlc\x00', 0x2, 0xffff, 0x71}, 0x2c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) getsockopt$EBT_SO_GET_INIT_ENTRIES(r0, 0x0, 0x83, &(0x7f0000000180)={'nat\x00', 0x0, 0x3, 0x1c, [], 0x7, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}], &(0x7f0000000080)=""/28}, &(0x7f00000002c0)=0x78) write$P9_RLCREATE(r0, &(0x7f0000000000)={0x18, 0xf, 0x2, {{0xe4, 0x4}}}, 0x18) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4001ff) write$P9_RMKNOD(r0, &(0x7f0000000240)={0x14, 0x13, 0x2, {0x0, 0x3, 0x5}}, 0x14) [ 798.605998] binder: BINDER_SET_CONTEXT_MGR already set [ 798.660172] binder: 9254:9256 ioctl 40046207 0 returned -16 [ 798.660331] binder: 9254:9272 unknown command 0 [ 798.671199] binder: BINDER_SET_CONTEXT_MGR already set [ 798.688166] binder: 9257:9269 ioctl 40046207 0 returned -16 [ 798.696438] binder: 9254:9272 ioctl c0306201 20000600 returned -22 02:00:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x500000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:56 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xe7, 0x2f) 02:00:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:56 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x400000000000000}, 0x0) [ 798.721209] binder: release 9254:9256 transaction 457 out, still active [ 798.729061] binder: undelivered TRANSACTION_COMPLETE [ 798.744547] binder: release 9254:9263 transaction 458 out, still active 02:00:56 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) prctl$PR_MCE_KILL_GET(0x22) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='pids.current\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000500)={'security\x00', 0x1000, "94d7e047801e79b6f2f92ceb3a9671444e0483314541e0825ef470ba87ee284a955a521fae89cbf589ed35926b9fb2cbde7b3ef90b550f0e237bcdfa65881254cda5bd08ff8bb54d2d7d279ac3bbddade23208346c90458b7317dbccc301db8a6890d6270c2dfa48ed451f9be0805cd8998ff968976d07b94acd5cd4ff178885f9fe0799a4b3284fb08cc5a42bb7fee37df5cdd1cd15b67f413e434304217b572d7c0dab2edef58dc5a601c1410f64fe00e20f8ac4230e5fb2b18114d10bd506dd27f1251ff6fdabc1915580dd1c9470e72abf576f17d79869e2fe2d3d23db4ba59bebf083a26980a923424ac0af0e79c430293199d4a918ac690e28e3187167807f9e803cb82564fcff806afd559c06d3f73fe4b66106751b9507a375c8c0cb7b223d2a3c83a16256aee81b6c3a742495073935fb66e131aee2aff7e9ec04f04613ce0cefd92e6b717a42a3c2b845a7831e0e24cd96581c2e44780297f7c26381b28d1accaefeff117cb7f9967876dc945aef7d13f84b778398ff05e24f67732d74be9724c9a6e653559c1886be8e8c8b668a5b7285539b3c64917c2ebf862f7b9ca76d87d87dc0f3d85f6eb11151acfb691c6f52c06078636a1b5eb331437fdb1f25ef62114823fd3b85495bdafebf716800fbe60f1d1a9691fe93a5ea5643c7e3ac7d9f5a46d691fbf6ec3b7d83132cbe3a649ab5e61579c967cd3da89b3d08c085711e666966291eff74d4d529de383ea88253af33bf9690321d35b904a4451a4b0f419868d07e0486351ebbaf0cbb2b01e4572b9eace4b992158d8fcbd60aa512311c9ad66786aaed01d07545e419032000fcb45c6ec6f35b6a239aabda7e64668f42474c4a155b30b399093b106805e4d25bac305df482363fe8bec20c37e77a9e07deedd564b92a6aa4951a45ee6b6dc9ec33d7c962205001a198135b31496e89e627d2811863fe54380c6c696284d014fecc63f1d8cea422708d9bb93dd191299c4d084ebe8306fbdf0f09dc0ed587bd5d69cb93f1590f8461e360f8be7802a5ae0f5ecda65b362a4aa4ced33995b57a9355d98715d43efb0db6d4b090396968428f43acbc7a8ba9dca1a69c1f184a4a942cc61b17aa33d180a9dc06052a63c778515bf451eb110f39c929ecce0471bb261830d1b37c32c459f90754a7a71b8487c0ac48d0270352c59c08900733d7ac05c6b283d195d3d01a41ddc563b8835db92218596d475e59c0c0a07fd1be481cf049bd68e01dfea67b59d5b733a52f2056fd0e870bdc9da2795ce35813701c7504e80f9cb814b11357a8856059bc785da21b9f4943a5c413bae740967a406d3c1f3e4400c59166964cfb6fed1bef9e9cc2fdcc756d8fc83a9be66930142c4fa421e8c48ce6bd88e94a46833750cc6cac8603501fe98d729643ef6fec5e48d3742a02ab9b3138d864e9d1d34a6fe0033c531015cd607543ef0c5f63cf1aaca8bc29a308a717d7d93eda202182bc4507ad5cdd50c3579cf48eab7f684d6f06264ad7956bf185507fb7fa8f0cf1d07b8211166cefc2cca9686d41dc0d3313e20bb63a6dd6251237f441fb61da11518ca5f5136f2cdca1d009a7a6431f16040b3ad60cece1aee9a0649312c564e5991dcd8ab4591a3b6d66521d612b6590e2348a864bf4a9f3419df12b314433eefd26a2390fdb509647a51681899c8c9f647abd7511ff8a663d9f0fe8ad66c1befae0cfaf846b895a5bf544ffa0870cd8f3ffc2fa49f35ac0f7a3ceb0f95ef3a1178fca56830fbe284610282c7e658c72a3be9559e05eccb23f398f142f564ba135ccd1ba9cfd83c3fe308c1170553a35ce3ff40109b602ee9b0498b37da818a0a1abd5450931f1c62a1ed2b84ee4fc3057440364172770411d662155720c7726c671acd4593662124dbb7ac95bc963468686f51566f0f405970ba57624168d9d6c7d4a4d457d1992a09de1d1e3a1fdfa299cd73922d98b4486d5a28951824a254067d3b22768e0339afab09e5c3cb132ea0bd9f3a3e52acdb79f2aab1769800d37feb81147f83d791a45f0b6c73ad53b22d4d3a700c25e212b1a7630c36662f057e7d776972a58f7ad9bf8cfa84ee5927d43fcc0f941d46a775a9cc058753f3f7e222018f7587a669c9446470ddcb607123405cf3e93ab763df7247fd504c6e52e1b1b38757fa71057044d49fb6fedc5e2a209f0f9e0fd495464c7d80ce04356256ddcb7fed52b6f7d633f339ae6d82dccf050f72dcdbdd784b2071dfed11b4cfcc4f08a68684659cf90fc6545e2f8d66e9ae5d7d604d1944a261f649b2e13d22689c249267cbd547adafbb1d687e6a74a153973f04d25316a79dcbcf10424ba4031493317739de2e07b634d08b9d0b92c66b1aa48935a668319b2aa2e692d82ad6d1cef5f93a7f777200d6c87259c93ef43b4f27e1e1e4fb10e86eb17a24b26c8c7cae6172d9e00f235c21c74e27d66fc92bee46379d94298122e0b940d347fb04acdb119137c41d0c978fdebbe06227308a96c0da14bbb038ec0788c41cab42db46e15aa8f29f21c5379ae1b62a32a5fec912d38ffe6e4b067ecfab0bc2ee8a6b1528d5c833b593f9963676018b83756e76825aa599523134c1438918e88f0bc9746d306ecf604e8addf85838b43bf0b921ed0e8351a86935ea42bbb90842da33f5481d45ac8cfc5d63790bad564e2121b8accff286a5958128e7859ef278753205a42a5e2144f4f3d312aa0ed347bfe4396615b87b5ba4802d0d65a80e0962ad83b0be0aaa5a722fee30d7491afb308a38283e053983e021c97328215c309103a90fa7098b0beec92df698d159c75c29f01edbfa27124d594be139fbf08bdcdcf45e64c43ac733c48b08b47463f1f8b893e709743e034e0fb758f676ccb3e202b1af1644a1a6601f44588b2627dec89005c6fd708b0550d92843c157d53fb123763285890f7937fa9379449964fab2ba3714bce30edb2b4db59bcdca05737597600607e25bf31b85994221547959a24c2668566b26234fb0d2cb589497072da27cb93509045728ae0a89f9aa95666d0ac304d62d2a31d348caf4370fe2c8950eed289a12b98e8bc9846295f321cf478a317881063b99902565a30fcbc3a3140efcdfec9a2e1844a456716b852564e3110af1210b13fefce42637e3c8764d63ccbeca9009ea81219fdcd6dba68bc0d1e4aae814895ca1a38c84ed16eb1d0dca60cd318605c8452a039e2c7cc6f7835247f7a8d7aa6aa2f8deef2dff574c9ed8ca7799d033f3a5755ee68fdb50300bb81d51d990f8399cc7587df5d2afe8845b353e7739c7509a38ad0aef81f92e44f8dd01bc6a131d28fa6aeb4cba27e15fff6f8558a5f4a71be7c2cd8457ae3c2ca4003e20d01c9e0c3bf78d22164dffbc24e93d7101590a57e8774bb48182d73d05e6c5403933674f6da77db595cc891fd1722398dd19e2ce2b698f3105b28358271b9147ce2364fab35d1d0d7b7e722d98bbe761e740767a246e2dcddbc407b45c45ebfb633e42974e3ef7123a73c80f98e8592846cd88105c605d21d54a06a76f1c797ecd26bf70125a875265ce2f00f2e798c53635ce419576af3efbea22dcf1f3c6d2ea01517cd55710f3c47ad06a30d5f8a5a381f4ecc2e70fc6770a428d1900e2b5af19c7e3c73ed20ea12780d11f612cf8d32bf41865f55f16d73c6734be5b541a7160e9adf3849e34db72750b11fd2b7670a4da50fd8573afb12e19da0893468ecce3f7f52b9f2bc40b14521e2f65af447571c30e1b705018483e1cc84c3aa02ae19c6e5b3100bb0d0c66b288507c194ad948bcaf49f110c24efab74bca0896e07bdbe51e0bd1054d0b0b2608ff8711992a1a1680705c9f4e51f4c81479bf244ddd1d63b62af739766262cb2566c8ff210477957b4548c8e0cccfea250a5bfd3f55610f6b6917648421c802abb65c35038186a53b4996bd1d45879d668b346019db61df6e770b29aefabf8d46dbeed3b37d1819a6213bc87c88f9efb37b3bd729a0c770f1c0f91ef38efd47b659d7db82bf899ae983a415adb53cf852b5ba4931723fcda7a4fae265f1e43a31a57b8cda1049b603a181a10b0bd305c7431995f310eb47d32feca362f70dbcf294803d26c2c0997d44021ef7143b101a3b713f303caf1e8a56997622b830c2780d8aa1e9e2323697083bf04cf62aabab556238835de671a70a353ddaea204ab6ab4f614cd522f7ccd0c9655ceb4727da092db7e1a5c82642880d7ea59c51b0fcfda7203596e7655c3d76abbaf939afd11c2c1938546bb6f312b2fe5ebd55dfbba72de4ca49382f3ad4f8587a36b51029b747940336f671688866a4389bb7b536227296476a41dbf3dc94c905630263e98cc7da46e1bfaf67d5185df2e050f978abd4641df738e7dd621e1ae43d9594b6c2c34698b96f09bd440af68b7bd43dfb4a5e8f8f774071532e4429de4024b12c256c4e76db71b69b6ab2857585dc3d46ad4bbf397515d81aba3fa32a6d498ad5f38735dc408aa460bc1610c02e950c2f7b586a125c30c7748fa5a04d5f2f7570c35195135acbe02a1b9660cbcf7b25cd9870d8b92838376f2c7dd4fef8f3fa5349e1de2e30cd18136c0c9d60614d55573fb8622d5378c641c2d815c6e3b91a0d37adc211d1f532a66ce873a811abb1f05d3566e271011b00f423754d496491a9c44e0e60963e463b1bda3563756cbe0fb0c8d0ce1d4d86e1b527a5062d53cc2ee556c07364de0806fb061b2b783e37cab28be8debe873ae4a09e091ac2ca85f3d49903b97ef6a450e4d6a24cac30315b0307d6d81f6eaa434401183c13194ac92faa785ae146aef86e57f3248ddd6b9d0b092fcb8ef517e7c7232f1e6f659fb88274656000f617a903c9233217b4ffe4addf09e565db742804c1c3c5fd16f7c1d9c489ec4229d86c7f620ba22189511aec503bb55d00df81bbcc917c9ec54278d72e73e9a4600b675bdfd0dbfca5f68ed38718a0feca4a6c258af3a1ab716780d87ef89edc72031cdb38faddf7a6212797d997b454089c3ad25d3579d2cd57075285c8c4d8e2b8254621fe5f7d842b3cf9258ad3938e0b26f4812720aaad36c73d68aa868643900eef23dd4157ee50c9c6158c675ada2a357d96c11455181f43e6dbb43d4a758a4da7aeecb660a2863d21c9535ce1ae3179494d40d8f1cc69e892a70b0dde90c732a9e839a3f3c84f6d4bc5e1d2accd4a8b9d275d6626e1b6e864e550117b2e5cfcf015261f6f58de4b8ce6826ca8f8c379c71ebd60c7ac6bb2a7e477b3546f98c822fb5d4faa3b1232205944012cc38d06b099305bc6e2b586873ac70737139c3a4431321758dc0bffb49667e90f7c8ac5970efa4e15877bfa061953592b933b0682365b2246b7a0d2e9328154cf93e682c28b8659fd6d26f4793cfce2803422a7d14328f4f5088aff883b3ee0fd0051e4932b20e75377e7752ec753bba0bba1772391f1986dfff4667f9f960e0f5c8552e704fab0fa71eb887798375e5c9d70872df14ee2c017086c894dbe354e55867e711cfc362b024c4a7b3029f98b37d94d538ea0c645bfdc1ab17365285b55728c5a5eee6707cfe724b40c4956a0a4d43581a852c5945ebc79644dc40e98a6130d8b093fe8e9f55cb2d4909001634d49b850696b69a109077eca8ecc9711fea2dcc94b376058e50431dc98b43547dbcbeb5ea3cdce29328fc09fa6f6460c4efb636d635f918ce8949e6429f678df17258e8eca3101f3056c19c9100eb934afcb3fd8460c58494e897aa7632ed37ea80055e4de3db7d35e78034"}, &(0x7f0000000040)=0x1024) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f00000000c0)=0x8100108) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:56 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fstatfs(r1, &(0x7f0000000000)=""/132) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 798.820342] binder: undelivered TRANSACTION_COMPLETE [ 798.866091] binder: release 9254:9256 transaction 457 in, still active [ 798.875427] binder: send failed reply for transaction 457, target dead [ 798.882143] binder: send failed reply for transaction 458, target dead [ 798.954406] binder: 9292:9295 unknown command 0 02:00:57 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xe8, 0x2f) 02:00:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x600000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:57 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x800000000000000}, 0x0) [ 798.975886] binder: BINDER_SET_CONTEXT_MGR already set [ 798.977549] binder: 9292:9295 ioctl c0306201 20000140 returned -22 02:00:57 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) accept4$x25(r0, &(0x7f0000000000), &(0x7f0000000080)=0x12, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x3ff) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 799.031040] binder: 9292:9305 unknown command 0 [ 799.046344] binder: 9289:9298 ioctl 40046207 0 returned -16 [ 799.068159] binder: BINDER_SET_CONTEXT_MGR already set 02:00:57 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xa00000000000000}, 0x0) [ 799.093175] binder_alloc: 9292: binder_alloc_buf, no vma [ 799.105350] binder: 9292:9304 ioctl 40046207 0 returned -16 [ 799.118846] binder_transaction: 5 callbacks suppressed [ 799.118862] binder: 9289:9306 transaction failed 29189/-3, size 0-0 line 3035 [ 799.129960] binder: 9292:9305 ioctl c0306201 20000140 returned -22 02:00:57 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xe9, 0x2f) [ 799.145357] binder: 9289:9314 unknown command 0 [ 799.162460] binder: 9289:9314 ioctl c0306201 20000600 returned -22 02:00:57 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:57 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) bind$unix(r0, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e24}, 0x10) ioctl$DRM_IOCTL_MAP_BUFS(r0, 0xc0186419, &(0x7f0000000080)={0x4, &(0x7f0000000100)=""/120, &(0x7f0000000380)=[{0x7, 0xb8, 0x8, &(0x7f00000002c0)=""/184}, {0x6, 0x1000, 0x9, &(0x7f0000000600)=""/4096}, {0x687, 0x1000, 0xb, &(0x7f0000001600)=""/4096}, {0x831d, 0x1000, 0x2, &(0x7f0000002600)=""/4096}]}) 02:00:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x700000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:57 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xe00000000000000}, 0x0) 02:00:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fsetxattr$security_evm(r1, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000040)=@md5={0x1, "8d852e4537b21a0171e6af242029727f"}, 0x11, 0x1) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x7) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:57 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xea, 0x2f) 02:00:57 executing program 2: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xc, &(0x7f0000000040)='wlan1em1em0\x00', 0xffffffffffffffff}, 0x30) r1 = syz_open_procfs(r0, &(0x7f0000000100)='n\x01\x00OKt\x04\x00\x00\x00t\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x401) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 799.763816] binder_alloc: 9289: binder_alloc_buf, no vma [ 799.769392] binder: 9289:9314 transaction failed 29189/-3, size 0-0 line 3035 [ 799.777297] binder: 9289:9314 unknown command 0 [ 799.781976] binder: 9289:9314 ioctl c0306201 20000600 returned -22 [ 799.788554] binder: undelivered TRANSACTION_ERROR: 29189 [ 799.805082] binder: undelivered TRANSACTION_ERROR: 29189 02:00:58 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r0, 0xc058534b, &(0x7f0000000100)={0x7, 0x7, 0x6, 0x4172, 0x2, 0x7}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000040)={0x3, 0x5}) connect$can_bcm(r0, &(0x7f0000000000), 0x10) 02:00:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x800000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 799.878256] binder: 9341:9345 ioctl 40046205 7 returned -22 [ 799.912895] binder: BINDER_SET_CONTEXT_MGR already set 02:00:58 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xf00000000000000}, 0x0) 02:00:58 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xeb, 0x2f) [ 799.953176] binder: 9348:9351 ioctl 40046207 0 returned -16 [ 799.973267] binder: BINDER_SET_CONTEXT_MGR already set [ 799.988428] binder: 9348:9356 unknown command 0 [ 799.995991] binder: 9341:9357 ioctl 40046205 7 returned -22 [ 800.032242] binder: 9348:9356 ioctl c0306201 20000600 returned -22 [ 800.054141] binder: release 9341:9345 transaction 464 in, still active [ 800.061496] binder: 9341:9345 ioctl 40046207 0 returned -16 [ 800.070050] binder: send failed reply for transaction 464 to 9348:9356 02:00:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xa00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:58 executing program 2: r0 = getpid() r1 = syz_open_procfs(r0, &(0x7f0000000140)='net/rpc\x00') ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000040)='team0\x00') perf_event_open(&(0x7f0000000180)={0x7, 0x70, 0x2, 0x200, 0x7, 0x25, 0x0, 0x401, 0x52a01, 0xa, 0x1, 0x3ff, 0x40, 0x1f, 0xffff, 0x7, 0xfff, 0xfffffffffffff528, 0x6, 0x2, 0x1, 0x6, 0x5, 0x4, 0xb1, 0x7, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x1, 0x1000, 0x5, 0x7ff, 0x101, 0x81, 0x1, 0x0, 0x8, 0x1, @perf_config_ext={0x800, 0x1}, 0x44, 0x3, 0x1, 0x8, 0xfffffffffffffffb, 0xfff, 0x2}, r0, 0x4, 0xffffffffffffffff, 0x1) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000326bd700010dbdf2502000000280005000001000000000000"], 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 800.084889] binder_alloc_mmap_handler: 3 callbacks suppressed [ 800.084905] binder_alloc: binder_alloc_mmap_handler: 9348 20001000-20004000 already mapped failed -16 [ 800.182524] binder_alloc: 9348: binder_alloc_buf, no vma [ 800.216407] binder: 9348:9374 transaction failed 29189/-3, size 0-0 line 3035 [ 800.234147] binder: 9348:9356 unknown command 0 [ 800.244209] binder: 9348:9356 ioctl c0306201 20000600 returned -22 [ 800.258224] binder: undelivered TRANSACTION_COMPLETE [ 800.263386] binder: undelivered TRANSACTION_ERROR: 29189 02:00:58 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x1, 0x2) connect$rose(r1, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, 0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}}, 0x1c) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:00:58 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x1000000000000000}, 0x0) 02:00:58 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xec, 0x2f) 02:00:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xa, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xc00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:58 executing program 2: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f00000001c0)=0xc) r1 = syz_open_procfs(r0, &(0x7f00000003c0)='\x87\x98(\x19Q\x1d%\x9b\x04\x12\x02\x1a\x8a\x9e\xb5\xa9\x179\xe7\xea\xeb\xc4\n\x0f\xdcIs\xf3\xf36{N>\x89\x1be\n\xad\xcb\xedq\xb9\xdb\x19\xfe\xd4\xb5B\xeeDs\xfdq\xbfD\xc4AN\xc0\xd7\xbd\xd1\xf6;\x86L\xf6\xdba\xb5\x1d\xad\x8a\xd36\x9a\xf4\x9a\x96\x04S!\xc9\xa9U\xd645\x96\xbe\x00\xb1\xe7\x9bO\x8b<\xb7z\x9a\xeb \x1c\xc7jSw\a\xaa\xb0w\x13\xbaY\x88\xa7-\xd3A') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000000)={0x0, 0x1}, &(0x7f0000000040)=0x8) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') setsockopt$inet_sctp_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f0000000080)={r3, 0x7fffffff, 0x2}, 0x8) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 800.286354] binder: undelivered TRANSACTION_ERROR: 29189 02:00:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xe00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:58 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x3f00000000000000}, 0x0) 02:00:58 executing program 2: r0 = userfaultfd(0x80000) fchdir(r0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:00:58 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xed, 0x2f) [ 800.411570] binder: BINDER_SET_CONTEXT_MGR already set [ 800.423603] binder: 9394:9396 ioctl 40046207 0 returned -16 [ 800.496258] binder_alloc: binder_alloc_mmap_handler: 9386 20001000-20004000 already mapped failed -16 [ 800.524857] binder: BINDER_SET_CONTEXT_MGR already set [ 800.535076] binder: 9386:9388 ioctl 40046207 0 returned -16 02:00:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:58 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$nl_route(0x10, 0x3, 0x0) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000000)={0x0, 0x37, "9a0661a9db5a9b0fd21e1859a872e5873de49bb8862fb929748cf642cf2096543adb26dd3b4849afc9fa1051b3fc2c9a7c6a61b01f4170"}, &(0x7f0000000040)=0x3f) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000080)={r2, 0x72e}, &(0x7f0000000100)=0x8) [ 800.551610] binder: 9394:9404 unknown command 0 [ 800.557822] binder: 9394:9404 ioctl c0306201 20000600 returned -22 [ 800.571626] binder: release 9386:9388 transaction 468 in, still active [ 800.580708] binder: send failed reply for transaction 468 to 9394:9404 02:00:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) getsockopt$packet_buf(r2, 0x107, 0xd, &(0x7f0000000040), &(0x7f00000000c0)) sendfile(r0, r1, &(0x7f0000000040), 0x7) 02:00:58 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x6000000000000000}, 0x0) 02:00:58 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xee, 0x2f) [ 800.693562] validate_nla: 9 callbacks suppressed [ 800.693571] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 801.186632] binder_alloc: binder_alloc_mmap_handler: 9394 20001000-20004000 already mapped failed -16 [ 801.196281] binder: BINDER_SET_CONTEXT_MGR already set [ 801.201692] binder: 9394:9404 ioctl 40046207 0 returned -16 [ 801.207341] binder: 9394:9436 unknown command 0 [ 801.208056] binder_alloc: binder_alloc_mmap_handler: 9418 20001000-20004000 already mapped failed -16 [ 801.212503] binder: 9394:9436 ioctl c0306201 20000600 returned -22 [ 801.222327] binder: BINDER_SET_CONTEXT_MGR already set 02:00:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x48, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:00:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:00:59 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$CAPI_GET_SERIAL(r0, 0xc0044308, &(0x7f0000000000)=0x7fffffff) 02:00:59 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xef, 0x2f) 02:00:59 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x7d0d000000000000}, 0x0) 02:00:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4, 0x10, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 801.233242] binder: 9418:9423 ioctl 40046207 0 returned -16 [ 801.235578] binder: undelivered TRANSACTION_COMPLETE [ 801.254381] binder: undelivered TRANSACTION_ERROR: 29189 [ 801.260333] binder: undelivered TRANSACTION_COMPLETE [ 801.282895] binder: send failed reply for transaction 470, target dead [ 801.317030] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:00:59 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x9effffff00000000}, 0x0) [ 801.393686] binder: BINDER_SET_CONTEXT_MGR already set 02:00:59 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xf0, 0x2f) 02:00:59 executing program 2: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, r0, 0x0, 0xd, &(0x7f0000000040)='/selinux/mls\x00'}, 0x30) syz_open_procfs$namespace(r3, &(0x7f0000000100)='ns/ipc\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 801.415153] binder: 9439:9453 ioctl 40046207 0 returned -16 [ 801.440258] binder_alloc: 9448: binder_alloc_buf, no vma 02:00:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2000000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 801.470166] binder: 9439:9457 transaction failed 29189/-3, size 0-0 line 3035 02:00:59 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xc00e000000000000}, 0x0) 02:00:59 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000000)="eaef3a313aedefc7fbdbac4cc7222dbfefab1a", 0x13, r1}, 0x68) [ 801.567550] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4c, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:00 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xf1, 0x2f) 02:01:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4000000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:00 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xf0ffffff00000000}, 0x0) 02:01:00 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r0, &(0x7f0000000100)=[{&(0x7f0000000000)=""/191, 0xffffffffffffff86}], 0x1, 0x0) 02:01:00 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 802.173368] binder: BINDER_SET_CONTEXT_MGR already set [ 802.178755] binder: 9448:9480 ioctl 40046207 0 returned -16 [ 802.179311] binder_alloc: binder_alloc_mmap_handler: 9439 20001000-20004000 already mapped failed -16 [ 802.194870] binder_alloc: 9439: binder_alloc_buf, no vma [ 802.200901] binder: 9439:9482 transaction failed 29189/-3, size 0-0 line 3035 [ 802.208983] binder: undelivered TRANSACTION_ERROR: 29189 [ 802.215367] binder: undelivered TRANSACTION_ERROR: 29189 [ 802.303368] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 802.309761] binder: 9484:9485 unknown command 0 02:01:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4800000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:00 executing program 2: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000140)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) perf_event_open$cgroup(&(0x7f0000000000)={0x1, 0x70, 0x100, 0x1, 0x0, 0x9, 0x0, 0xf0d, 0x0, 0x1, 0x2e, 0x9, 0x5de, 0xcd, 0x5881, 0xfff, 0xfff, 0x179b800, 0x5, 0x1, 0x9, 0x2, 0x2, 0x1, 0x6d, 0x7ff, 0x1, 0xfffffffffffff000, 0x101, 0x7, 0x5, 0xffffffff, 0x9, 0xde2, 0x0, 0x4d0, 0x8, 0x1, 0x0, 0x409e, 0x4, @perf_config_ext={0x4, 0x7fff}, 0x29080, 0x9, 0x2de9, 0x8, 0xffffffff, 0xff, 0x401}, r1, 0x10, r1, 0x4) 02:01:00 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xffffff7f00000000}, 0x0) [ 802.362934] binder: 9484:9485 ioctl c0306201 20000140 returned -22 [ 802.403168] binder: BINDER_SET_CONTEXT_MGR already set 02:01:00 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xf2, 0x2f) [ 802.427770] binder: 9496:9499 ioctl 40046207 0 returned -16 [ 802.443918] binder_alloc: binder_alloc_mmap_handler: 9484 20001000-20004000 already mapped failed -16 [ 802.486183] binder_alloc: 9484: binder_alloc_buf, no vma [ 802.505255] binder: BINDER_SET_CONTEXT_MGR already set [ 802.514688] binder: 9496:9509 transaction failed 29189/-3, size 0-0 line 3035 [ 802.523190] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:00 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xffffffff00000000}, 0x0) 02:01:00 executing program 2: getpgrp(0xffffffffffffffff) r0 = getpgrp(0x0) r1 = syz_open_procfs(r0, &(0x7f0000000000)='mountstats\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 802.531245] binder: 9484:9485 ioctl 40046207 0 returned -16 [ 802.538429] binder: 9484:9514 unknown command 0 [ 802.575088] binder: 9484:9514 ioctl c0306201 20000140 returned -22 02:01:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x60, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:01 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xf3, 0x2f) 02:01:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4c00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:01 executing program 0: syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000000)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:01 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000000c0)=0x3, 0x4) sysfs$2(0x2, 0xcb, &(0x7f0000000040)=""/16) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_x25_SIOCDELRT(r0, 0x890c, &(0x7f00000003c0)={@null=' \x00', 0x1, 'erspan0\x00'}) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) pipe(&(0x7f0000000000)) ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f00000002c0)=""/222) 02:01:01 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0xfffffffffffff000}, 0x0) [ 803.193063] binder_alloc: binder_alloc_mmap_handler: 9496 20001000-20004000 already mapped failed -16 [ 803.202747] binder_alloc: 9496: binder_alloc_buf, no vma [ 803.208311] binder: 9496:9528 transaction failed 29189/-3, size 0-0 line 3035 [ 803.217133] binder: undelivered TRANSACTION_ERROR: 29189 [ 803.222698] binder: undelivered TRANSACTION_ERROR: 29189 02:01:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6000000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 803.294019] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:01 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x2}, 0x0) 02:01:01 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xf4, 0x2f) [ 803.347883] binder: BINDER_SET_CONTEXT_MGR already set 02:01:01 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400202) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 803.387269] binder: 9540:9541 ioctl 40046207 0 returned -16 [ 803.402940] binder_alloc: binder_alloc_mmap_handler: 9535 20001000-20004000 already mapped failed -16 [ 803.435252] binder_alloc: binder_alloc_mmap_handler: 9540 20001000-20004000 already mapped failed -16 [ 803.445513] binder: BINDER_SET_CONTEXT_MGR already set [ 803.482563] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 803.495943] binder: 9540:9541 ioctl 40046207 0 returned -16 [ 803.502487] binder: BINDER_SET_CONTEXT_MGR already set [ 803.510521] binder: 9535:9553 ioctl 40046207 0 returned -16 02:01:01 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x4}, 0x0) [ 803.542009] binder_thread_release: 2 callbacks suppressed [ 803.542036] binder: release 9540:9547 transaction 480 out, still active [ 803.547980] binder_alloc: 9535: binder_alloc_buf, no vma [ 803.555821] binder: undelivered TRANSACTION_COMPLETE 02:01:01 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x40000800) r1 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x0, 0x2) getsockopt$IP_VS_SO_GET_SERVICES(r1, 0x0, 0x482, &(0x7f00000000c0)=""/91, &(0x7f0000000040)=0x5b) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\a\x00\x00\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 803.593890] binder: 9540:9547 transaction failed 29189/-3, size 0-0 line 3035 [ 803.616663] binder: undelivered TRANSACTION_ERROR: 29189 [ 803.632829] binder: release 9535:9539 transaction 480 in, still active 02:01:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x68, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6558000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:01 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xf5, 0x2f) 02:01:01 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$VIDIOC_G_FREQUENCY(r0, 0xc02c5638, &(0x7f0000000000)={0x0, 0x4, 0x3f}) [ 803.716818] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 803.731240] binder: send failed reply for transaction 480, target dead 02:01:01 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xf6, 0x2f) 02:01:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6800000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:01 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x8}, 0x0) [ 803.790180] binder_alloc: binder_alloc_mmap_handler: 9574 20001000-20004000 already mapped failed -16 [ 803.810163] binder: BINDER_SET_CONTEXT_MGR already set [ 803.824796] binder: 9568:9582 ioctl 40046207 0 returned -16 [ 803.858412] binder: BINDER_SET_CONTEXT_MGR already set [ 803.875383] binder: 9574:9579 ioctl 40046207 0 returned -16 [ 803.884287] binder: 9568:9586 unknown command 7 02:01:02 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x10000, 0x0) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 803.905540] binder: 9568:9586 ioctl c0306201 20000140 returned -22 [ 803.913547] binder_alloc: 9574: binder_alloc_buf, no vma [ 803.948634] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 803.961991] binder: 9574:9590 transaction failed 29189/-3, size 0-0 line 3035 [ 803.964293] binder: BINDER_SET_CONTEXT_MGR already set 02:01:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6c, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:02 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xa}, 0x0) 02:01:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6c00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 804.003029] binder: 9568:9586 unknown command 7 [ 804.040179] binder: 9568:9586 ioctl c0306201 20000140 returned -22 [ 804.070358] binder: undelivered TRANSACTION_ERROR: 29189 [ 804.076219] binder: release 9574:9579 transaction 483 in, still active [ 804.085211] binder: 9568:9582 ioctl 40046207 0 returned -16 [ 804.122422] binder: send failed reply for transaction 483 to 9574:9579 [ 804.147401] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 804.155488] binder: undelivered TRANSACTION_COMPLETE [ 804.163831] binder: BINDER_SET_CONTEXT_MGR already set 02:01:02 executing program 0: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b630004"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:02 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xf7, 0x2f) 02:01:02 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fcntl$getownex(r2, 0x10, &(0x7f0000000000)) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x0, 0x0) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f00000002c0)={0x0, {0x2, 0x4e20, @remote}, {0x2, 0x4e21, @broadcast}, {0x2, 0x4e20, @rand_addr=0x6}, 0x44, 0x0, 0x0, 0x0, 0x18a, &(0x7f0000000140)='gre0\x00', 0x6, 0x401}) [ 804.178923] binder: undelivered TRANSACTION_ERROR: 29189 [ 804.209160] binder_alloc: 9601: binder_alloc_buf, no vma [ 804.236160] binder: 9601:9606 ioctl 40046207 0 returned -16 [ 804.273963] binder: release 9601:9606 transaction 486 out, still active 02:01:02 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xe}, 0x0) 02:01:02 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xf8, 0x2f) 02:01:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7400000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 804.281535] binder: 9601:9608 transaction failed 29189/-3, size 0-0 line 3035 [ 804.290307] binder: undelivered TRANSACTION_COMPLETE [ 804.316480] binder: release 9601:9606 transaction 486 in, still active [ 804.325510] binder: 9618:9622 unknown command 67134219 02:01:02 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') r1 = shmget$private(0x0, 0x3000, 0x220, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_STAT(r1, 0xd, &(0x7f00000002c0)=""/152) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f00000001c0), 0x1, 0x0) ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f00000001c0)={0x4, 0x3f, "33ff2c5ab7e4e84a14185f940048e30545031e4d8afb646133e543cddde09fbbd41f886590ec17bde8f80239d6478f23905f2b8c6e4fcd45bfacf32d1d367c"}) write$P9_RMKDIR(r0, &(0x7f0000000140)={0x14, 0x49, 0x1, {0x0, 0x0, 0x5}}, 0x14) r2 = getpid() fcntl$lock(r0, 0x26, &(0x7f00000000c0)={0x1, 0x7, 0x100000001, 0x1ff, r2}) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000240)={0x0, 0x8001}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000000)={r3, 0x2}, &(0x7f0000000380)=0x8) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000080)={r4, 0x2}, &(0x7f0000000100)=0x8) [ 804.352826] binder: send failed reply for transaction 486, target dead [ 804.363657] binder: 9618:9622 ioctl c0306201 20000140 returned -22 02:01:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x74, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 804.398190] binder: undelivered TRANSACTION_ERROR: 29189 [ 804.431018] binder: BINDER_SET_CONTEXT_MGR already set 02:01:02 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xf}, 0x0) [ 804.472015] binder: 9618:9638 unknown command 67134219 [ 804.478447] binder: 9618:9638 ioctl c0306201 20000140 returned -22 02:01:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x7a00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 804.515192] binder: 9618:9622 ioctl 40046207 0 returned -16 [ 804.523817] binder_alloc: 9636: binder_alloc_buf, no vma [ 804.549404] binder: BINDER_SET_CONTEXT_MGR already set 02:01:02 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xf9, 0x2f) 02:01:02 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ipv6_route\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 804.570893] binder: 9636:9640 ioctl 40046207 0 returned -16 [ 804.605815] binder: 9636:9642 transaction failed 29189/-3, size 0-0 line 3035 02:01:02 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c638000"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:02 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x10}, 0x0) [ 804.638608] binder: release 9636:9640 transaction 490 out, still active [ 804.652519] binder: undelivered TRANSACTION_COMPLETE [ 804.669913] binder: undelivered TRANSACTION_ERROR: 29189 02:01:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7a, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:02 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xfa, 0x2f) [ 804.712086] binder: release 9636:9640 transaction 490 in, still active [ 804.736114] binder: send failed reply for transaction 490, target dead 02:01:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8100000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:02 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000600)={'filter\x00', 0x7, 0x4, 0x4a8, 0x280, 0x140, 0x0, 0x3c0, 0x3c0, 0x3c0, 0x4, &(0x7f0000000000), {[{{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@broadcast, @mac=@remote, @dev={0xac, 0x14, 0x14, 0x21}, @local, 0x3}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev={[], 0xf}, @empty, @multicast2, @broadcast, 0x0, 0x1}}}, {{@arp={@broadcast, @remote, 0xffffff00, 0xffffffff, @empty, {[0xff, 0x0, 0x0, 0xff]}, @mac=@random="e2a46f1e1969", {[0xff, 0x0, 0xff, 0x0, 0xff]}, 0x7fffffff, 0x3f, 0x1ff, 0x6, 0x100, 0x8, 'nr0\x00', 'rose0\x00', {0xff}, {0xff}, 0x0, 0x100}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @empty, @multicast1, 0xd, 0xffffffff}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f8) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:02 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x60}, 0x0) [ 804.837645] binder: 9661:9667 unknown command 8413964 [ 804.842881] binder: 9661:9667 ioctl c0306201 20000140 returned -22 [ 804.880130] binder: BINDER_SET_CONTEXT_MGR already set [ 804.917150] binder: 9661:9677 unknown command 8413964 02:01:03 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xfb, 0x2f) [ 804.950867] binder: 9663:9670 ioctl 40046207 0 returned -16 [ 804.956784] binder: BINDER_SET_CONTEXT_MGR already set [ 804.975487] binder: 9661:9676 ioctl 40046207 0 returned -16 [ 804.981406] binder_alloc: 9661: binder_alloc_buf, no vma [ 804.990232] binder: 9661:9677 ioctl c0306201 20000140 returned -22 02:01:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88a8ffff00000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:03 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) preadv(r1, &(0x7f0000000080)=[{&(0x7f0000000000)=""/74, 0x4a}], 0x1, 0x0) 02:01:03 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xf0}, 0x0) [ 805.010880] binder: 9663:9679 transaction failed 29189/-3, size 0-0 line 3035 02:01:03 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x4, 0x4000) ioctl$VIDIOC_ENUMAUDIO(r1, 0xc0345641, &(0x7f0000000040)={0x8db, "0f35dc9640a9164d7a8bdeaa2d7ca9dbea63188c998d22a119677981cf225a31", 0x3, 0xc97849baa027171b}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = gettid() ptrace$setregs(0xf, r2, 0x4, &(0x7f0000000180)="e51277766c6f4b87c7cb4571e08b21507f9ecbb5ae15608a5cc01c5dd82a2cad7e551cb9a21497285ee8b979d6d328810bc1762d70d64cce353372a6974a64451b86858e3076d6f4807013854ab5fef0ec43b756a5cc8edc0c51211330d2ce308c533a0f0c9f009b592d8de355fed3e4a3bb606cc7a0a29da0f2ed79164b792a8e53c7568151c55d512b7ab9d3492bb0484080f179f91deeef429e86cb7a") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 805.076089] binder_alloc: 9663: binder_alloc_buf, no vma [ 805.104603] binder: 9663:9679 transaction failed 29189/-3, size 0-0 line 3035 02:01:03 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xfc, 0x2f) [ 805.170366] binder: undelivered TRANSACTION_ERROR: 29189 [ 805.199218] binder: undelivered TRANSACTION_ERROR: 29189 02:01:03 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xa00}, 0x0) 02:01:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x300, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:03 executing program 2: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0xc, &(0x7f0000000040)='net/rt_acct\x00'}, 0x30) r0 = getpgid(0xffffffffffffffff) r1 = syz_open_procfs(r0, &(0x7f0000000140)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0), 0x0, 0x0) 02:01:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9effffff00000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:03 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xfd, 0x2f) [ 805.393985] binder: BINDER_SET_CONTEXT_MGR already set [ 805.417292] binder: 9708:9717 ioctl 40046207 0 returned -16 02:01:03 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/status\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f00000002c0)=ANY=[@ANYRES32=r2, @ANYBLOB="f10000008e7535bc39f214dbcb8b472f58adf16b2cbf30ed0fd4a4c65504291c510a8b2b588da6f59fa3393fda8f7d63697cbbe5a2fb85309ecf42c269d902d610e8181204e6472a9af49f0ad5d0edc5143815341c79ac453693465cbc6353330e7a1308ca67016e286ac1693e389a417dd0f259e5b514c5ccdae3ed9f16018d97b58175eaa85bcecc96ef7b2ce1c18d8c54d3169bba3a629a1392fad27291c566ad7418bd7a664d77117ec7622f8c6212d234122b6216345904e9303899303d3830f63b0c70a0f0884bcbbc8cccd160670567d4bac20ef4585dd425a613d114486e085eea57b1a0ec6ae68878fd1ca01e5fe9f760"], &(0x7f0000000080)=0xf9) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:03 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xd7d}, 0x0) [ 805.449510] binder: BINDER_SET_CONTEXT_MGR already set [ 805.454825] binder: 9701:9703 ioctl 40046207 0 returned -16 02:01:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xa907000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 805.513149] binder: release 9701:9703 transaction 497 in, still active [ 805.525641] binder: send failed reply for transaction 497 to 9708:9721 02:01:03 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:03 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0xfe, 0x2f) 02:01:03 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xe00}, 0x0) 02:01:03 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x2, 0x1) write$evdev(r0, &(0x7f0000000100)=[{{0x77359400}, 0x4, 0x9, 0x126}, {{0x77359400}, 0x15, 0x8, 0x40}, {{0x77359400}, 0x3, 0x6}], 0x48) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000000)={0x400, 0x2, 0x5ccc}, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) connect$bt_sco(r0, &(0x7f0000000040)={0x1f, {0x88, 0x1, 0x9, 0x8, 0xffffffffb7133eeb}}, 0x8) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0ffffff00000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 805.781950] binder: 9742:9749 ioctl c0306201 20000140 returned -11 [ 805.823410] binder_alloc_mmap_handler: 5 callbacks suppressed [ 805.823427] binder_alloc: binder_alloc_mmap_handler: 9742 20001000-20004000 already mapped failed -16 [ 805.856714] validate_nla: 6 callbacks suppressed [ 805.856723] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 805.871054] binder: BINDER_SET_CONTEXT_MGR already set [ 805.915358] binder: 9742:9749 ioctl 40046207 0 returned -16 02:01:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x500, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:04 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xec0}, 0x0) 02:01:04 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)) 02:01:04 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x102, 0x2f) 02:01:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfeff000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) close(r0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 806.181339] binder_alloc: binder_alloc_mmap_handler: 9708 20001000-20004000 already mapped failed -16 [ 806.190990] binder_alloc: 9708: binder_alloc_buf, no vma [ 806.196536] binder: 9708:9760 transaction failed 29189/-3, size 0-0 line 3035 [ 806.204131] binder: undelivered TRANSACTION_COMPLETE [ 806.209388] binder: undelivered TRANSACTION_ERROR: 29189 02:01:04 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x100000000000012d, 0x0) 02:01:04 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xf00}, 0x0) [ 806.301304] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 806.311798] binder: BINDER_SET_CONTEXT_MGR already set [ 806.317837] binder_alloc: binder_alloc_mmap_handler: 9762 20001000-20004000 already mapped failed -16 [ 806.328125] binder: 9768:9771 ioctl 40046207 0 returned -16 02:01:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xff0f000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:04 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x103, 0x2f) [ 806.356587] binder: BINDER_SET_CONTEXT_MGR already set [ 806.385297] binder: 9762:9774 ioctl 40046207 0 returned -16 [ 806.448271] binder_alloc: 9762: binder_alloc_buf, no vma [ 806.462390] binder: 9762:9786 transaction failed 29189/-3, size 0-0 line 3035 [ 806.462588] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 806.480467] binder: release 9762:9774 transaction 502 out, still active 02:01:04 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x3f00}, 0x0) [ 806.498675] binder: undelivered TRANSACTION_COMPLETE 02:01:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x600, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:04 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x104, 0x2f) 02:01:04 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') getsockopt(r0, 0x8001, 0x92, &(0x7f00000002c0)=""/232, &(0x7f0000000100)=0xe8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f0000000040)={'mangle\x00'}, &(0x7f00000000c0)=0x54) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xfeda}], 0x1, 0x0) [ 806.548018] binder: release 9762:9774 transaction 502 in, still active [ 806.570272] binder: send failed reply for transaction 502, target dead 02:01:04 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x6000}, 0x0) [ 806.682755] binder_alloc: binder_alloc_mmap_handler: 9799 20001000-20004000 already mapped failed -16 [ 806.691923] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 806.722526] binder: BINDER_SET_CONTEXT_MGR already set 02:01:04 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x105, 0x2f) [ 806.742738] binder: 9799:9802 ioctl 40046207 0 returned -16 [ 806.752594] binder_alloc: 9799: binder_alloc_buf, no vma [ 806.771002] binder: undelivered TRANSACTION_COMPLETE [ 806.780518] binder: 9799:9803 transaction failed 29189/-3, size 0-0 line 3035 [ 806.787985] binder: send failed reply for transaction 505, target dead 02:01:05 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x1, 0x84010, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfffffffffffff000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:05 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x7d0d}, 0x0) 02:01:05 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$pptp(0x18, 0x1, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-monitor\x00', 0x8000, 0x0) ioctl$SIOCRSSCAUSE(r2, 0x89e1, &(0x7f0000000140)=0x28) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000000)=""/72, 0x48}, {&(0x7f00000002c0)=""/201, 0xc9}, {&(0x7f00000003c0)=""/150, 0x96}], 0x3, 0x0) 02:01:05 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x106, 0x2f) 02:01:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x700, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 807.066591] binder_alloc: binder_alloc_mmap_handler: 9768 20001000-20004000 already mapped failed -16 [ 807.142378] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 807.152976] binder_alloc: binder_alloc_mmap_handler: 9827 20001000-20004000 already mapped failed -16 [ 807.170518] binder: BINDER_SET_CONTEXT_MGR already set [ 807.176601] binder: 9827:9836 transaction failed 29189/-3, size 0-0 line 3035 [ 807.184095] binder: 9827:9834 ioctl 40046207 0 returned -16 02:01:05 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xc00e}, 0x0) 02:01:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:05 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x107, 0x2f) [ 807.191275] binder: undelivered TRANSACTION_COMPLETE [ 807.199925] binder: send failed reply for transaction 509, target dead 02:01:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xa00, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:05 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000000)={0x4, 0x1, 0x80000001, 0x6, '\x00', 0xe681}) 02:01:05 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x108, 0x2f) [ 807.391775] binder: BINDER_SET_CONTEXT_MGR already set [ 807.397377] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 807.440698] binder: 9855:9858 ioctl 40046207 0 returned -16 [ 807.444863] binder_alloc: binder_alloc_mmap_handler: 9839 20001000-20004000 already mapped failed -16 [ 807.467869] binder: BINDER_SET_CONTEXT_MGR already set [ 807.484526] binder: send failed reply for transaction 512 to 9855:9862 [ 807.498585] binder: 9839:9840 ioctl 40046207 0 returned -16 [ 807.499230] binder_alloc: binder_alloc_mmap_handler: 9855 20001000-20004000 already mapped failed -16 02:01:05 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:05 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xf000}, 0x0) 02:01:05 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x9, 0x18, 0x1, r0}) socketpair$unix(0x1, 0x400000012, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_ENABLE_CAP(r0, 0x4068aea3, &(0x7f0000000000)={0xf9, 0x0, [0x9, 0x8, 0x3be, 0x4]}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) fsetxattr$security_capability(r0, &(0x7f0000000100)='security.capability\x00', &(0x7f0000000140)=@v1={0x1000000, [{0xb7a4}]}, 0xc, 0x1) 02:01:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x2000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 807.540788] binder: 9855:9862 transaction failed 29189/-3, size 0-0 line 3035 [ 807.568605] binder: undelivered TRANSACTION_COMPLETE 02:01:05 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x109, 0x2f) [ 807.673895] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 807.707002] binder_alloc: binder_alloc_mmap_handler: 9877 20001000-20004000 already mapped failed -16 [ 807.712379] binder: BINDER_SET_CONTEXT_MGR already set 02:01:05 executing program 2: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xc, &(0x7f0000000080)='net/rt_acct\x00'}, 0x30) r1 = syz_open_procfs(r0, &(0x7f0000000000)='cmdline\x00\x8c9{\xe7\xd2\x8c\xb0\xeb\x9e^\xf1\rP\xb9\xdc\xa7;c\x91\xc8\xab\xdb;\x8ar\xde,\xf3\xb7\x8d\x8e?\xde\b\xc3\xdc\xbfU\xc7\xf5\xf3\t\x13\xe7|\xc0L\xbbp5\x99\x94\x1d\xd6\xf7b\x88o}\xf0\xb8\xda\xa4D\xeb\xd8\x024\xca\xea\x97\x01y>\x05\xe8\xe3\xd0d\xd5\xe3\xa0o\x838G\xbc\xce\x14\x147\xe1\x8f|\xe8\x9a\x9cC\xab\xe9/s)\xafm\xc0\xc1b{\xe6e\x04\xaf\xaf') ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x40044900, 0x8001) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:05 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x34000}, 0x0) 02:01:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 807.726558] binder: 9878:9885 ioctl 40046207 0 returned -16 [ 807.745339] binder: 9877:9884 transaction failed 29189/-3, size 0-0 line 3035 [ 807.765780] binder: BINDER_SET_CONTEXT_MGR already set 02:01:05 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x10a, 0x2f) [ 807.832983] binder: 9877:9883 ioctl 40046207 0 returned -16 [ 807.845135] binder: send failed reply for transaction 516 to 9877:9883 02:01:06 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x400300}, 0x0) 02:01:06 executing program 2: ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000002c0)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000300)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000000180)={0x2, 0x7deee1ba, 0x8}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) openat$urandom(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/urandom\x00', 0x0, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r3, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r4, 0x590}}, 0x10) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) [ 807.878321] binder: undelivered TRANSACTION_COMPLETE [ 807.891295] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:06 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000)=0x3d) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x3f00, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:06 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xf0ffff}, 0x0) 02:01:06 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_GET_KEEPCAPS(0x7) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:06 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x10b, 0x2f) [ 808.512829] binder_alloc: binder_alloc_mmap_handler: 9878 20001000-20004000 already mapped failed -16 [ 808.587614] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 808.597096] binder: BINDER_SET_CONTEXT_MGR already set [ 808.602471] binder: 9918:9926 ioctl 40046207 0 returned -16 [ 808.602488] binder: BINDER_SET_CONTEXT_MGR already set [ 808.629777] binder_alloc_new_buf_locked: 3 callbacks suppressed 02:01:06 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x1000000}, 0x0) [ 808.629785] binder_alloc: 9918: binder_alloc_buf, no vma [ 808.643909] binder_thread_release: 6 callbacks suppressed [ 808.643950] binder: release 9918:9926 transaction 519 in, still active [ 808.645488] binder: 9928:9931 ioctl 40046207 0 returned -16 [ 808.650372] binder: 9928:9934 ioctl 1 20000000 returned -22 [ 808.662293] binder: send failed reply for transaction 519 to 9918:9926 02:01:06 executing program 2: r0 = accept$nfc_llcp(0xffffffffffffffff, &(0x7f00000003c0), &(0x7f0000000000)=0x60) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000440)='ip_vti0\x00') ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000380)) r1 = fcntl$getown(0xffffffffffffff9c, 0x9) r2 = syz_open_procfs(r1, &(0x7f0000000080)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) recvmsg$kcm(r2, &(0x7f0000000340)={&(0x7f0000000200)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f0000000280)=[{&(0x7f0000000080)}], 0x1, &(0x7f00000002c0)=""/117, 0x75}, 0x2) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000100)=""/195, 0xc3}], 0x1, 0x0) [ 808.685124] binder: undelivered TRANSACTION_COMPLETE [ 808.706430] binder_release_work: 8 callbacks suppressed [ 808.706437] binder: undelivered TRANSACTION_ERROR: 29189 02:01:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4800, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 808.746077] binder: undelivered TRANSACTION_ERROR: 29189 02:01:06 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/rtc0\x00', 0x80000, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet(0x2, 0x1, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$UI_SET_SNDBIT(r2, 0x4004556a, 0x1) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000040)='SEG6\x00') ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_RM_CTX(r0, 0xc0086421, &(0x7f0000000340)={r4, 0x2}) sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="080225bd7000fedbdf25020000000800020005000000669509fa180004000000000001800000010000000000010001000100080004000600000008000300aa0a000014000100000000000000000000000000000000001400010000000000000000000000ffff"], 0x6c}, 0x1, 0x0, 0x0, 0x4}, 0x40000) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:06 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x2000000}, 0x0) [ 808.894852] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 808.903145] binder: BINDER_SET_CONTEXT_MGR already set [ 808.920419] binder_alloc: 9947: binder_alloc_buf, no vma [ 808.935413] binder: 9947:9948 ioctl 40046207 0 returned -16 [ 808.947063] binder: release 9947:9948 transaction 522 out, still active [ 808.957576] binder: undelivered TRANSACTION_COMPLETE [ 808.971392] binder: undelivered TRANSACTION_ERROR: 29189 [ 808.983878] binder: release 9947:9948 transaction 522 in, still active [ 809.009882] binder: send failed reply for transaction 522, target dead 02:01:07 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="793da3a40add6c47dde6eb45179e12764659220600000067f77bb967e78d8fed175ca87df646fc61dc45e53eb940d6de541073608ebf8b14afd6d033db1e78b46543f2bd5724090ed6e1c4919dcedc66464a2127ecc8f59b3842e7710ba73e733c0f321ff9b0cbf032b33f419fc501a0e5586ece22caad660c7ce2d53079a94b26920ce6b418072a0abe6a1d0000"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:07 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x10c, 0x2f) 02:01:07 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x4000000}, 0x0) 02:01:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4c00, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:07 executing program 2: ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000080)=0x0) r1 = syz_open_procfs(r0, &(0x7f00000001c0)='net/ip_tables_names\x00') getsockopt$MISDN_TIME_STAMP(r1, 0x0, 0x1, &(0x7f0000000140), &(0x7f0000000040)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 809.377851] binder: 9928:9968 ioctl 1 20000000 returned -22 02:01:07 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x8000000}, 0x0) [ 809.470374] binder: BINDER_SET_CONTEXT_MGR already set [ 809.470392] binder_alloc: 9971: binder_alloc_buf, no vma [ 809.493807] binder: 9971:9972 ioctl 40046207 0 returned -16 [ 809.499834] binder_transaction: 2 callbacks suppressed [ 809.499864] binder: 9971:9980 transaction failed 29189/-3, size 0-0 line 3035 02:01:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 809.522227] binder: BINDER_SET_CONTEXT_MGR already set 02:01:07 executing program 2: ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000000)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 809.553814] binder: 9981:9983 ioctl 40046207 0 returned -16 [ 809.565155] binder: 9981:9989 unknown command -1532805767 [ 809.571793] binder: 9981:9989 ioctl c0306201 20000140 returned -22 [ 809.586327] binder: undelivered TRANSACTION_ERROR: 29189 [ 809.591863] binder: release 9971:9972 transaction 526 in, still active 02:01:07 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xa000000}, 0x0) [ 809.635780] binder: send failed reply for transaction 526 to 9971:9972 [ 809.649180] binder: undelivered TRANSACTION_COMPLETE 02:01:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 809.680805] binder: undelivered TRANSACTION_ERROR: 29189 02:01:07 executing program 2: r0 = getpid() r1 = syz_open_procfs(r0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$TIOCLINUX5(r1, 0x541c, &(0x7f0000000000)={0x5, 0x9, 0x0, 0x3ff, 0x5}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) getpeername$tipc(r1, &(0x7f0000000040), &(0x7f0000000080)=0x10) setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:07 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x1, 0x2) timerfd_settime(r1, 0x0, &(0x7f0000000040), &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:07 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x10d, 0x2f) 02:01:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:07 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xe000000}, 0x0) [ 809.863034] binder: BINDER_SET_CONTEXT_MGR already set 02:01:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 809.891305] binder_alloc: 10002: binder_alloc_buf, no vma [ 809.911621] binder: release 10002:10003 transaction 530 out, still active [ 809.929661] binder: undelivered TRANSACTION_COMPLETE 02:01:08 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xf000000}, 0x0) [ 809.954063] binder: BINDER_SET_CONTEXT_MGR already set [ 809.959598] binder: 10002:10007 ioctl 40046207 0 returned -16 [ 809.971066] binder: 10020:10022 ioctl 40046207 0 returned -16 02:01:08 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) r2 = gettid() syz_open_procfs(r2, &(0x7f0000000000)='limits\x00') [ 809.994659] binder: 10002:10012 transaction failed 29189/-3, size 0-0 line 3035 [ 810.043945] binder: release 10002:10003 transaction 530 in, still active [ 810.059753] binder: send failed reply for transaction 530, target dead 02:01:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:08 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x10000000}, 0x0) [ 810.099454] binder: undelivered TRANSACTION_ERROR: 29189 02:01:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6800, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:08 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x20000, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, r0, 0x0, 0xc, &(0x7f0000000040)='net/rt_acct\x00'}, 0x30) getpid() r1 = gettid() r2 = syz_open_procfs(r1, &(0x7f0000000000)='comm\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) preadv(r2, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 810.216872] binder: BINDER_SET_CONTEXT_MGR already set 02:01:08 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x10e, 0x2f) [ 810.247087] binder_alloc: 10039: binder_alloc_buf, no vma [ 810.254765] binder: 10039:10041 ioctl 40046207 0 returned -16 [ 810.305213] binder: 10039:10042 transaction failed 29189/-3, size 0-0 line 3035 [ 810.335331] binder: release 10039:10041 transaction 533 out, still active [ 810.342332] binder: undelivered TRANSACTION_COMPLETE [ 810.355196] binder: undelivered TRANSACTION_ERROR: 29189 [ 810.360687] binder: release 10039:10041 transaction 533 in, still active [ 810.376631] binder: send failed reply for transaction 533, target dead 02:01:08 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="202cdfc9671d3a6b495fb2920db8f3e563746ba340ee4028d0f98bc73e423e650b9deea3647bd5f1b1d150f9ce1419952bffd4d7c4cd924076cecd21856942b3778c71192130be54299803e0beea9db3bb1adc8103ecff8450eb98684cfe42c9b46fb3457545de"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x42) ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x40044900, 0x0) getsockopt(r1, 0x7, 0x80000000, &(0x7f0000000200)=""/106, &(0x7f0000000280)=0x6a) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x101000, 0x0) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000180)={0x0, {0x2, 0x4e23, @rand_addr=0x4}, {0x2, 0x4e22, @multicast2}, {0x2, 0x4e21, @multicast1}, 0x80, 0x0, 0x0, 0x0, 0x2, &(0x7f00000000c0)='ip6gre0\x00', 0x100000000, 0x73, 0x7f}) 02:01:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:08 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x3f000000}, 0x0) 02:01:08 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000001c0)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6c00, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:08 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x10f, 0x2f) 02:01:08 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x2) getsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000000)=0x8, &(0x7f0000000080)=0x4) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:09 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x60000000}, 0x0) [ 810.841148] binder_alloc_mmap_handler: 7 callbacks suppressed [ 810.841182] binder_alloc: binder_alloc_mmap_handler: 10065 20001000-20004000 already mapped failed -16 [ 810.849225] binder: BINDER_SET_CONTEXT_MGR already set 02:01:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 810.903764] binder: BINDER_SET_CONTEXT_MGR already set [ 810.913354] binder: 10065:10067 ioctl 40046207 0 returned -16 [ 810.919481] binder: 10072:10073 ioctl 40046207 0 returned -16 [ 810.952625] binder_alloc: 10065: binder_alloc_buf, no vma [ 810.971192] binder: 10072:10078 unknown command -908121056 [ 810.984931] binder: release 10065:10067 transaction 537 in, still active 02:01:09 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockname$unix(r0, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x6e) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x30, 0x2000000, {"1f27f08b41552c186c1006f3331e0c1b98c509cedc"}}, {0x0, "e0413ce76556a616d516378511e2d433a28effe3decefdcb0281241ac92b6cc967b1995a00bfa5f6871a1d41a331346e39844afcc12ef8312e83141dc1d06d2a9cad660e177c6c4ab9ee907984d2337f249f551f7b064844ffa480b474d42c04c86829c2605d5f2388cd03ea2eb97e1b6b300e038d92113fbbc97834093e64961eef62991496d5cc9ced26"}}, &(0x7f0000000380)=""/197, 0xbd, 0xc5, 0x1}, 0x20) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:09 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x7d0d0000}, 0x0) [ 811.002380] validate_nla: 6 callbacks suppressed [ 811.002389] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 811.015657] binder: 10065:10074 transaction failed 29189/-3, size 0-0 line 3035 [ 811.024360] binder: send failed reply for transaction 537 to 10065:10067 [ 811.032894] binder: 10072:10078 ioctl c0306201 20000140 returned -22 [ 811.045179] binder: undelivered TRANSACTION_ERROR: 29189 02:01:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x48}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 811.072790] binder: undelivered TRANSACTION_COMPLETE [ 811.078540] binder_alloc: binder_alloc_mmap_handler: 10072 20001000-20004000 already mapped failed -16 [ 811.096749] binder: undelivered TRANSACTION_ERROR: 29189 [ 811.144886] binder: 10072:10085 unknown command -908121056 [ 811.196960] binder: 10072:10085 ioctl c0306201 20000140 returned -22 [ 811.222010] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:09 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x8, 0x22900) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x20, r2, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x10000}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x20000040) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0c630000ffc3da61faf0d7b7b3ac3cba660bf02ea736b6c6a7f1b0f3ba00f31c52410500baa1d7d1f59c96f1a86bb85716f3e86750c69f23060760a9b157be2714c240b29b820f2787a7f6bfffff81b9b4a35cab7be20fcebf998475e8ae1f7f36a8f81d28eec3e26e06ded710d64239d7269ded6484ca14e680eb5c33b5c1c18fa6e169e0dff939e042033e28dd9875ec9e4a638afe15cefddbe963e3249a8795796cc790ef13df34af0d3e5c1c01be9d93aa0f8c8939222831b4eb8cfe819f97e6f60d4d26f0ddc07532249699247ad4726a86f3567990fca4f9be6d5b6341cf78059f7cf9fe306f5f5f86e85547513f1ea9aa0e35e24c28deee7f21eaaa524b3f034f34c0026e2b772829dae8d426d615ca31c0a01e508a28dcbe7d0e48fae562e03de32dd7f158882da8c968ef4359da81b774b6d46e3ebbb36d493d6bbedbe0ff907638e887ccd49a0e864c33e4f0ecf789e83e090c0fe9471f19455fbaf2ec60578442000d5e29f921c96816caeefbf059033b5e4fb33feef907817306e7fdfe02caaba9641e2430897b9d52869b39192933a42aa1b6d036958cb69063b84e236662cd3fa49dd296690fcd7360bac570bd35659df2c1b6e98d1adfa822ff60f823927b787db69547621cc296a9d0fe25dda48afd2f9c2f86c8ccb18a391178a44a3321efc04c00f5541ee2a74afa3b13eaa61b28b6757ad0f56b58467f5219c9862e9d9f004ac0d241686460"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:09 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x110, 0x2f) 02:01:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7400, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:09 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r0, 0x111, 0x2, 0x0, 0x4) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000380)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x2, r2, 0x3c, 0x1, @ib={0x1b, 0x80000001, 0x81, {"cda2af2999811d9cbeb325ef0646de9f"}, 0x7, 0x2, 0xa0}}}, 0xa0) 02:01:09 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x9effffff}, 0x0) 02:01:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4c}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 811.339992] binder_alloc: binder_alloc_mmap_handler: 10105 20001000-20004000 already mapped failed -16 02:01:09 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='wchan\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000)={0xffffffffffffffff}, 0x0, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000000080)={0x13, 0x10, 0xfa00, {&(0x7f00000002c0), r1}}, 0x18) 02:01:09 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xc00e0000}, 0x0) [ 811.396130] binder: BINDER_SET_CONTEXT_MGR already set [ 811.414240] binder: BINDER_SET_CONTEXT_MGR already set [ 811.419817] binder: 10112:10118 ioctl 40046207 0 returned -16 [ 811.445043] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 811.451289] binder: 10105:10111 ioctl 40046207 0 returned -16 [ 811.486202] binder_alloc: binder_alloc_mmap_handler: 10112 20001000-20004000 already mapped failed -16 [ 811.486906] binder_alloc: 10105: binder_alloc_buf, no vma [ 811.512208] binder: release 10105:10111 transaction 541 out, still active [ 811.528614] binder: 10105:10119 transaction failed 29189/-3, size 0-0 line 3035 [ 811.537401] binder: undelivered TRANSACTION_COMPLETE 02:01:09 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xf0ffffff}, 0x0) 02:01:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x60}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:09 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000000), 0x8a, 0x0) [ 811.551587] binder: send failed reply for transaction 541, target dead [ 811.580674] binder: undelivered TRANSACTION_ERROR: 29189 02:01:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7a00, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 811.651747] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:09 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x0, 0x440) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc4c85513, &(0x7f0000000500)={{0x2, 0x4, 0x7, 0xffffffffffffffff, 'syz0\x00', 0xd8b8}, 0x0, [0x9, 0xd23, 0x7fff, 0xfffffffffffffffd, 0x2, 0xffffffffffffffc1, 0x1, 0x4, 0x7, 0x101, 0x0, 0x4, 0x9b1, 0x4, 0xfffffffffffffffd, 0xff, 0xfff, 0x3ff, 0x5, 0xfffffffffffffffc, 0x5, 0x8, 0x8000, 0x3ff, 0x82, 0x3ff, 0x3, 0x4, 0x3, 0x2, 0x76b, 0x800, 0x0, 0x0, 0x0, 0x3, 0x3ff, 0x2, 0x6, 0x6, 0x101, 0x4000000000000, 0x0, 0x9, 0xffffffffffffff01, 0x48c4, 0xffff, 0x4, 0x200, 0xc, 0x9, 0x2, 0x3, 0xffffffffffffffe1, 0x240, 0x8d, 0x0, 0x6, 0x3, 0x80, 0x9, 0x11, 0x6, 0x3, 0x20, 0x400, 0x2, 0x0, 0xffff, 0x8001, 0x2, 0x0, 0xfffffffffffffff9, 0x5, 0x5, 0xf2, 0x0, 0x4, 0x4, 0x9, 0x5, 0x1ff, 0x9a0, 0xfff, 0x4271, 0x6, 0x3ff, 0x0, 0x8, 0x8, 0x0, 0x80, 0x8, 0x0, 0xffffffff, 0x4, 0x3ff, 0x225, 0x88, 0x2, 0x8, 0x6, 0x5, 0x5, 0x1000, 0x80000001, 0x400, 0x20, 0x8, 0x8, 0x20, 0x80000001, 0xf2e4, 0x401, 0x4, 0xfffffffffffffffc, 0x5, 0x7, 0x0, 0xb7a, 0x0, 0xff, 0x0, 0x20000000000, 0x80000000, 0x7, 0x10000, 0x10001], {r2, r3+30000000}}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 811.765482] binder_alloc: binder_alloc_mmap_handler: 10144 20001000-20004000 already mapped failed -16 02:01:09 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x111, 0x2f) 02:01:09 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xfffff000}, 0x0) 02:01:09 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x68}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 811.813534] binder: BINDER_SET_CONTEXT_MGR already set [ 811.861302] binder: BINDER_SET_CONTEXT_MGR already set [ 811.866837] binder: 10144:10146 ioctl 40046207 0 returned -16 [ 811.890099] binder: 10150:10151 ioctl 40046207 0 returned -16 02:01:10 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xffffff7f}, 0x0) [ 811.907493] binder_alloc: 10144: binder_alloc_buf, no vma [ 811.913773] binder: 10144:10163 transaction failed 29189/-3, size 0-0 line 3035 [ 811.923436] binder: BINDER_SET_CONTEXT_MGR already set [ 811.932718] binder: undelivered TRANSACTION_COMPLETE [ 811.938145] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 811.945795] binder: send failed reply for transaction 545, target dead 02:01:10 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) setsockopt$netrom_NETROM_IDLE(r0, 0x103, 0x7, &(0x7f0000000040)=0x5, 0x4) accept4$x25(r0, 0x0, &(0x7f0000000080), 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x8000) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) 02:01:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x1000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 811.963604] binder: 10150:10159 ioctl 40046207 0 returned -16 02:01:10 executing program 2: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)) r0 = fcntl$getown(0xffffffffffffffff, 0x9) r1 = syz_open_procfs(r0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r1, 0x6, 0x2, &(0x7f0000000040), &(0x7f0000000080)=0x6) 02:01:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6c}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:10 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xffffff9e}, 0x0) 02:01:10 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = epoll_create(0x4) epoll_wait(r1, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}], 0x6, 0xfffffffffffffff9) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffff00000000bada1b"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 812.106039] binder_alloc: binder_alloc_mmap_handler: 10175 20001000-20004000 already mapped failed -16 02:01:10 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x112, 0x2f) [ 812.189896] binder: BINDER_SET_CONTEXT_MGR already set [ 812.205361] binder: 10175:10176 ioctl 40046207 0 returned -16 02:01:10 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f0000000000)={0x1000, 0x4000, 0x7, 0x4, 0x1}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 812.232122] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 812.255563] binder_alloc: 10175: binder_alloc_buf, no vma [ 812.262437] binder: send failed reply for transaction 548 to 10175:10176 [ 812.273070] binder: undelivered TRANSACTION_COMPLETE 02:01:10 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xfffffff0}, 0x0) 02:01:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x74}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 812.324119] binder: 10175:10186 transaction failed 29189/-3, size 0-0 line 3035 [ 812.334473] binder: 10192:10198 unknown command -1 [ 812.350119] binder: 10192:10198 ioctl c0306201 20000140 returned -22 02:01:10 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000000)={0x7fffffff, 0x20a, 0x2a3, 0x67d, 0x0}, &(0x7f0000000040)=0x10) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000600)=ANY=[@ANYRES32=r2, @ANYBLOB="7f009e00c49d9b6958d61759cceb1955337852b12e4521e7762d87e9b9388742de89037ebd23fdd987b64e92ff87e91208704c64df17fa278a858cf78e82ce8c9f55a25b4693a85db4855a6e968c82f57eac8f213e7adadb6df11c3d0b1cee52cb0a736e898ed61ba7e78f41c53490315bfe9542924cbfb2efb47d25fbb61f2de68afe524f473063414a4d1a30fedadb069cdb6d0b45f3cb8a48ca94fb875e18cd06760fc8e3087fa576a1aaebe51a63cbfa087bd97e4333a71b2c7b8d8feff27139e5591b8c17435f7e4cb140ac15c16cf77cd13d9388e86c30f6c5a70b593c6fdc8a7bf6864a17abdf365c7e1efcca21f64182d1b6372976ec4e7059140d47f2593bdc8dd015a62bbf73ea9cdc48803b44892b68ab1bc718c2d21a81b852884158133111502f269b88edb5cf1ba078d89d3c4d49defa4910a09b502d89badad8b2a06dd9e8976f122b5463b50f68edc6c90c3b7f23a9eabf1e5807d410d8254c51815f6da902b82e46b1191341a983836254ad9e3a2d4433ff2b7887c07e16113923e02f609865e0f113f3b4a43db888a9566f686d08dd204f279198921772881acbb75c70209aa04c87f060cbf1abfcb140c13bed61acd14e08f4e4c094d97af7282ed9bc1ea423bb80cafce38189cc956993ee5390ae1a437c16721bc82fb04a1cc6dd08b019fd87d1c4c106d1cca724f1010000"], 0xa6) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:10 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x40030000000000}, 0x0) [ 812.434176] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x2000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7a}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:10 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xf0ffffffffffff}, 0x0) 02:01:10 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000440)=""/108}, {&(0x7f0000000340)=""/231}], 0x100000000000006c, 0xfffffffffffffffa) [ 812.553863] binder: BINDER_SET_CONTEXT_MGR already set [ 812.560218] binder: 10216:10217 ioctl 40046207 0 returned -16 02:01:10 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x113, 0x2f) [ 812.609672] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 813.062947] binder_alloc: binder_alloc_mmap_handler: 10192 20001000-20004000 already mapped failed -16 02:01:11 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x14) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$TCGETA(r1, 0x5405, &(0x7f00000000c0)) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000100)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0xd0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="06630440000000000663044004000000076304400200000011634840020000000000000000000000000000000000000001000000000000000000000038000000000000002000000000000000", @ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="8561646600000000080000000000000003000000000000001300000000000000852a6a7701010000", @ANYRES64=r2, @ANYBLOB="0400000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='H\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="040000000000000003630840", @ANYRES64=r2, @ANYBLOB="11634840040000000000000001000000000000000000000011000000000000000000000000000000000000001000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0800000000000000056304400100000004630440030000000b630000"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809c43ac6553db7f225a4e47722a057a8846454ad779316094e4bee8cab76761555d3675804fb728f045f7d9ecc9b2662539500d7df7d180200"}) 02:01:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf0}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:11 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x100000000000000}, 0x0) 02:01:11 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='n\x8b\"\a\t\x8f\v\xb5g\xdc\x7f&\xc2\b\xf6\x19et/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KVM_SMI(r0, 0xaeb7) fcntl$setflags(r1, 0x2, 0x1) write$FUSE_DIRENT(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="480080000000030000002c003d79ffffffff1a000000b2ddffff6e8b22070972745f61636374eaff00080000"], 0x48) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@mcast1, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@local}}, &(0x7f0000000300)=0xe8) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000340)={@local, 0x67, r3}) ioctl$IMHOLD_L1(r0, 0x80044948, &(0x7f0000000000)) 02:01:11 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x114, 0x2f) [ 813.118548] binder: BINDER_SET_CONTEXT_MGR already set [ 813.119946] binder: 10192:10238 unknown command -1 [ 813.124013] binder: 10192:10198 ioctl 40046207 0 returned -16 [ 813.128859] binder: 10192:10238 ioctl c0306201 20000140 returned -22 [ 813.129219] binder: send failed reply for transaction 551 to 10216:10217 02:01:11 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x200000000000000}, 0x0) [ 813.211225] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 813.236983] binder: 10249:10250 Release 1 refcount change on invalid ref 0 ret -22 02:01:11 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 813.272494] binder: 10249:10250 Release 1 refcount change on invalid ref 4 ret -22 [ 813.332913] binder: 10249:10250 DecRefs 0 refcount change on invalid ref 2 ret -22 [ 813.348490] binder: 10249:10250 got transaction to invalid handle [ 813.355420] binder_alloc: binder_alloc_mmap_handler: 10216 20001000-20004000 already mapped failed -16 [ 813.378475] binder: undelivered TRANSACTION_COMPLETE [ 813.390637] binder: 10249:10250 transaction failed 29201/-22, size 56-32 line 2896 02:01:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x3000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:11 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x400000000000000}, 0x0) 02:01:11 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$TIOCEXCL(r0, 0x540c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 813.451000] binder: BINDER_SET_CONTEXT_MGR already set [ 813.462131] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:11 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x115, 0x2f) [ 813.509569] binder: 10249:10263 ioctl 40046207 0 returned -16 [ 813.509582] binder: 10249:10273 Release 1 refcount change on invalid ref 0 ret -22 [ 813.509602] binder: 10249:10273 Release 1 refcount change on invalid ref 4 ret -22 [ 813.564485] binder: BINDER_SET_CONTEXT_MGR already set [ 813.589839] binder: 10270:10276 ioctl 40046207 0 returned -16 [ 813.593326] binder: send failed reply for transaction 554, target dead [ 813.610247] binder: 10270:10276 transaction failed 29189/-22, size 0-0 line 2896 [ 813.622308] binder: 10249:10273 DecRefs 0 refcount change on invalid ref 2 ret -22 [ 813.638578] binder: 10249:10273 got transaction to invalid handle 02:01:11 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x408, r0) openat$cgroup_ro(r1, &(0x7f0000000080)='cpuset.effective_mems\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0bf5464c99787728b7c9fdc935ee1c4b37bfe5ff9af27ec8373c8352e6921c420a488efb51391db6a5fc64487c972b59a09070e2d8ac2f5577262bf84f6c0ee7e1677a261ff2132e24a1d37f938054e492c9713fd774"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/loop-control\x00', 0x1, 0x0) 02:01:11 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x800000000000000}, 0x0) 02:01:11 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) write$binfmt_aout(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="862e097f8003000003010000000000000100000033b9010000000000000000f1508507cd00fad896f5f5dd0349bd51312f3d325fac034a83b67a8cc2e9ec4258c5f64b8589dc51e51e7021fb74af5d67083d7f5ab40be4e11a96692bd601f16ba4bd6390c79bc79b40abc9902000"], 0x4b) 02:01:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x500}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 813.671845] binder: 10249:10273 transaction failed 29201/-22, size 56-32 line 2896 02:01:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x600}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:11 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xa00000000000000}, 0x0) [ 813.779842] binder: 10293:10294 unknown command 1279718667 02:01:11 executing program 2: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000100)={r1, 0xfffffffffffffff7, 0x4, 0x80000001}, 0x10) getpgrp(0xffffffffffffffff) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000440)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000480)=0x0) r3 = syz_open_procfs(r2, &(0x7f0000000500)='net/unix\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000380)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000003000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00009fe000/0x600000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000002c0)="45dce0f2a13f3068d370902dfe071018a0dad92cafb1af4a660d5e63fa4abc254a43645c696bae35293d3959accb62422ab7145c6374ad186c30bd53f53bf72506a193f3dbec280103180e50a2adbaa1106716706b5795140967d32006267ff79f31b3004eac6b48e6ddd63c24faa0c4e3069d10d76fdb077fed56dd386eaddd4aa953267fdd3ff939d513b3803e43b3ed7d53fb354afa74b5278625acbf66ac1695c53fab7bad7114eaa9b27471e177a4c31f", 0xb3, r4}, 0x68) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f0000000140)=0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f00000001c0)=r6) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) preadv(r3, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 813.825206] binder: 10293:10294 ioctl c0306201 20000140 returned -22 [ 813.877174] binder_alloc: binder_alloc_mmap_handler: 10293 20001000-20004000 already mapped failed -16 [ 813.932323] binder: BINDER_SET_CONTEXT_MGR already set [ 813.972760] binder: 10293:10294 ioctl 40046207 0 returned -16 [ 813.982485] binder: 10293:10309 unknown command 1279718667 [ 813.989311] binder: 10293:10309 ioctl c0306201 20000140 returned -22 02:01:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:12 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xe00000000000000}, 0x0) 02:01:12 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x116, 0x2f) 02:01:12 executing program 2: ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) ioprio_set$pid(0x2, r0, 0x9) r1 = syz_open_procfs(0x0, &(0x7f0000000740)='net/rt_acct\x00V\xd4\x80\x83\x14\xba\x94\xad\xa8/\x17t\xee\xd6:\xa4\xb9\x17\xe1\xd2\x93\t\xf3\xf8\x96\xb5%\xf8,\xec\x8b\xb2\xa7\xe5\x16\xa6\xa0\xd7@\xd0\xdc\x00\x05\xf0\xb9sm\xf1\x00c*[\xcbK\xc9-\x0f\x82\x83cT\xbc\xdd\x1e>\x14\xb8\xd6\x14\xdda7Gl\v\xb1\x8b\xf0[r\xf3a\x8a@s\xd3\x18\xa4\xc5I\xa2`>\x88ux\xa1\x9b\'\xe4Dt\x17\x1b\x9a%{\x86\x04\xc6`\x8c1\x9f\x0f@\xd3;\xf7R;\x97O\xe0\x05O\xaeqZ\xa6r\xa4\xc7\x0e9Z\x17\x8d<\x8e\x99s\xcc\xf6d8yU9@m\xd7m\x9e\x9b\nT\xe2)2\xb6/\x14\xf1\xa1\x9b\xa9\x8a\x13\xf4\x98\xb7T\xbb:\b\x1fI\xae\xd9\x1d\fsU-0\xd1\xe1\xdf9\xba\x90\x0e*24\xf1\xc0C\xa9\xae\xb3\xb6\x8d\xaaBj\xa6\\f\xbaUX\xdf\xe2\xf0\x9e\"FKf\xf9\xb5\xbf\xd1\xce\f\xde]z\xf8\x06EC\x1bt\xd1\xf7\x03\xecP\x1a\xc3\xe8U\x89BN\f\x8d\x00\xbfi\x8e\x9a.\x8fIe\xfeU\x8c\xe6\x94Ys5\xb2\x01\xa1\xf9I\xf5\xedg') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000640)=0x3e86, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000180)={0x0}) r5 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r1, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0xc4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="09631040", @ANYRES64=r4, @ANYBLOB="040000000000000009631040", @ANYRES64=r5, @ANYBLOB="040000000000000000634040030000000000000004000000000000000000000011000000000000000000000028000000000000004000000000000000", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a747000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000003000000000000000200000000000000"], @ANYPTR=&(0x7f00000003c0)=ANY=[@ANYBLOB="60000000000000003000000000000000280000000000000038000000000000001800000000000000380000000000000000000000000000000000000000000000"], @ANYBLOB="12634840000000000000000003000000000000000000000010000000000000000000000000000000000000003000000000000000", @ANYPTR=&(0x7f0000000400)=ANY=[], @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB="780000000000000000000000000000004000000000000000000000000000000018000000000000003800000000000000"], @ANYBLOB="780e00000000000004630440040000000b630000"], 0x7, 0x0, &(0x7f0000000580)="2f8375733f3496"}) getsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000100), &(0x7f0000000140)=0xb) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl(r6, 0x7, &(0x7f00000002c0)="0f6f123feb89b939d32130048f9a617dc0dfc138ea41dd03b67d00ba26ac74a1be6e6e8d0d92d6490562c8e705aaa1c9017f689821fc7f32cf2cfc4350982780f99cbe4d62964da63153c4e5eaccd2590b5d0fc2905042e3538f91a9c082548103c450eaee5efd57c14863c99c18871bca9f5e61d35ef19854950b9f1614087492865195cc7d16b63b46bdc30e1da067ffc82902e74fec41cc") ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000026c0)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000027c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4004000}, 0xc, &(0x7f0000002780)={&(0x7f0000002700)=ANY=[@ANYBLOB="5c0000002e000a062dbd7000fddbdf2500000000", @ANYRES32=r7, @ANYBLOB="e0ff0a4000000000ebff020008000b000800000008000b000500000008000b100400000008000b000800000008000b0004000002f9000b000400000008000b0001f8ffff"], 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000400)='/dev/vcs\x00', 0x200, 0x0) 02:01:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x700}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000004000/0x3000)=nil, 0x3000, 0x1000000, 0x20011, r0, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$DRM_IOCTL_GET_UNIQUE(r2, 0xc0106401, &(0x7f0000000040)={0x65, &(0x7f00000000c0)=""/101}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) openat$cgroup_procs(r3, &(0x7f0000000180)='cgroup.threads\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 814.345370] binder_alloc: binder_alloc_mmap_handler: 10270 20001000-20004000 already mapped failed -16 [ 814.355266] binder_alloc: 10270: binder_alloc_buf, no vma [ 814.365228] binder_release_work: 4 callbacks suppressed [ 814.365235] binder: undelivered TRANSACTION_ERROR: 29189 02:01:12 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xf00000000000000}, 0x0) [ 814.416797] binder: undelivered TRANSACTION_ERROR: 29189 [ 814.452658] binder: BINDER_SET_CONTEXT_MGR already set 02:01:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7a9}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 814.481173] binder: 10325:10326 ioctl 40046207 0 returned -16 02:01:12 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 814.527677] binder_alloc: 10313: binder_alloc_buf, no vma 02:01:12 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x1000000000000000}, 0x0) [ 814.581448] binder_transaction: 1 callbacks suppressed [ 814.581481] binder: 10325:10329 transaction failed 29189/-3, size 0-0 line 3035 02:01:12 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') setxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000100)=0x0) syz_open_procfs(r2, &(0x7f0000000140)='loginuid\x00') ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 815.207582] binder: BINDER_SET_CONTEXT_MGR already set [ 815.212916] binder: 10313:10354 ioctl 40046207 0 returned -16 02:01:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x5000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:13 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x117, 0x2f) 02:01:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:13 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x3f00000000000000}, 0x0) 02:01:13 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0xbfd, 0x101042) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0xfff0000000000) setns(r0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f00000004c0)={0x0, @in6={{0xa, 0x4e23, 0x40000, @ipv4={[], [], @empty}, 0x101}}, [0x1, 0x7f, 0xd1cc, 0x7, 0xfffffffffffffbff, 0xddf, 0x8, 0x1ff, 0x4, 0x3, 0x1000, 0x1ff, 0x100000000, 0x8, 0x100000001]}, &(0x7f0000000080)=0x100) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000600)={r2, 0x40, 0x30}, &(0x7f0000000640)=0xc) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@empty, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f0000000000)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@initdev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@remote}}, &(0x7f0000000040)=0xe8) setreuid(r3, r4) fcntl$getflags(r0, 0xde60707261752406) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x7fff) removexattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=@known='trusted.overlay.metacopy\x00') 02:01:13 executing program 0: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) connect(r0, &(0x7f0000000380)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x3, 0x2, 0x0, 0x0, {0xa, 0x4e22, 0x1, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x5}}}, 0x83fbcc9d57748453) r1 = getpgrp(0x0) syz_open_dev$sg(&(0x7f0000000140)='/dev/sg#\x00', 0x80000000, 0x80) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20ncci\x00', 0x800, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net\x1cipv4/vs/lblcr_Vxpir\x90}k\xbb9a', 0x2, 0x0) perf_event_open(&(0x7f0000000080)={0x5, 0x70, 0x9, 0xffff, 0xc700000000000000, 0x6, 0x0, 0x1, 0x8002, 0x9, 0x9, 0x3, 0x8, 0x7d11, 0x87, 0x81, 0x8, 0xfff, 0x5, 0x2, 0xffffffffffffd668, 0xbc, 0x3, 0x7, 0xffffffffffffff00, 0x9, 0x3, 0x80000001, 0x1f, 0x355, 0x3, 0x8001, 0xffffffff, 0x7f, 0xffffffffffffffff, 0x7, 0x2, 0x7b0e, 0x0, 0x5, 0x6, @perf_bp={&(0x7f0000000040), 0x1}, 0x4, 0x400, 0xffffffff00000000, 0x0, 0x4a7, 0xffffffff, 0x3}, r1, 0x1, r2, 0x8) syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) [ 815.249369] binder_alloc: 10325: binder_alloc_buf, no vma [ 815.254977] binder: 10325:10340 transaction failed 29189/-3, size 0-0 line 3035 [ 815.265238] binder: undelivered TRANSACTION_ERROR: 29189 [ 815.270776] binder: undelivered TRANSACTION_ERROR: 29189 [ 815.344655] binder: BINDER_SET_CONTEXT_MGR already set 02:01:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xe00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:13 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x6000000000000000}, 0x0) [ 815.371900] binder: 10363:10368 ioctl 40046207 0 returned -16 [ 815.415933] binder: BINDER_SET_CONTEXT_MGR already set 02:01:13 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x4, 0xffffffff, 0x9, 0x7fffffff, 0x3}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 815.457538] binder: 10370:10371 ioctl 40046207 0 returned -16 [ 815.483091] binder: 10370:10378 transaction failed 29189/-22, size 0-0 line 2896 02:01:13 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x118, 0x2f) 02:01:13 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x4, 0x40000) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000040)={0xfff, 0x1000, 0x7fffffff, 0x40, 0xf, 0x6, 0x3, 0x80, 0x80000000, 0x6}) [ 816.167566] binder_alloc_mmap_handler: 2 callbacks suppressed [ 816.167582] binder_alloc: binder_alloc_mmap_handler: 10370 20001000-20004000 already mapped failed -16 [ 816.183302] binder: BINDER_SET_CONTEXT_MGR already set [ 816.188640] binder: 10370:10378 ioctl 40046207 0 returned -16 [ 816.189389] binder_alloc: binder_alloc_mmap_handler: 10390 20001000-20004000 already mapped failed -16 [ 816.194879] binder: undelivered TRANSACTION_ERROR: 29189 [ 816.212366] binder: BINDER_SET_CONTEXT_MGR already set 02:01:14 executing program 2: r0 = syz_open_dev$usb(&(0x7f0000001240)='/dev/bus/usb/00#/00#\x00', 0xe74, 0x8000) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000001280)=@assoc_value, &(0x7f00000012c0)=0x8) ioctl$FS_IOC_GETFLAGS(0xffffffffffffffff, 0x80086601, &(0x7f0000000000)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0xfc56) fcntl$notify(0xffffffffffffffff, 0x402, 0x15) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) preadv(r1, &(0x7f00000011c0)=[{&(0x7f0000000040)}, {&(0x7f0000000080)=""/59, 0x3b}, {&(0x7f0000000100)=""/4096, 0x1000}, {&(0x7f0000001100)=""/31, 0x1f}, {&(0x7f0000001140)=""/13, 0xffffffffffffff0c}, {&(0x7f0000001180)=""/60, 0x26}], 0x6, 0x0) 02:01:14 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x7d0d000000000000}, 0x0) 02:01:14 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:14 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x119, 0x2f) 02:01:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 816.219364] binder: 10390:10391 ioctl 40046207 0 returned -16 [ 816.224707] binder_thread_release: 5 callbacks suppressed [ 816.224717] binder: release 10390:10391 transaction 567 in, still active 02:01:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffd) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='syscall\x00') getsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000180)={r2, 0x60e}, 0x8) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000040)={0x57, 0xc3ce, 0x5387, {0x40, 0x6}, {0x6, 0x80000001}, @rumble={0x7, 0x60c4}}) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) openat$cachefiles(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/cachefiles\x00', 0x40002, 0x0) ioctl$KVM_S390_UCAS_MAP(r1, 0x4018ae50, &(0x7f0000000080)={0x8000000006, 0x0, 0x8}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0c620000f0c44948aaee5aa2a00f3b6e19866950363a9a746d5ad6e0942962be67056de1b21e3ee3c48857f1ba667f23a47cd5c1c45a55c2d270ce48795a0dc707648543f72e7133dbc7a1cbaba359e1482278d73fba580d2bc70b8367e209ee5d7da08b96c41e47de329d24aacccef325c4b0d0423204b41fa3bf3a4bd440c318d71531d750f0a44409744d05f39b126cfa6c478ca30d5229aef46e27816add12210000000000000000141b00613cabf86fa7f3542e053290f8d778636c4ea5d73a2215995cceeb5973781acc95a4434fee430090fece4cdc6fc4b643aa4af73bf281e4f6ebe89dc80a80b4831de9e32ec1c0e9572451754159d3a2b1d36f5392390e55ac84280da77d920ab875e94123d50992f8f482c2770cee6499775bb548678b91a7ed418176812d4d562be97181e21df710eb53b4b589edaae3cf3d0b980a51ab7d2426006fa5432144f750a3d6f2b911024a9a76e939ea14168104349803ac68b8a214864b1187ff7fcac1d0b6a9ecbe08b68a6825bd2c9b0340b234f7d7f92aacb2224e0e2a0ab85a5990020c"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) socket$rxrpc(0x21, 0x2, 0xa) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={r1, 0x7, 0x1, 0x2, &(0x7f0000000200)=[0x0, 0x0, 0x0], 0x3}, 0x20) write$P9_RSTATFS(r1, &(0x7f00000002c0)={0x43, 0x9, 0x1, {0x1, 0x5, 0x1, 0x52, 0x2, 0x0, 0x7fffffff, 0xcf8, 0x6}}, 0x43) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rfkill\x00', 0x8000, 0x0) [ 816.273572] validate_nla: 8 callbacks suppressed [ 816.273581] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 816.310779] binder: send failed reply for transaction 567 to 10370:10386 02:01:14 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x9effffff00000000}, 0x0) 02:01:14 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 816.335208] binder_release_work: 1 callbacks suppressed [ 816.335213] binder: undelivered TRANSACTION_COMPLETE [ 816.340599] binder: undelivered TRANSACTION_ERROR: 29189 [ 816.360083] binder_alloc: binder_alloc_mmap_handler: 10410 20001000-20004000 already mapped failed -16 02:01:14 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$IMDELTIMER(r0, 0x80044941, &(0x7f0000000040)=0x3) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 816.444645] binder: BINDER_SET_CONTEXT_MGR already set [ 816.467693] binder: 10410:10412 ioctl 40046207 0 returned -16 [ 816.475564] binder: BINDER_SET_CONTEXT_MGR already set [ 816.486640] binder: 10420:10423 ioctl 40046207 0 returned -16 02:01:14 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xc00e000000000000}, 0x0) [ 816.493316] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 816.503630] binder_alloc: 10410: binder_alloc_buf, no vma [ 816.519653] binder: 10420:10430 unknown command 25100 [ 816.535336] binder: release 10410:10412 transaction 569 out, still active 02:01:14 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4800}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 816.542326] binder: undelivered TRANSACTION_COMPLETE [ 816.548379] binder: 10410:10413 transaction failed 29189/-3, size 0-0 line 3035 [ 816.557811] binder: 10420:10430 ioctl c0306201 20000140 returned -22 02:01:14 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xf0ffffff00000000}, 0x0) [ 816.605162] binder: undelivered TRANSACTION_ERROR: 29189 [ 816.613153] binder: release 10410:10412 transaction 569 in, still active [ 816.623280] binder: 10420:10423 unknown command 25100 [ 816.640299] binder: 10420:10423 ioctl c0306201 20000140 returned -22 02:01:14 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) utimensat(r0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={{r1, r2/1000+10000}, {0x77359400}}, 0x0) 02:01:14 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x11a, 0x2f) 02:01:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 816.655259] binder: send failed reply for transaction 569, target dead [ 816.683565] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:14 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x3, 0x4000) mq_timedreceive(r1, &(0x7f00000000c0)=""/89, 0x59, 0x7f, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 816.793708] binder_alloc: binder_alloc_mmap_handler: 10449 20001000-20004000 already mapped failed -16 [ 816.822746] binder: BINDER_SET_CONTEXT_MGR already set [ 816.832909] binder: 10449:10450 ioctl 40046207 0 returned -16 02:01:14 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xffffff7f00000000}, 0x0) 02:01:14 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 816.840374] binder_alloc: 10449: binder_alloc_buf, no vma [ 816.849932] binder: BINDER_SET_CONTEXT_MGR already set [ 816.858597] binder: 10449:10452 transaction failed 29189/-3, size 0-0 line 3035 [ 816.871279] binder: 10455:10456 ioctl 40046207 0 returned -16 02:01:15 executing program 2: openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x20000, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 816.890882] binder: release 10449:10450 transaction 573 out, still active [ 816.911222] binder: undelivered TRANSACTION_COMPLETE [ 816.928036] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xa000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 816.950141] binder: undelivered TRANSACTION_ERROR: 29189 [ 816.976170] binder: release 10449:10450 transaction 573 in, still active 02:01:15 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xffffffff00000000}, 0x0) [ 817.002347] binder: send failed reply for transaction 573, target dead 02:01:15 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000000)=0xec) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5865}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:15 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x11b, 0x2f) [ 817.070209] binder_alloc: binder_alloc_mmap_handler: 10471 20001000-20004000 already mapped failed -16 [ 817.097724] binder: BINDER_SET_CONTEXT_MGR already set [ 817.112234] binder: 10471:10472 ioctl 40046207 0 returned -16 02:01:15 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0xfffffffffffff000}, 0x0) [ 817.161974] binder_alloc: 10471: binder_alloc_buf, no vma [ 817.210435] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 817.225320] binder: 10471:10474 transaction failed 29189/-3, size 0-0 line 3035 [ 817.229404] binder: release 10471:10472 transaction 576 out, still active [ 817.249922] binder: undelivered TRANSACTION_COMPLETE 02:01:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x20000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 817.268591] binder: undelivered TRANSACTION_ERROR: 29189 [ 817.288690] binder: release 10471:10472 transaction 576 in, still active [ 817.312194] binder: send failed reply for transaction 576, target dead [ 817.391410] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 817.419884] binder_alloc: binder_alloc_mmap_handler: 10498 20001000-20004000 already mapped failed -16 [ 817.438747] binder: BINDER_SET_CONTEXT_MGR already set [ 817.444341] binder: 10498:10500 ioctl 40046207 0 returned -16 [ 817.460654] binder_alloc: 10498: binder_alloc_buf, no vma [ 817.471419] binder: 10498:10501 transaction failed 29189/-3, size 0-0 line 3035 [ 817.501792] binder: release 10498:10499 transaction 579 in, still active [ 817.515437] binder: send failed reply for transaction 579 to 10498:10499 [ 817.522379] binder: undelivered TRANSACTION_ERROR: 29189 [ 817.534964] binder: undelivered TRANSACTION_COMPLETE 02:01:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x100000000000, 0x10, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x400, 0x0) ioctl$KDGKBDIACR(r2, 0x4b4a, &(0x7f0000000280)=""/127) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000240)=ANY=[@ANYRESDEC=r1, @ANYRES32=r2], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) getsockopt$XDP_STATISTICS(r2, 0x11b, 0x7, &(0x7f00000000c0), &(0x7f0000000100)=0x18) 02:01:15 executing program 2: r0 = accept4$rose(0xffffffffffffff9c, &(0x7f0000000000)=@full={0xb, @dev, @null, 0x0, [@default, @rose, @netrom, @remote, @remote, @rose]}, &(0x7f0000000040)=0x40, 0x80000) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000080)) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x7, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:15 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6558}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:15 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x11c, 0x2f) 02:01:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x3f000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 817.622600] binder_alloc: binder_alloc_mmap_handler: 10455 20001000-20004000 already mapped failed -16 [ 817.702175] binder_alloc: binder_alloc_mmap_handler: 10513 20001000-20004000 already mapped failed -16 [ 817.726601] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 817.737332] binder: BINDER_SET_CONTEXT_MGR already set 02:01:15 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f0000000000), 0x0, 0x0) 02:01:15 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6800}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 817.756334] binder: BINDER_SET_CONTEXT_MGR already set [ 817.761793] binder: 10519:10522 ioctl 40046207 0 returned -16 [ 817.769651] binder: 10513:10515 ioctl 40046207 0 returned -16 [ 817.802386] binder_alloc: 10513: binder_alloc_buf, no vma [ 817.804121] binder: 10519:10522 unknown command 808464432 [ 817.822020] binder: 10519:10522 ioctl c0306201 20000140 returned -22 [ 817.848474] binder: release 10513:10515 transaction 583 in, still active [ 817.860212] binder: send failed reply for transaction 583 to 10513:10515 [ 817.879671] binder: 10513:10527 transaction failed 29189/-3, size 0-0 line 3035 [ 817.891535] binder: 10519:10524 unknown command 808464432 02:01:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:16 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 817.897882] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 817.905644] binder: undelivered TRANSACTION_COMPLETE [ 817.910931] binder: 10519:10524 ioctl c0306201 20000140 returned -22 02:01:16 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_init_net_socket$llc(0x1a, 0x2, 0x0) preadv(r0, &(0x7f00000005c0), 0x0, 0x0) 02:01:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) fallocate(r1, 0x50, 0x18, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = fcntl$dupfd(r1, 0x406, r1) ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000000)=[0x6, 0x88]) 02:01:16 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x11d, 0x2f) 02:01:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x48000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 818.045202] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:16 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) r1 = getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000002c0)={{{@in6=@mcast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @initdev}}, 0x0, @in6=@empty}}, &(0x7f0000000080)=0xe8) stat(&(0x7f0000000100)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = geteuid() sendmsg$nl_generic(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)={0x1580, 0x3b, 0x114, 0x70bd27, 0x25dfdbfc, {0x1a}, [@nested={0x1134, 0x3d, [@generic="c64797d9c309b2fd43345b138b1ba7e77a924115a134074c326be42f0e7a797c64ccfee9aca89916c937f29a2b7209519294c07675f50718431ce41c12aff2873d3cb0eebd6d368caf1a9c4bc87784315c0c23267193cee3e3b5f6", @generic="f59c273e88d52c77299ce3bc0071509d4fe7d9b11ccfda7d3e65b00128fbedce08a3550c6662a817e140ba7cd6e0118d1c3af02725c0c0dde39f444031fdfaf284c0b1c4de1854b13441b0685805cb5653766e59ee7c7114722a54ec853997b761827ad49b9f", @generic="c1ead9232dd1b54f048729408eadad6c348f3fc2be6326191c075212f37fc00739f9803b20ea62e8311ee2414f221447d857aa3697c79a7fc19203048b1983686e60f8df88e64d2933d135dfbbb721c90034c602080e5e3539117383a9e4f8b233cb51d28f02435510182d9dd967f96deb4bd4911f429099a762c97e13c0dfc5aba9035ca875f62af1c4177f8ae2f886bf690d5d2797f9281c84b8bf5ab85c8bccdc1a58bad0880a334c368977d6a2542eefdce0a30134d2d2a2752331ee511ad18f73edfb02e4edcc9599e0a31dad9fd9e610f544103a6deff97b8a65e4dbf647d46b0320a5715126607e1882d547a8430d4cd6bc61ea409e46ba0cf704b23f18f0d9f6ac218dc5db7da39eb445f4243690cbcc1d0effcabaeca69733f2b68fd95351890bc256da0dc9e36862dc65334c11656ba5d76e4b46538b55ba32e1c5b027f88137ae471d37bf52d468077b5469caa113716c9060b28ea66149626b4c429cdd7c077d90d1e55cff6be4f4e3fde53f16bd724bd80414f0544f5bbd2f83dda7ab82ee69df52356a47a8cba671a86f7a5fa3552f7552f1385cf0429395f5caf3c421e8423ee1a3aec5cd608fc0a9be37c14a67344a056fff4a20351f70b81e65e1760c160a85656762ec9927f6695dee738f00abf46c2a0845889e11533a4ef3835bbebb946bc9fb1da1fcf8b3bed9fccba319879b0d7865e95444f9ffe38b000ebd275ab1d11a50628ae6744317f01a18d5e37a2a311be8e40547cb2734deb366abdeaa2a39bae212665711d655d41a844f83fd47178bd2a8fbbc1310a6e4b5696b36fb2ae5ba9f4108c6cfa50c1a9cad3118ef10ca970c5bf178cd923c3e43edcee426bc94e8dbcf350ff7cf9fdb825e9bdf2e97add9376ef3eba4fb1cf6667a36a7d5340a22f732a472700507db87de424988e9a1e5386fd3c24f0edf08685ae889a358a923271818a8645d952a91f6cc2f477777f217316eb25841f375100a504cab8a5b1d9d9c23872f8c5b03f3f601b89dafb1e82ee676ad78eca113614a1c05f6d5e5304188cf6a969713a35b50aaf2b8e4b1ef82bb775a58847f9bf4558573a292ce59afee602be64e2dd367e0b1be5b2d837490739478378e14a6630814d7c867f6c6b5c98822f46a001beea9abbb18171a32366d784a33071d2a3f1da4f4f44e6e780aea2ad104bc54b4308b26cc213cc92b74ac390c790ebefcf4925953a5b4eb473aab0f376cf2c8cd0a0f0adce4f077818e720227c586a8f32c0b695e3609a477bc9fd0cf50d8482d5cd2200e15207a5eae4cedd75336b52fd30815f190a52161370dd7da3da378a9aa7bcb551a030a37ca88627a13b0a031070dfe4ac0195cd3f2821663955627328bcd7d9c25af9f4b72ecf8e0b6b26a03af75e56b98efe51c2fd7b11c1e205c1c7304a04b7b48c61e8d32ca63ff8c6107687d39ed3099885fb54f1c061b0242b65c3ebdbabea702cda4cf247f9c9f6c92b5deedc8c9e192ebd77d0dbc6ea1eb031af308c0cc3491ff0b3d6799762eb8f39e4a67665084e1164fd86971fef2e01af5e3372c8f02c7d3615f2e24d0e74854c2eeb3807df2571a8dff92ad4f90fed915c976d47dd6d0d32c3ff2da5ea1d07c33b5eeb4071dab5994f4ca13fe1b5bc2787b8f67a54d95761fb75ce4dff7bcfd97c7091c39fada1a9fb613bc7d605151dc052004015a3d2dbc2985a56c7ae2bc977860f212afece6060097594ab38c2290a3ed2de16df29442e56dbb5eb14d8eadc27452d030d2967e165f69e6be8ef1e1f1be6d553ad41e8b0299002bfe29c4775b8e44a4246ced37a5da2fc094b6f2fe35ad8065a88c9f91230175480e7752c1ad8b694519c49f6ac756530cf7a35f89b6978a787ac9c1d14d2a85a810b44d4e36f8fe95b265d387dba8fd318ad11444493c204b017363d2c733c2f57d8dd5707b57d9be5e5c76c1c18a1573fdbbb03574ad0ead0167e88e2177ca3b643761e12aa13f3b739d869db462e6455fbcbe25de7106cc2250e1c70c3ffe1b1b469be01d7084b514c5a0604a8861a133abed89bd932a5903254fc6d8c38cca3b5c45e43658c6b9eda277d9cc60f2973547eccba25544e289317a5909285de0f2a7b92ef902233786e4ae3412b4be93a7dea960ced08a734b8e81e26ceeb39f9bed62faf7e34f13769b0c2b62dcd7a4a3a8d33f42b0a948af5c37759920eedf61c6be00fd7f6d99c27c7e22a78696cb704102203f49b119e465378c63a80d0676fa52d56e222f7a5d96f898836a49a6052d2751ee8273475cd0f205523ea78a93923a927d376db9d46129b3eecd4ec43834ea132e361580c02c0045e54126b5df90708e223c76f03fed3e659bdde66b27675255e9ea6d73cd73a8c3044dd914fd535b088d45c18aad39a0b9307d3df0fc353b7e174900867ce726ff8f6f5948e9876edb3c3e111db01db34e5986121dc914720f5b0ad59d8ac1ceb7cba6bf9367b17aa2b9575d628de3c56e241d26793bb51f35bd60a871ccfc036691f794b650a5767069ea0a854e662e37f6286b13f1edca671afce5aa50a45835b1084951865f3f4ca034c258349563370df26aa26c835661ee2a61da8b56be638f62e54718feefc494911ae1ec7be34eebcc8ecb9468dc4494db776a4f7c22fb32839547cfc9a482e0332798b34a0898e081ff3c4085906f3ffe9c164573f24cb463155d3b8bf5979f977b2f455f96c89b384e1e583f192725adb4f1b901be8c8f2186f62074b5894ee8801fd9a1fa836c027f64e61297a445ad91c3fe100b67ecf273ba7dd1a5b7d5f1075ee2f2a9e88aa5e2560499bde2894beb138498abd5c624c277552af69cb19a46493a105e821ab2ec1f5026d75913c0237fb26faad2ad223841bfd7963ca54116bc366c5d4eeff298c7623d2e330494430dab9e2d07fa82f3a77036d100bfe1b5d24cc87d2496a49f7e99732be1a1e4174c8aaeef6c5f6bd25d4925b150641161e7bf3a8bd1174df68c26c15fbe951f0565706d5d503c9e6b29b9f662d328e4efed065ba884d80a2839f0a309e733897bd6f5eac0a1b8ce616003fe868deeac985e92c3959ad34b2f859f3eab34e050b160947cebf970a83ec419ab14874955281287b29a41f6d9c78b2347c6a40cc130ddf0cba64dc2148c12f620a415dbb367652427c4fa353bb7abee67e4d4edeb71c78be3388f29b15ac1e67428df1fff3b2b00c2fd47b3ac90eadea780e0871f0e14bce3d462d0f4c7e972ab2f649fd54ad0b95328db50ea123477fb55ae85a6c893a45d6cedbd483b814fd0196b7216b1f42a5eec868d0d9fbcbce2462d0b957f40931b7f49cb563807301415e538fe46a52f4f1d138a85e40e13685a6eb10c832ee4c3a11cc8ac0447329c31c9a89fa454cc9ea55378a8b15c17845d7dcf0d8e3f925e91598c215caf992fefa91bf6e1b06c5822cd932370cde35a6074b84f8724b5512725fdb99347848f0240c6fb329ddb78cad7c6ff74d32df5efa963c0bf778ea9aeccc58b219655c8caa6d8335ae327f86486cec151cd978790e31478c9acd91774785e4b98f237e4ff846b691ab72721abd3c878cfb301009b4d8dd3f0f52cbf4f8d6839a3b05e9430cec9083ee7b5b76740654f58adfc0a507512309949e1c5bb15cdc3a590051db22b9f8c05aa864d45f6929f9f3f1b0db2a2b75d2a358cd634b3ab4f84f4e7b27ff8c751deba50f19e9afbb775882e076d29a65c7ef914da22cb35c2c7a3e5a9a400b0c8c9ba9b4111900f6074668460d0365decac4ff2f9a5a0d66c4f2193e8841d5f85dfdb080f8327fe2ca0f522c511908d33426b5f5cc581396680baf395aac5861a37475e41233f73f446ba09e34d985fcc60a20a39c8077531292ec98fc8178d52aec5d3362e86d6edc411395eaffe2f530a4fcee7991c55302254cb1e157e90acd75c706fb247c48dd13731e219e0d41cc9ae34131b1b7c073ce95e1687e5a3b5e678a8c60045662fc5c7f725393d90f9e52fb35b042a54f1624fcea11f2c287996be70a5bff050846f94f7eaf19f161154908ebedc6fa8ed6186b343ecd1a2f3892bf88a1ee7603b39639c67930617d5659b9e24546f8ec2a1e7345e6c0dfff02d374d3db572b647f73e9e3b5729a7785b6d17082fcfd94ae2c4369ecc424c0ee0d7aedf7f32ad76290b04da1690b2dec573f688584e7d3633d10938aa4a8fd4d872bb7c6f4f071d7594224e045cd109481b0aff5debeb773b78573bacf63704202c41af8d41af278e40b2270c98251b9240246490bba8329d5e412907cbf4110477a7f0b52d40c6fd06ae2c92cdce18d08dae9894b00157d455c63323e0db07b9a527feeae21bf1da6ade4ebfeba5622c75225693c6d187c61a8fc2cc1170eadd0c2717e2d3eca6befad65e8533a4f1266fd5e41e1d3ce977a678f76e5c0930c87cb23992a5e778a063864f9179a592e8b5ea4718862103eb98f7cd355c0e55bd1b530565b9bee6709ef284d37f3e98390ffd085283365bd8fd5b5166f6b6ac23e2bb5dffc16f7889fdd1e94183a076436daee2922a82326a10be83d2dde29199166595225406f3be62d8776250a60eceed4cde48a511cfc15a3dc74eb4249ac3e45d1c906d4c5fddc0d927710ae2e4531226e64f63adff49222937456b1d04f79a50a78b8ee74928c02352ba95fe377d63d36d72ee94c080f19b59f119e7055f2eced1d708a44712dd3914cb82ac3caac4dfef065f13441fa4f9a7664d3d5428ffab51dd6ab4969900793ec0fc647b3aabf3c13437030efa8a18ebdd15df7b4e97de882ce3aa0d21a88892d74379d3dffc8fce550eac2461ff790e34342f8b0b917ceb8c7eb6e6cbe3be300ac655f38570765830baab20353e3f11b0fbf8d456aab5bcf9a308a5efd0e74df17d080b3cb1a098cda7afd0ff3d41bebbe3772aa13cf8ccc9f265bc950778518ae9b3482d373bba04b016a8dbf3c045846241d4451c2a0250feec090d609695f1f62d8008dbec8ceb69b72f23145fa56abd18c3bb02f2a519fddad60b4dfd3fc7f84ae278ed22a9f609c51b1a31f8ce9d496ad7a939e043bc7a0b0955a23f9fb5c32230216a2e2cbdc27fe0c06918e60a0387cd69eb746c30b586a284d1cc063f8b68d0944c633c0c859d51f4da29800ab40d69f2e29ca8ef74fd0114a9b7aab9ab2eb008fc2f72382d3b7f63e8dcac72b24a337806fb79b07000868e3f4e39fada965b002ee710b15d067d015aa58a417bb03200ad87592c1c606a1b0c9dc44555ed1f432c8ed4da368d804b68c756aafaadd087efeb333db41f4f33868dd238607660e08c831053eaf651548dd4aead993f7063803da074c3978646cd7793c4c2fa7be342257d858759c50669b1fd8ba8a25062c439eb4e5ae2402df5fda0290b345c306ae485d09c3045e7c9d1cf1ca98ae3f8dd8245fdfdfd847df3a85b1e445739c4f61728e8ce49cc64926a8e54da5ee6147e86bf990a225da199918af0ede7dae08fd2c4d0deb4d0c5ad0811725c905f6be4f4efcbf4cfc511172de31609eb8bccc64f0f9684357ef2af02a8c4a1b18dded7cd067add754d5c9dfca82e1eeef4f858f501d9c4b51f2a88e7b486372fbf5bac7fc47a65f3a07d7b996586a6f6ebdef36fbc902f2a5bf533f87ad925d03bb721b5bbb78444ae29d4fa9e9923cd8ccd17bd4041e9d9804fad94c20667ec81f15c77108f0ad1c13412bedf74038dc5e0dad96d5b1fe3ccc585df288ebd96512598ff1e218d2c4995eeb7a27a94b3df02025c0692fd2be17e6eb3b8", @generic="d6982936ae773658c54c5f1b5cb9d0f2b71a339887f513a5d8773d382dbd60189d55eff86826d5d7572cfb275b84815a66c2000a72", @generic="4671003ffb4708b0a3ddd234ecc1aab5bf1dc2edcf09bc3f084d8d8eeaf9900fe9f709e5ca2d80e095c4ad090b89a28e8a20314fb86be6d1d2"]}, @nested={0x98, 0x5a, [@generic="07acb5eb57e06cc426b760663af0f68e2640ef08c30bbfe98c4a17b6e87aa7fca31a9410e8cd7a9c5e308e313e04acdeb12608d5d937e693eee9f203a89605806c50e4574693c9906db1417067c09de68e9c9dc2edafd86d286e9687d31cd99d005a25358d7268330589bb8afed86249257d7cddd97eb46cd955ae0d78b15c44619c2764", @typed={0x8, 0x8b, @uid=r2}, @typed={0x8, 0x83, @pid=r1}]}, @nested={0x2c8, 0x1a, [@generic="0327d2bc2afbec58cc0b91663b6ea069077c65e10dc1570588f1f09c89ef92097993a038e6d0d38be8f6148ddd9f65040f84baa58bdcd5f1d9d36ff31d8bc0a492c9cde6517ecc9c95eb575fcf47ff74f49390cbe6b23095056b302ce8f8080083d04f73a800aeb58019ddc7ffa78b12ac061fdcaf1c8a32e3660c24ee0754a252d795b4b005ed0ecc5e40604593aeaf8b3ed94f9e88ca6a3167619bf0a7516dc6cc5c1e9a2f9de78d6236044eb53f23a75010", @generic="24c435b3177f32d0dc234a4eb794fb346f245e995c364dabfade846ab432528b2f778393329c0dfccd4752067cf272d92cc8946a2fbcbf120082cc83be212f11c52f2c2e595f7185165fbb860a0195e0998d0b1cc92fcc78807247b706d5be87017e56f8ec0fd5ee2624093d52fd0a4470cf3ce0b73cfca54b4cda6b4bba6c7f57c89f8dcf8cca16cd226428220f958444fcc6b12b9bee44e64426ec3090e75cf0f5edcf32c85f0f43477da4366d9e1b9ef240ba2b4eeed5c811bdc2d99c0136eba8459002d4d1e572b8938d9be48ab82814d471f02d553ebfc08924aa8dc2b390", @typed={0x9c, 0x4f, @binary="b9bb63af81ca97a151927ece925ccf8f68dd84bbe7ff444ab0ab4a5959b7b739dd8f1d40555266f21b2b1082022b2027ef7b8f2258166241f33ccd184ac3dcb147fbe3f8e0b9f4fbf339f48b6ae415f32ccbdf019a5e1b3d4b955c125aa70210318a63174eebb62d32c1baaa94db986089b501b9ee3b19947a8b11d91d9aacf2d5c3f421bc30a358541a15d9401f0b53b41943ce083d"}, @typed={0x8, 0x5c, @uid=r3}, @typed={0x14, 0x94, @ipv6=@mcast2}, @typed={0x8, 0x70, @uid=r4}, @generic="c3e285432ff52026e33056b53d81df42a55dfbc06dd4c2d39e5a1ddf7336ea813d4d3327c05fa902e743640db816e25289570afc0b8f5026a360e9643ed53e8eeef6427c6cebf9b5edfbc3", @typed={0x10, 0x77, @str='net/rt_acct\x00'}, @typed={0x14, 0x8f, @ipv6=@mcast1}]}, @generic="94e8fa194f23bb5f8ae12280b2d5dac1d5d8f5699deeb756c28787eb7da3899d2b4fd0c64d29481a8fec9a8b61523641338e5b68c78ffd95208b01d580b9abb7179112ae274c0202365f039edef5e2932d5cbd252618889850e12685f05e874ede4560f36ca55063406551e75c2b469bfdc68d460c63736d804d1d5d8c3bc3053cf195d870b7cfae99eafa91fbcf44e542b9e2238f0d51468f5c65fa583fa172ce67e28d520bb5ed8d0b5b5e25828815e08f889fc55d079b6d535a88cdb9adf018673fc59c61606ee6e7f541594fa95f5dc8ab055c6f"]}, 0x1580}, 0x1, 0x0, 0x0, 0x4010}, 0x80) fcntl$lock(r0, 0x25, &(0x7f0000000000)={0x0, 0x0, 0x6, 0x57, r1}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x7) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:16 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7400}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 818.190076] binder: 10553:10554 ioctl 40084503 20000000 returned -22 [ 818.229513] binder_alloc: binder_alloc_mmap_handler: 10553 20001000-20004000 already mapped failed -16 [ 818.234719] binder: BINDER_SET_CONTEXT_MGR already set 02:01:16 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:16 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) r2 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) getsockopt$bt_BT_POWER(r2, 0x112, 0x9, &(0x7f0000000040)=0x1, &(0x7f0000000080)=0x1) [ 818.272400] binder: 10555:10563 ioctl 40046207 0 returned -16 [ 818.285218] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 818.292837] binder_alloc: 10553: binder_alloc_buf, no vma 02:01:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 818.351541] binder: 10555:10568 transaction failed 29189/-3, size 0-0 line 3035 02:01:16 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) setitimer(0x0, &(0x7f0000000040)={{}, {r1, r2/1000+30000}}, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="63000004b2e08a313b9b47ede8885b463c682a75cfdeb0a1383704ca424cbd758ee3350bb91f05566eef7207ce83cc4b655781cfa886b9872edcd7679a5bd03ec5a97f1aa8644b0717389e3aeb4e954b6adbeb0ce6eadcb3923bd1398417012f6f97487d8a5f3934ae88a6a23b7ba526ff467aebfc265f78f2abca46c31683fcfa11ca5801efc5905cf67a57776cd201ccf3c8cae6b4b647f7e523e355eb7fd4cade61008441ed9ca866eb0c0d55f6d927e8e04e0459ae32d2038b3f941b01d4ac21a884c817c4074bb43a4f243d3d347320c1118a"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:16 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$VIDIOC_SUBDEV_S_CROP(r0, 0xc038563c, &(0x7f0000000000)={0x10000000001, 0x0, {0x7fffffff, 0x6, 0x99, 0x103}}) socketpair$unix(0x1, 0x6, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r0, 0x114, 0x1, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) 02:01:16 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:16 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x11e, 0x2f) 02:01:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8100}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 818.595098] binder: 10584:10585 unknown command 67108963 [ 818.623792] binder: 10584:10585 ioctl c0306201 20000140 returned -22 [ 818.667188] binder_alloc: binder_alloc_mmap_handler: 10584 20001000-20004000 already mapped failed -16 [ 818.680049] binder: BINDER_SET_CONTEXT_MGR already set [ 818.686722] binder: 10584:10585 ioctl 40046207 0 returned -16 [ 818.693258] binder: 10584:10599 unknown command 67108963 [ 818.717895] binder: 10584:10599 ioctl c0306201 20000140 returned -22 02:01:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4c000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:17 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:17 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000001c0)={'vcan0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@mcast1, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @loopback}}, 0x0, @in=@dev}}, &(0x7f00000003c0)=0xe8) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={&(0x7f0000000140), 0xc, &(0x7f0000000400)={&(0x7f0000000880)=ANY=[@ANYBLOB="6c0200002000000427bd7000fcdbdf252b000000ac1414280000000000000000000000014e2200094e23eec90a00200011000000", @ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="e0001100fe880000000000000000000000000101fe800000000000000000000000000020ff0100000235000000000a00fe80000000000000000000000000002600000000000000000000ffffffffffff3c000000033500000a00000000000000000000000000000000000001ac1e01010000000000000000000000003f070000073500000a000000fe880000000000000000000000000101000000040000000000000000000000003e030000000000000a000200e0000002000000000000000000000000000000040000000000000000000000007f030000013500000a000200080019002500000008000b00060000001c01120061656769733132382d6165736e6900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007006000000000000bdb3a76e65d0cb1e5453bdc269f223f78bc9226db4ed230b6b661ef523245f53021a826efd32304780e1d6a335be10fc7aa74e3ce6e98e4505ac4ba35a2379504d2b84db3a8034f226466c13161a625a4781fc159c79f6ad1d7d070b9a1e2e63f00377267010d8d7d7cc70e1bea11fa85348e7214a39cc29b68df5e01d42614fd8b6b72a75f03481906a83195540e788c943e21c25e371e17a0da36b8475c07f62abfd499ac77cb5f157d35db4fb31c1791a48db9e37ce05a277f1d700000c001000000000000000000008000c0001000000eb9ac3d115ee0073516b1ce36b0f1db9c3ddba69bfa18da3a5073777d1dcb51f62bfaf000000000000000000"], 0x26c}, 0x1, 0x0, 0x0, 0x40}, 0x41) getsockopt$bt_sco_SCO_CONNINFO(r0, 0x11, 0x2, &(0x7f0000000480)=""/23, &(0x7f00000004c0)=0x17) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$vfio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vfio/vfio\x00', 0x10040, 0x0) ioctl$VIDIOC_QUERYCTRL(r0, 0xc0445624, &(0x7f0000000000)={0xebf7, 0x102, "f7bb9c11cb27e5c11a6d3e17f2eb9447925c044983ae0d42a820359e448ddbca", 0x8001, 0x3f, 0x9, 0x4, 0x20}) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) ioctl$IMGETCOUNT(r0, 0x80044943, &(0x7f0000000080)) 02:01:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa907}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:17 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000180)={{{@in=@empty, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @local}}}, &(0x7f0000000040)=0xe8) r3 = getgid() write$FUSE_CREATE_OPEN(r1, &(0x7f0000000280)={0xa0, 0x0, 0x6, {{0x4, 0x1, 0x80000000, 0x101, 0x8, 0x1be, {0x0, 0x0, 0x8001, 0x1, 0x2, 0x2, 0x7fffffff, 0x1f, 0x1ff, 0x1000, 0xfff, r2, r3, 0x0, 0xfffffffffffffff7}}, {0x0, 0x2}}}, 0xa0) getegid() ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00@'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:17 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x11f, 0x2f) [ 819.012481] binder_alloc: 10555: binder_alloc_buf, no vma [ 819.018162] binder: 10555:10577 transaction failed 29189/-3, size 0-0 line 3035 02:01:17 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 819.116739] binder: 10606:10615 unknown command 16384 02:01:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 819.151461] binder: 10606:10615 ioctl c0306201 20000140 returned -22 [ 819.179722] binder: BINDER_SET_CONTEXT_MGR already set 02:01:17 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_open_dev$rtc(&(0x7f0000000040)='/dev/rtc#\x00', 0x7fff, 0x101000) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(0xffffffffffffffff, 0xc034564b, &(0x7f0000000000)={0x6435, 0x63373179, 0x7, 0x7fffffff, 0x0, @stepwise={{0xcaf, 0x3}, {0x0, 0x100000001}, {0x9, 0x800}}}) preadv(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 819.204655] binder: 10616:10617 ioctl 40046207 0 returned -16 [ 819.204658] binder: BINDER_SET_CONTEXT_MGR already set [ 819.204678] binder: 10606:10615 ioctl 40046207 0 returned -16 02:01:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfeff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x60000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:17 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) prctl$PR_SET_TIMERSLACK(0x1d, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:17 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:17 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x120, 0x2f) 02:01:17 executing program 2: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/enforce\x00', 0x10000, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VIDIOC_G_FBUF(r1, 0x8030560a, &(0x7f0000000100)={0x8f, 0x28, &(0x7f0000000000)="d6e8b4e62596b6895a38c91b6a400bc5409a27e873a7e381b6ef4981d434429486d319baf902f70ed8b1caca60f5642dddd3c0e3378a1b4764270315d2bca6bdca4b348db43946d3eabe8bf616e09b50dcaa92edd2ff7ea41f037a4f667d31636be2b504b1043ad1298545f16c0620fb7754f7e5743515e466d811dc3f46ababfd4f7ec57b72b52ad45030916702cc736d4d5dcb54654b8e6857547cd180c84e27984c39d3d0c06eff03492c6fb6e361965cbba3f0f3ab252a8f7b4e626a70", {0x3, 0xffff, 0x31324d4e, 0xf, 0x2, 0x4, 0x1, 0x77}}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r2, &(0x7f0000000140)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) getsockopt$bt_sco_SCO_CONNINFO(r0, 0x11, 0x2, &(0x7f00000002c0)=""/240, &(0x7f00000003c0)=0xf0) [ 819.456832] binder: BINDER_SET_CONTEXT_MGR already set [ 819.485200] binder: 10639:10640 ioctl 40046207 0 returned -16 [ 819.499849] binder: BINDER_SET_CONTEXT_MGR already set [ 819.509868] binder: 10635:10650 ioctl 40046207 0 returned -16 02:01:17 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xff0f}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 819.536666] binder: release 10635:10638 transaction 596 in, still active [ 819.548873] binder: send failed reply for transaction 596 to 10639:10640 02:01:17 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = accept4$packet(0xffffffffffffff9c, 0x0, &(0x7f0000000080), 0x80000) getsockopt$sock_buf(r0, 0x1, 0x1c, &(0x7f0000000180)=""/179, &(0x7f00000000c0)=0xb3) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) ioctl$DRM_IOCTL_SET_VERSION(r2, 0xc0106407, &(0x7f0000000240)={0xaa0000, 0x5, 0x5, 0x1}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="86815621845a7803f4a19f440c190d1b3820bd61fc87d8648561ff032215df4aa72e7cc86550b362b41e79c4f58dbe66ec8bd38fc49ff91934c0c21a3e770b446cb3968bbf7e713cb795092efd88f3d76e672a5127b42458c59996eb7d"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:17 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='self\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:17 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffe}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 819.724407] binder: 10663:10666 unknown command 559317382 02:01:17 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x121, 0x2f) [ 819.780903] binder: 10663:10666 ioctl c0306201 20000140 returned -22 [ 819.831972] binder: BINDER_SET_CONTEXT_MGR already set [ 819.855515] binder: 10663:10676 unknown command 559317382 [ 819.875236] binder: 10663:10666 ioctl 40046207 0 returned -16 [ 819.905571] binder: 10663:10676 ioctl c0306201 20000140 returned -22 02:01:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x68000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:18 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$RTC_UIE_OFF(r0, 0x7004) ioctl$KVM_SET_MP_STATE(r0, 0x4004ae99, &(0x7f0000000000)=0x7) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000040)=@assoc_value={0x0, 0x200}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000000c0)=@assoc_id=r1, &(0x7f0000000140)=0x4) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000100)={r1, 0xfff}, 0x8) 02:01:18 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x34000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:18 executing program 0: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000100)={0xffffffffffffffff}) getsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f0000000980)={@dev}, &(0x7f00000009c0)=0x14) r1 = syz_open_dev$binder(&(0x7f0000000a80)='/dev/binder#\x00', 0x0, 0x7fc) r2 = syz_open_dev$binder(0x0, 0x0, 0x0) r3 = creat(&(0x7f0000000000)='./file0\x00', 0xb) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r3, 0x402c5342, &(0x7f0000000180)={0x1ff, 0x10001, 0x0, {}, 0xffffffffffff0001, 0x1}) ioctl$RTC_VL_CLR(r3, 0x7014) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00e9ff00"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000040)={r2, 0x0, 0x9, 0x2, 0x100}) getresgid(&(0x7f00000006c0), &(0x7f0000000700)=0x0, &(0x7f0000000740)) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000780)={{{@in=@remote, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@loopback}}, &(0x7f0000000880)=0xe8) syz_mount_image$hfsplus(&(0x7f00000000c0)='hfsplus\x00', &(0x7f0000000200)='./file0\x00', 0x7, 0x5, &(0x7f0000000640)=[{&(0x7f0000000240)="ad31e42d330a24b3f0c732e9dc647971c37d17e4259ec06a9890b067bb65744b097fec00231074e92a25e068510f1c8d911cd6d538881181d15e43d39e9125a9d053a8d60d14202522a2c93c37ff8203cf9e6a7a1cff461196af3f9b9a6475d94ec7008235f9933adab6e4ee526a7e2e8ed7f98424aad078e07f844cf74641870d1bca162463ac1134b1f8de2b8e060b50fc3678dc6a6bead51bcb06982db63a1c9929607984b3db0fc0f6e33cd098884fde37b53a25cc612b54394b80ec35830cdcb1f5605c2057e9ffb8e2aa1e4ead185c13fe219e98416340c71028ec5d91af990cde4f9d5f74359824f95a27e0880137a492494e04c777815891", 0xfc, 0xe60}, {&(0x7f0000000340)="22c8d840dcc21def0ebc886caf566aeb9f2de1ee5026c14bcba4c3eb323b3deb375756164e44ccf45d912f106ab9702d732ac21735aea832035c1b0e3045893662c8d6b0fbbb0700207baac162de1a218a89c4d108ab139d04f4d6267af3c1996a7467b9c02af6b446922b1a7bf42e2ebe0593408f2a3f205e380a3ff4deeb0bbd979aeeacf8246fa95345066dea9d525ca380c85fca55f661982b48464aac3f4456482dd4eb990cfd5f915db2488e41e46c2c3e813e", 0xb6, 0x6}, {&(0x7f0000000500)="183b1b5759a4505bc21d857ca4549b199596fe2383f4430a3d9e5a8c85cc57e76fd7af0ac07e335c9e758233b19dad3ef9a2c031176912e323b9f3d369b3fc6ff8d1eb963d41102406f8dc8fef5e12d61f992f0f20c827f2748e74e6e6750d8a584d0c09d3dbe4fa036394996828c9d54a3ab21dae657026cdf6d82d2ee50ef7049ebee0fff595a2256e9b1d068787bab1a78ff4642e8e887e172cfccdac8fef96e83ed47b50f7bae4108d0fc772ed0ba0918204", 0xb4, 0x6}, {&(0x7f0000000400)="ff5012181b9e04a318e82b73a9e13a5badef54e0152c67fd8c8ff6ddc24a894a197aa7eedd7afebd777e464a0597cad8f9303696c26249f251db0588c96e500ee64b2691e0e841227cbf22102dd3a96042542cc562d8c20b9338d9299d52085e0d8ac01eb23df9420f57", 0x6a, 0x2}, {&(0x7f00000005c0)="dc8203d0c4d94399e0db4a39f4cc2cbd4f4bc60eb77e559c40d760f51ff3527b2247ebb2a91e9d4cc2927b5ba4f32e609ccc1008367bba86f91f80099d93dc21ff42890babf6e64e6d14a3f422efc126490134a725e89a2652468a6981f4d7612f668aa14152", 0x66, 0x100000001}], 0x80000, &(0x7f00000008c0)={[{@force='force'}, {@gid={'gid', 0x3d, r4}}, {@umask={'umask', 0x3d, 0x100}}, {@session={'session', 0x3d, 0x783e}}, {@part={'part', 0x3d, 0x1f}}, {@barrier='barrier'}, {@nls={'nls', 0x3d, 'koi8-r'}}], [{@appraise='appraise'}, {@euid_eq={'euid', 0x3d, r5}}]}) ioctl$KVM_NMI(r3, 0xae9a) 02:01:18 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x122, 0x2f) [ 820.212556] binder_alloc: 10639: binder_alloc_buf, no vma [ 820.218278] binder_transaction: 2 callbacks suppressed [ 820.218295] binder: 10639:10686 transaction failed 29189/-3, size 0-0 line 3035 [ 820.231395] binder: undelivered TRANSACTION_COMPLETE [ 820.236591] binder_release_work: 7 callbacks suppressed [ 820.236597] binder: undelivered TRANSACTION_ERROR: 29189 [ 820.247538] binder: undelivered TRANSACTION_ERROR: 29189 [ 820.333331] binder: 10691:10695 unknown command 16771328 [ 820.362785] binder: 10691:10695 ioctl c0306201 20000140 returned -22 [ 820.369492] binder: BINDER_SET_CONTEXT_MGR already set 02:01:18 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:18 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup2(r1, r0) 02:01:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 820.379650] binder: 10688:10699 ioctl 40046207 0 returned -16 [ 820.431052] binder: BINDER_SET_CONTEXT_MGR already set [ 820.449863] binder: 10688:10699 ioctl 40046207 0 returned -16 [ 820.460705] binder: BINDER_SET_CONTEXT_MGR already set [ 820.475329] binder: 10691:10711 ioctl 40046207 0 returned -16 [ 820.487537] binder: undelivered TRANSACTION_COMPLETE [ 820.495618] binder: undelivered TRANSACTION_COMPLETE [ 820.514252] binder: 10691:10695 unknown command 16771328 02:01:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6c000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:18 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 820.539958] binder: 10691:10695 ioctl c0306201 20000140 returned -22 [ 820.576041] binder: send failed reply for transaction 601, target dead [ 820.582856] binder: send failed reply for transaction 602, target dead 02:01:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x400300}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:18 executing program 2: getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000000)={0x0}, 0xfffffffffffffffd) r1 = syz_open_procfs(r0, &(0x7f00000002c0)='net\x01\x01\x00\x00acct\x00:\xa1\xad\xc3\"\xc8\xe3 \xa1\x97<\xb4o\x9d\xea\xc6\xae\rw\xdd\xca\x80\x02\x87\x8d=k\xa0_]\xa5\x03R\x1b\x13Y\x06F!\xd5\x7fY\r\xe7\xba\xeb\x93\xd6\xc2\xca\xdfv\xb5dse\x8c\x99\xa0\x9cP\xf1H\xff\xf9\x02b\x11\x87L\x92<\xd7h(\x12c\x16\x02\xbb)`\x81\x11\xe0.~\x7f\xa5Q\xe7\xd2w\xfa{\xb4\xad`cw\xf0\x7f\x806oma\x95\xf5\xf7\'\xca7\x19\xed}\xea\xa3\x91/\x81\xef\xb0\xff6>\x9f\xf7\x00\xd7^\x13\xba\xa1\x96]+.\xae\xafer:\xaa\x89\xe4c\xc9\x9e\r\x9e\xff\xb0\xe7\x9f\n\xbb\xce\x0e_5\xc6\x02\xe7\x92\xdcl\xebf\x9c\xce\xeb\xd2\xa1G)Z\x1c\xe4I\xb5\xe2\x89\xa2\xd7E\xc8\xfd_?t\x18J\xb1\xd0\xd4\xdb`i%\xf2\x15\x13\xe6\x90\x91Fx\xfe\x8bn~\xa0\x9f6\x84\xcc%bE\x9e\xadV\xd7\x97r\xf9u\x87\xe1\aq') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r1, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) [ 820.654305] binder: BINDER_SET_CONTEXT_MGR already set 02:01:18 executing program 0: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x8000000000802) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x200000, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x70, r2, 0x1, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x400}]}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x3}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x4}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x20040010}, 0x0) 02:01:18 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x123, 0x2f) [ 820.684132] binder_alloc: 10722: binder_alloc_buf, no vma [ 820.710382] binder: 10722:10723 ioctl 40046207 0 returned -16 02:01:18 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 820.759319] binder: undelivered TRANSACTION_COMPLETE [ 820.765370] binder: 10722:10726 transaction failed 29189/-3, size 0-0 line 3035 [ 820.794127] binder: send failed reply for transaction 604, target dead 02:01:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 820.825686] binder: undelivered TRANSACTION_ERROR: 29189 02:01:19 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000000)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) 02:01:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x74000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:19 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 820.993923] binder: BINDER_SET_CONTEXT_MGR already set 02:01:19 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4a) preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/191, 0xbf}], 0x1, 0x0) socket$can_raw(0x1d, 0x3, 0x1) [ 821.021712] binder: 10751:10756 ioctl 40046207 0 returned -16 [ 821.070211] binder: BINDER_SET_CONTEXT_MGR already set 02:01:19 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 821.094318] binder: send failed reply for transaction 607 to 10751:10759 [ 821.106386] binder: 10738:10741 ioctl 40046207 0 returned -16 02:01:19 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x124, 0x2f) 02:01:19 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0c6300004aad78c370a28691ec31ab0600433f50b837cd2d582ef4f2c770b0f5477772522a9fb536700397330a3306a6439542422a21e7b32982418bb22fe85283a89376c8a2f7ed2da84e0b4b700f990be9d0ab0bda2c58416ea8070d07d42bdb252c8150265d7228e82b966f55f89f6ad71e86e1e715b2df8ee551bf7522e4d9ac2d4738760dd4"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:19 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @dev}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000240)='lo\x00\x00\x00\x00\xdf\xff\xff\xff\x00', 0x10) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000200)=0x7fffffffff, 0x4) sendto$inet(r1, 0x0, 0x0, 0x1000000020000000, &(0x7f0000000080)={0x2, 0x4e20}, 0x10) sendto$inet(r1, &(0x7f0000000240), 0x13f698e4b9e296e3, 0x0, 0x0, 0xffffffffffffff06) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000180)=0x1a0d, 0x4) close(r1) 02:01:19 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 821.317462] validate_nla: 13 callbacks suppressed [ 821.317472] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 821.368800] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:19 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 821.495911] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 821.781363] binder_alloc_mmap_handler: 9 callbacks suppressed [ 821.781383] binder_alloc: binder_alloc_mmap_handler: 10751 20001000-20004000 already mapped failed -16 [ 821.797147] binder: BINDER_SET_CONTEXT_MGR already set [ 821.802442] binder: 10751:10759 ioctl 40046207 0 returned -16 [ 821.809250] binder: undelivered TRANSACTION_COMPLETE [ 821.810245] binder_alloc: binder_alloc_mmap_handler: 10773 20001000-20004000 already mapped failed -16 [ 821.814371] binder: undelivered TRANSACTION_ERROR: 29189 02:01:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7a000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:19 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x125, 0x2f) 02:01:19 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 821.815141] binder_thread_release: 5 callbacks suppressed [ 821.815152] binder: release 10751:10798 transaction 609 out, still active [ 821.831841] binder: BINDER_SET_CONTEXT_MGR already set [ 821.849829] binder: undelivered TRANSACTION_COMPLETE 02:01:20 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 821.910042] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 821.912257] binder: 10773:10779 ioctl 40046207 0 returned -16 [ 821.917581] binder: release 10773:10779 transaction 609 in, still active [ 821.917593] binder: send failed reply for transaction 609, target dead 02:01:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 821.978272] binder_alloc: binder_alloc_mmap_handler: 10807 20001000-20004000 already mapped failed -16 [ 822.022415] binder: BINDER_SET_CONTEXT_MGR already set 02:01:20 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 822.046471] binder: 10807:10810 ioctl 40046207 0 returned -16 [ 822.079368] binder_alloc: 10807: binder_alloc_buf, no vma [ 822.080303] binder: release 10807:10810 transaction 611 in, still active 02:01:20 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 822.103704] binder: send failed reply for transaction 611 to 10807:10810 [ 822.120291] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 822.120436] binder: 10807:10811 transaction failed 29189/-3, size 0-0 line 3035 02:01:20 executing program 2: 02:01:20 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x126, 0x2f) [ 822.149321] binder: undelivered TRANSACTION_ERROR: 29189 [ 822.166802] binder: undelivered TRANSACTION_COMPLETE [ 822.173021] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 822.190349] binder: undelivered TRANSACTION_ERROR: 29189 02:01:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xfdfdffff, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:20 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:20 executing program 2: [ 822.362019] binder: BINDER_SET_CONTEXT_MGR already set [ 822.374709] binder: 10833:10838 ioctl 40046207 0 returned -16 [ 822.382704] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 822.427905] binder_alloc: binder_alloc_mmap_handler: 10821 20001000-20004000 already mapped failed -16 [ 822.474417] binder: BINDER_SET_CONTEXT_MGR already set [ 822.493501] binder: 10821:10845 ioctl 40046207 0 returned -16 [ 822.513808] binder: release 10821:10824 transaction 614 in, still active 02:01:20 executing program 2: r0 = socket$inet6(0xa, 0x3, 0xfb) r1 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x10000, 0x0) socketpair(0x3, 0x5, 0x80, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1d, &(0x7f0000000340)={@empty, 0x0}, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f00000003c0)={0x1d, r2}, 0x10, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0x4000810) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7f}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vsock\x00', 0x0, 0x0) ioctl$TIOCCONS(r3, 0x541d) ioctl$sock_inet6_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000180)={@mcast1, 0x1a, r2}) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000740)={0x0, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f00000001c0)=0x84) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000440)={r4, 0xae32, 0x1, 0xffffffffffffff00, 0x9, 0x8}, 0x14) openat$dsp(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dsp\x00', 0x8400, 0x0) ioctl$int_in(0xffffffffffffffff, 0x800000c0045002, &(0x7f0000000580)=0x100040000) ioctl$SIOCGETNODEID(0xffffffffffffffff, 0x89e1, &(0x7f0000000040)={0x4}) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000400)={0x1, 0x5, 0x3a, 0xffff, 0xffffffffffffffe0, 0xfffffffffffffffd, 0x8000, 0x20, 0x7, 0x8000, 0x5}, 0xb) r5 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r6 = socket$bt_rfcomm(0x1f, 0x0, 0x3) dup2(r6, 0xffffffffffffffff) ioctl$sock_bt_bnep_BNEPCONNDEL(r3, 0x400442c9, &(0x7f0000000140)={0x10000, @dev={[], 0x22}}) splice(r5, &(0x7f0000000080), r5, &(0x7f0000000240), 0x766, 0x0) clone(0x200000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'bond0\x00'}) ioctl$RNDADDENTROPY(r3, 0x40085203, &(0x7f0000000600)={0x0, 0xfa, "d38b9a0e8c785b1de44b79a1621b0c5d14673d6d757347f7872e73f3f6120be0c9d4491b28289ccddefb4ff20ecd141b6fe478cdfabd983fd608c9d1e758a4fc02495afbef2d78b04661e631d1a7f70e6644d30a3a0cb6dde2d7cd605fc6c2242acba8fced2dbf49a3fb57b2337e9daf1640e6ebacbdd2e147b2a87ad4488e2aaf71c7fe1633cd7044143b8bb992991e9a7db1324d233ea9d52fbc85122e421bcb7609a5211eb0f961456d9a5453721f0fbf28b2005bc5711d5f1a90d520dd653140a8a9f4fb83a8d7ba38b17c7d3f89d320ae78ab8b31b03eb3b73905dda08246de4dcfce16258a8e877bf8856770c134390df89d9b7ec92a51"}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'bond0\x00', 0x800000000008a03}) 02:01:20 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x4000, 0x4c) bind$vsock_dgram(r1, &(0x7f0000000080)={0x28, 0x0, 0x0, @hyper}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c350000aed226f4e281"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:20 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 822.528954] binder: send failed reply for transaction 614 to 10833:10841 [ 822.561765] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 822.659534] Unknown ioctl 21533 02:01:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:20 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x127, 0x2f) [ 822.693301] Unknown ioctl 1074021065 [ 822.717817] binder: 10855:10858 unknown command 13580 [ 822.735421] binder: 10855:10858 ioctl c0306201 20000140 returned -22 02:01:20 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 822.761236] binder_alloc: binder_alloc_mmap_handler: 10855 20001000-20004000 already mapped failed -16 [ 822.804030] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 822.824305] binder: 10855:10862 unknown command 13580 [ 822.824364] binder: BINDER_SET_CONTEXT_MGR already set [ 822.848162] binder: 10855:10858 ioctl 40046207 0 returned -16 02:01:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 822.874747] binder: 10855:10862 ioctl c0306201 20000140 returned -22 [ 822.942982] Unknown ioctl 1074287107 [ 823.154843] binder_alloc: binder_alloc_mmap_handler: 10833 20001000-20004000 already mapped failed -16 [ 823.176678] binder_alloc: 10833: binder_alloc_buf, no vma [ 823.182266] binder: 10833:10879 transaction failed 29189/-3, size 0-0 line 3035 02:01:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xfffffdfd, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:21 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:21 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 02:01:21 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x128, 0x2f) [ 823.303749] binder: BINDER_SET_CONTEXT_MGR already set [ 823.329696] binder: 10881:10886 ioctl 40046207 0 returned -16 02:01:21 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 823.351381] binder: undelivered TRANSACTION_ERROR: 29189 [ 823.362708] binder: undelivered TRANSACTION_COMPLETE [ 823.377571] binder_alloc: binder_alloc_mmap_handler: 10881 20001000-20004000 already mapped failed -16 [ 823.395206] binder: undelivered TRANSACTION_ERROR: 29189 [ 823.428867] binder_alloc: binder_alloc_mmap_handler: 10888 20001000-20004000 already mapped failed -16 [ 823.466432] Unknown ioctl 21533 [ 823.472935] binder: BINDER_SET_CONTEXT_MGR already set [ 823.479523] Unknown ioctl 1074021065 [ 823.509417] binder: 10888:10890 ioctl 40046207 0 returned -16 [ 823.509455] binder_alloc: 10888: binder_alloc_buf, no vma [ 823.548564] binder: 10888:10892 transaction failed 29189/-3, size 0-0 line 3035 [ 823.578140] Unknown ioctl 1074287107 [ 823.585167] binder: undelivered TRANSACTION_ERROR: 29189 [ 823.601231] binder: release 10888:10890 transaction 619 in, still active [ 823.616240] binder: send failed reply for transaction 619 to 10888:10890 [ 823.652447] binder: undelivered TRANSACTION_COMPLETE [ 823.657964] binder: undelivered TRANSACTION_ERROR: 29189 [ 823.665956] 8021q: adding VLAN 0 to HW filter on device bond0 [ 823.680794] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:22 executing program 2: r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video35\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) dup3(r1, r0, 0x0) 02:01:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) syz_init_net_socket$ax25(0x3, 0x0, 0xcd) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:22 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:22 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x129, 0x2f) 02:01:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x100000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 823.977799] binder_alloc: binder_alloc_mmap_handler: 10906 20001000-20004000 already mapped failed -16 [ 824.010277] binder: BINDER_SET_CONTEXT_MGR already set 02:01:22 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:22 executing program 2: clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0xa) wait4(0x0, 0x0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000000c0)={@empty, @mcast1, @ipv4, 0x20000000, 0x0, 0x0, 0x12a}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 824.035431] binder: 10906:10908 ioctl 40046207 0 returned -16 [ 824.037794] binder: BINDER_SET_CONTEXT_MGR already set [ 824.105332] binder: 10911:10913 ioctl 40046207 0 returned -16 [ 824.111346] binder_alloc: 10906: binder_alloc_buf, no vma [ 824.117266] binder: release 10906:10908 transaction 622 in, still active [ 824.124141] binder: send failed reply for transaction 622 to 10906:10908 [ 824.145462] binder_alloc: binder_alloc_mmap_handler: 10911 20001000-20004000 already mapped failed -16 [ 824.155088] binder: 10906:10917 transaction failed 29189/-3, size 0-0 line 3035 [ 824.170947] binder: undelivered TRANSACTION_COMPLETE 02:01:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x200000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:22 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x32000, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000040)={0xfffffffffffff000, 0x0, 0x4, 0x2, 0x0}, &(0x7f00000000c0)=0x10) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000100)={r2, 0x9}, &(0x7f0000000180)=0xc) 02:01:22 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:22 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) ioctl$VT_OPENQRY(r1, 0x5600, &(0x7f0000000080)) setsockopt$inet_buf(r0, 0x0, 0x3b, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000040)) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) stat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000340)) socket$alg(0x26, 0x5, 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r2 = creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000200)='team\x00') getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) ioctl$KVM_SET_CLOCK(r2, 0x4030ae7b, &(0x7f0000000140)) r3 = accept(0xffffffffffffffff, 0x0, &(0x7f00000040c0)) getsockname$packet(r2, 0x0, &(0x7f00000041c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) r4 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611) mkdirat(r4, &(0x7f0000000040)='./file0\x00', 0x0) mkdirat(r4, &(0x7f00000001c0)='.//ile0\x00', 0x1) renameat(r4, &(0x7f0000000240)='.//ile0\x00', r4, &(0x7f00000000c0)='./file0/f.le.\x00') chroot(&(0x7f0000000100)='./file0\x00') [ 824.364248] binder: BINDER_SET_CONTEXT_MGR already set 02:01:22 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x12a, 0x2f) 02:01:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 824.389683] binder: 10945:10948 ioctl 40046207 0 returned -16 [ 824.415783] binder: BINDER_SET_CONTEXT_MGR already set [ 824.421091] binder: 10939:10940 ioctl 40046207 0 returned -16 02:01:22 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 824.462214] binder: release 10939:10940 transaction 626 in, still active [ 824.473153] binder: send failed reply for transaction 626 to 10945:10953 02:01:22 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0c630000abdce4e05bd1be2ca1b22e27504730fa0e0e03800ae8b3a5faa6b3806af5725347b1d511d44e8ba5b21b55d19e68620e66439053432479d13f604f1df5b423b16c274ad60d8d651c97401d83f87c55669dfc51e78521961418214fd0c3a0f6b2afb8469d86d5573b7101f9888a8bc1dd3ab2f5c6d616091fd88bb689ef22ad3fa3f3f0bfd6f1314c"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:22 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 824.736463] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000203) [ 824.773872] FAT-fs (loop2): Filesystem has been set read-only 02:01:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x300000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:23 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:23 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x12b, 0x2f) 02:01:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:23 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) ioctl$VT_OPENQRY(r1, 0x5600, &(0x7f0000000080)) setsockopt$inet_buf(r0, 0x0, 0x3b, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000040)) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) stat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000340)) socket$alg(0x26, 0x5, 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r2 = creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000200)='team\x00') getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) ioctl$KVM_SET_CLOCK(r2, 0x4030ae7b, &(0x7f0000000140)) r3 = accept(0xffffffffffffffff, 0x0, &(0x7f00000040c0)) getsockname$packet(r2, 0x0, &(0x7f00000041c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) r4 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611) mkdirat(r4, &(0x7f0000000040)='./file0\x00', 0x0) mkdirat(r4, &(0x7f00000001c0)='.//ile0\x00', 0x1) renameat(r4, &(0x7f0000000240)='.//ile0\x00', r4, &(0x7f00000000c0)='./file0/f.le.\x00') chroot(&(0x7f0000000100)='./file0\x00') [ 825.159686] binder: BINDER_SET_CONTEXT_MGR already set [ 825.165672] binder: 10945:10953 ioctl 40046207 0 returned -16 [ 825.167052] binder: BINDER_SET_CONTEXT_MGR already set [ 825.177826] binder: release 10945:10986 transaction 628 out, still active [ 825.184768] binder: undelivered TRANSACTION_COMPLETE [ 825.190279] binder: 10970:10973 ioctl 40046207 0 returned -16 [ 825.200331] binder: release 10970:10973 transaction 628 in, still active 02:01:23 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 825.270067] binder: send failed reply for transaction 628, target dead [ 825.296517] binder: undelivered TRANSACTION_COMPLETE 02:01:23 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 825.317731] binder_release_work: 2 callbacks suppressed [ 825.317737] binder: undelivered TRANSACTION_ERROR: 29189 [ 825.333153] binder: BINDER_SET_CONTEXT_MGR already set 02:01:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 825.412782] binder: 10997:10999 ioctl 40046207 0 returned -16 [ 825.413343] binder: release 10997:10999 transaction 630 in, still active [ 825.449109] binder: 10997:11002 transaction failed 29189/-22, size 0-0 line 2896 [ 825.456028] binder: send failed reply for transaction 630 to 10997:10999 [ 825.464063] binder: BINDER_SET_CONTEXT_MGR already set [ 825.474124] binder: 11001:11012 ioctl 40046207 0 returned -16 [ 825.491254] binder: undelivered TRANSACTION_COMPLETE 02:01:23 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 825.509893] binder: undelivered TRANSACTION_ERROR: 29189 [ 825.529599] binder: undelivered TRANSACTION_ERROR: 29189 02:01:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x400000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:23 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:23 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x12c, 0x2f) 02:01:23 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) ioctl$VT_OPENQRY(r1, 0x5600, &(0x7f0000000080)) setsockopt$inet_buf(r0, 0x0, 0x3b, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000040)) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) stat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000340)) socket$alg(0x26, 0x5, 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r2 = creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000200)='team\x00') getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) ioctl$KVM_SET_CLOCK(r2, 0x4030ae7b, &(0x7f0000000140)) r3 = accept(0xffffffffffffffff, 0x0, &(0x7f00000040c0)) getsockname$packet(r2, 0x0, &(0x7f00000041c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) r4 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611) mkdirat(r4, &(0x7f0000000040)='./file0\x00', 0x0) mkdirat(r4, &(0x7f00000001c0)='.//ile0\x00', 0x1) renameat(r4, &(0x7f0000000240)='.//ile0\x00', r4, &(0x7f00000000c0)='./file0/f.le.\x00') chroot(&(0x7f0000000100)='./file0\x00') [ 825.709330] binder: BINDER_SET_CONTEXT_MGR already set 02:01:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x65580000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 825.735340] binder_alloc: 11019: binder_alloc_buf, no vma [ 825.754617] binder: BINDER_SET_CONTEXT_MGR already set [ 825.760550] binder: 11019:11029 ioctl 40046207 0 returned -16 02:01:23 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 825.784750] binder: 11024:11032 ioctl 40046207 0 returned -16 [ 825.784787] binder: undelivered TRANSACTION_COMPLETE [ 825.800376] binder: 11019:11030 transaction failed 29189/-3, size 0-0 line 3035 [ 825.844327] binder: send failed reply for transaction 634, target dead [ 825.856806] binder: undelivered TRANSACTION_ERROR: 29189 02:01:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x500000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:24 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 825.984170] binder: BINDER_SET_CONTEXT_MGR already set [ 826.000947] binder_alloc: 11047: binder_alloc_buf, no vma [ 826.014057] binder: 11047:11050 ioctl 40046207 0 returned -16 02:01:24 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 826.034789] binder: 11047:11051 transaction failed 29189/-3, size 0-0 line 3035 02:01:24 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x12d, 0x2f) [ 826.077017] binder: send failed reply for transaction 637, target dead [ 826.095350] binder: undelivered TRANSACTION_ERROR: 29189 02:01:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x600000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:24 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:24 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 826.283570] binder: BINDER_SET_CONTEXT_MGR already set [ 826.325178] binder_alloc: 11066: binder_alloc_buf, no vma [ 826.353554] binder: 11066:11069 ioctl 40046207 0 returned -16 [ 826.361569] binder: 11066:11070 transaction failed 29189/-3, size 0-0 line 3035 [ 826.361926] binder: send failed reply for transaction 640 to 11066:11069 [ 826.377575] validate_nla: 13 callbacks suppressed [ 826.377599] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 826.394866] binder: undelivered TRANSACTION_ERROR: 29189 [ 826.418353] binder: undelivered TRANSACTION_ERROR: 29189 02:01:24 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x5, 0x40800) getsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000040), &(0x7f00000000c0)=0x4) r1 = syz_open_dev$binder(0x0, 0x0, 0x800000000002) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:24 executing program 2: 02:01:24 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x700000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:24 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:24 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x12e, 0x2f) [ 826.594630] binder: BINDER_SET_CONTEXT_MGR already set 02:01:24 executing program 2: [ 826.615235] binder_alloc: 11085: binder_alloc_buf, no vma [ 826.635289] binder: 11085:11092 ioctl 40046207 0 returned -16 [ 826.641380] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 826.649888] binder: 11085:11094 transaction failed 29189/-3, size 0-0 line 3035 02:01:24 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x2, 0x0) accept4$nfc_llcp(r1, &(0x7f00000000c0), &(0x7f0000000040)=0x60, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0c6300008e9fb26a16fc56a863cc4459bb7c4374a351aeb375d237bbaeaa2174"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000080)=@assoc_value={0x0, 0x2e}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000200)={0x0, 0x8000, 0xff, 0x401, r2}, 0x10) 02:01:24 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 826.679256] binder: send failed reply for transaction 644, target dead [ 826.686744] binder: undelivered TRANSACTION_ERROR: 29189 02:01:24 executing program 2: 02:01:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xa00000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:24 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7a000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:25 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 826.908712] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 826.939217] binder_alloc_mmap_handler: 10 callbacks suppressed [ 826.939233] binder_alloc: binder_alloc_mmap_handler: 11113 20001000-20004000 already mapped failed -16 02:01:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x81000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x40106614, &(0x7f00000000c0)={0x0, @aes256}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0xf2eb, 0x200100) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000040)) 02:01:25 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x12f, 0x2f) [ 826.970546] binder: BINDER_SET_CONTEXT_MGR already set 02:01:25 executing program 2: [ 827.029509] binder: 11113:11117 ioctl 40046207 0 returned -16 [ 827.036145] binder_thread_release: 7 callbacks suppressed [ 827.036156] binder: release 11113:11117 transaction 647 in, still active 02:01:25 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 827.093498] binder: send failed reply for transaction 647 to 11113:11117 [ 827.119507] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 827.129386] binder_release_work: 3 callbacks suppressed [ 827.129391] binder: undelivered TRANSACTION_COMPLETE 02:01:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x2000000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 827.157398] binder: 11132:11135 ioctl 40106614 200000c0 returned -22 02:01:25 executing program 2: [ 827.204342] binder: undelivered TRANSACTION_ERROR: 29189 [ 827.222892] binder: BINDER_SET_CONTEXT_MGR already set [ 827.230891] binder_alloc: binder_alloc_mmap_handler: 11132 20001000-20004000 already mapped failed -16 02:01:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x88a8ffff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 827.259882] binder: 11132:11139 ioctl 40106614 200000c0 returned -22 [ 827.274198] binder: 11137:11138 ioctl 40046207 0 returned -16 [ 827.275454] binder_alloc: 11132: binder_alloc_buf, no vma 02:01:25 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 827.306774] binder: BINDER_SET_CONTEXT_MGR already set [ 827.329459] binder: 11132:11135 ioctl 40046207 0 returned -16 [ 827.336799] binder: 11137:11144 transaction failed 29189/-3, size 0-0 line 3035 02:01:25 executing program 2: 02:01:25 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x82, 0x0) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f0000000040), 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 827.389916] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 827.411037] binder_alloc: binder_alloc_mmap_handler: 11137 20001000-20004000 already mapped failed -16 02:01:25 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x130, 0x2f) 02:01:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9effffff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 827.456731] binder_alloc: 11137: binder_alloc_buf, no vma [ 827.521305] binder: 11137:11153 transaction failed 29189/-3, size 0-0 line 3035 [ 827.534464] binder: BINDER_SET_CONTEXT_MGR already set 02:01:25 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:25 executing program 2: [ 827.568995] binder: 11157:11162 ioctl 40046207 0 returned -16 [ 827.569206] binder: undelivered TRANSACTION_ERROR: 29189 [ 827.606406] binder_alloc: binder_alloc_mmap_handler: 11157 20001000-20004000 already mapped failed -16 02:01:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x3f00000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 827.641900] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:25 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:25 executing program 2: 02:01:25 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x2000000, 0x100010, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) [ 827.748327] binder_alloc: binder_alloc_mmap_handler: 11174 20001000-20004000 already mapped failed -16 02:01:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa9070000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 827.839813] binder: BINDER_SET_CONTEXT_MGR already set [ 827.885725] binder: 11174:11179 ioctl 40046207 0 returned -16 [ 827.900417] binder: release 11174:11179 transaction 654 out, still active [ 827.902622] binder: BINDER_SET_CONTEXT_MGR already set [ 827.912855] binder_alloc: 11174: binder_alloc_buf, no vma [ 827.913246] binder: undelivered TRANSACTION_COMPLETE [ 827.925147] binder: 11187:11189 ioctl 40046207 0 returned -16 02:01:26 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x131, 0x2f) 02:01:26 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:26 executing program 2: [ 827.935722] binder: release 11174:11179 transaction 654 in, still active [ 827.950717] binder: 11174:11180 transaction failed 29189/-3, size 0-0 line 3035 02:01:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) fstatfs(r1, &(0x7f0000000200)=""/113) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="02007c7a51b05cf55aa3674b948173e20e003ea31aa76ba629c75d6d5f6427fea7c80900000000000000a3becbc7fcf032a8057fb0db461c3feb04488728c9c54df17d83129cf87ae00460b40bd216c7172466befe4471c32d15b8ca66d6784515bc58bfcf61379d4941872a0d0e0ec490f4959500d19d2b"], 0xfffffffffffffd54, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vsock\x00', 0x40004000404, 0x0) ioctl$NBD_SET_SIZE(r2, 0xab02, 0x1000) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000280)={r2, &(0x7f0000000080), &(0x7f0000000100)=""/19}, 0x18) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x10200, 0x0) connect$pptp(r3, &(0x7f0000000040)={0x18, 0x2, {0x2, @rand_addr=0x97}}, 0x1e) [ 827.980260] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 827.986687] binder: send failed reply for transaction 654, target dead 02:01:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4800000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:26 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:26 executing program 2: [ 828.139457] binder: 11204:11207 unknown command 2054946818 [ 828.150053] binder: 11204:11207 ioctl c0306201 20000140 returned -22 [ 828.206283] binder: BINDER_SET_CONTEXT_MGR already set [ 828.214391] Unknown ioctl 43778 [ 828.235098] binder: 11208:11211 ioctl 40046207 0 returned -16 [ 828.245370] binder_alloc: binder_alloc_mmap_handler: 11204 20001000-20004000 already mapped failed -16 [ 828.252045] binder_alloc: 11204: binder_alloc_buf, no vma [ 828.267961] binder: BINDER_SET_CONTEXT_MGR already set [ 828.273840] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 828.285563] binder: 11204:11216 ioctl 40046207 0 returned -16 [ 828.291704] binder: 11204:11207 unknown command 2054946818 02:01:26 executing program 2: 02:01:26 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 828.300438] binder: 11208:11217 transaction failed 29189/-3, size 0-0 line 3035 [ 828.303479] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 828.333422] binder: 11204:11207 ioctl c0306201 20000140 returned -22 02:01:26 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x132, 0x2f) [ 828.378632] Unknown ioctl 43778 02:01:26 executing program 2: 02:01:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfeff0000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:26 executing program 0: socket$inet_sctp(0x2, 0x3, 0x84) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x0, 0x4000) ioctl$VIDIOC_G_INPUT(r1, 0x80045626, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0), 0x8d, 0x0, &(0x7f0000000180)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802d10768b86c452a986726810b17dc59f54771adf4037ee6484b8bb156f7ff0d0410b8276f6b88b2b2313fd617533c495e70e8b228e6301e9a367883329b0a02eefbf6213bae"}) 02:01:26 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:26 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000400)={@dev}, 0x14) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) dup2(r1, r0) [ 828.546436] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x4c00000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xff0f0000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:27 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x133, 0x2f) 02:01:27 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:27 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") syz_mount_image$msdos(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) mkdirat(r1, &(0x7f00000001c0)='.//ile0\x00', 0x0) renameat(r1, &(0x7f0000000240)='.//ile0\x00', r1, &(0x7f00000000c0)='./file0/f.le.\x00') [ 828.988164] binder_alloc: binder_alloc_mmap_handler: 11208 20001000-20004000 already mapped failed -16 [ 828.998142] binder: BINDER_SET_CONTEXT_MGR already set [ 829.003437] binder: 11208:11217 ioctl 40046207 0 returned -16 [ 829.006871] binder: release 11208:11223 transaction 659 out, still active [ 829.020992] binder: undelivered TRANSACTION_COMPLETE [ 829.094839] binder: BINDER_SET_CONTEXT_MGR already set [ 829.110928] binder: 11258:11263 ioctl 40046207 0 returned -16 02:01:27 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffa888}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:27 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x134, 0x2f) 02:01:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 829.399097] binder: BINDER_SET_CONTEXT_MGR already set [ 829.404532] binder_alloc: binder_alloc_mmap_handler: 11238 20001000-20004000 already mapped failed -16 [ 829.414766] binder: 11238:11287 ioctl 40046207 0 returned -16 [ 829.442462] binder: send failed reply for transaction 659, target dead [ 829.450681] binder: send failed reply for transaction 660 to 11258:11263 02:01:27 executing program 0: r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x1, 0x2) setsockopt$RDS_GET_MR(r0, 0x114, 0x2, &(0x7f00000000c0)={{&(0x7f0000000180)=""/232, 0xe8}, &(0x7f0000000040), 0x19}, 0x20) syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) setsockopt$inet_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000100), 0xfffffffffffffed9) r2 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x51a, 0x3ffd) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000002700)={0x80000000, {{0x2, 0x4e23, @empty}}}, 0x88) listxattr(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)=""/54, 0x36) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x126, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0c63c620ad00009407950454e732b69877ddcf3d2de4925d27abb7b104fbdb0bbd56b3564ca8c964677c3b2b383b2dbdbac5a76f2003e82d00000000000000009efccf5b2df3bfb3749c2eb9f6eccf489804a6d16db0e337b8e3bb1cbe82c450a1890434f65bf31f7b65925ece8fd787d09c438d30ad4f655593fd72b2f54134dca662389c030ee756d936bf487ed652f2161aa8f75884c182286a710a2a99396c28b80c1e0db1765ddd8ac5543b4d5447face09d10c6f0624d437b6f4f166df09d0a36bc512d103da03d0cdf6a736fb0ae96c68c64609ceebb326cec5c78e5e924ff5acfd855eb2d8c64f9d47196b8f70167fdb92bd001f3e074ef557ff47d5b2e56bc010188034eb3fbdc083da083b1580105c94000000000000"], 0x48, 0x0, &(0x7f0000000280)="f27aed438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846754ad778316094e4bee8cab76761555d3676404fb3c728f044b5186e6ea70934e825f7d9ecc9b26"}) 02:01:27 executing program 2: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000240)='/dev/uhid\x00', 0x1, 0x0) write$UHID_SET_REPORT_REPLY(r0, &(0x7f0000000000), 0xc) 02:01:27 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 829.599045] binder: 11298:11300 unknown command 549872396 [ 829.608585] binder: 11298:11300 ioctl c0306201 20000140 returned -22 [ 829.636195] binder_alloc: binder_alloc_mmap_handler: 11298 20001000-20004000 already mapped failed -16 02:01:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6000000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:28 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x135, 0x2f) 02:01:28 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:28 executing program 2: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000240)={0xb, 'syz0\x00', '[yz1\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00 \x00', 'syz1\x00', 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, "80ac39"}, 0x11b) write$UHID_INPUT(r0, &(0x7f0000000400)={0x8, "bebcba98a255045edb5c9d6ad3a5810e4da41ab4a65e57673df27891e78c16b3fdd6695abacccca999f32bc14f8940f46b42ec7d9a62b866d9c102b439ba932583ff7e1d5372b2a4dae33bdfaf5608d3473829ce58c17b44e6588c4c941c7402ed10574dd0026877d15c6d7c5d6a7f320f8b11e631aab805cdc40d2cd8fb1c70affa34486cb1b2b1a4f8895495d1cfcc582003ea63cf973455af139bacc4bf0b1c457c2e893a3abf89fc0781a880a43bc55c3da75a2002587a371bfd7815046a429eb185498f4553eff502819f0823a53d449349333e8a4c279dfaa3e670f688b31012d967b6115ce3db11cf60aeb32c43abf7baa0b1821f4483be4c0ad92a7a4c33a2da91f76e8c8470fe63d8fe85d85e4286a3f47d118ae86a16513d9b5c6fffee0356797fdd23329a832352783a701a194f9eebb890ab2cdb3af2163831353e273f85049aaa2c7c18830d16de2cccaded366acf7e2c5f7f1a800da8fa125f83f9d29938900cef5696a3243182c477cd6ba68e105c1dd89528431759849bd43f16243c7c70377f16ce715c0435e1e3d66f1e0f02c75b3619fe502ae337cec79ba031ed8e0f2d79a44e72db264f85194649ecbaaf9bb98eb14cdc7ae1879dbb9777ee5d4e87c7dfdc7369a99610e8ee33e8e6cf9264199434fa2bebb1d672b773cd105ebcbdb684aab83d699ba3c2f91414ecc3cf72890d489e9b848b4be364a8a0b005f50a99c99e90a5ab6820534937fa64f8654da9e3fad6ae11c54c0716fb578f87c0e11c2935f8f3c197ffc1bbb955cd783d9a0b2a85c485550ed484f9acea487313d3b7780a3d54fa9bedcef35e0a42df5f04f996bdceb2811f36fdea896785d9bfd4dd07bb1d8454b229095f039dae79f790f74ae1cf278ab04836c24e36c5615bdc06b6cbc0ea93a1997906162b94bf9e35d611411883ab17985a64e2558c7181b46c351a54dd0081ec0a15ffc46e8aaf0a5313d1309a07f79b5273299d97bcbc18138aea1ec83ae460b9ac46a95d2008078c95a3eaa041a5b38197e9673153814515be8cbd4ec0bd80a3cad776b7732e53f20b33be53ea2e5bafde3e904375fe09321309502043052f87a8c0e6480a26f7631300b98e1ec16c8b95e7e980ad87aaa099d8fc574e1ae8f1455a8fa1c2c54b2e44c6309bda328d8775cccc2f342f4ef7ef069794e504c201c8a4a3a5e82595f3fbfbc9895ed3c5681a2600e5d4d7cd907d06bc318b7fa50e5c2d0f0b7956d15ec672d26fc2ef0f99094e07f327f8d4b329e565f37a03eab851db9dd5b01aec88329106b300cbd3cfb82e56b198594961532ac5269a8a4364085219bf5cf0ad13ec509a6286fb934b8d0fd25ea71abcf9aaa97454cc8abb121fded02ca719daf0a9b32e3621be7f35f8c36ae5da904087a3641547a576869658070776331adc7c2ebcdde732f78b473e6b096345835bcc9659a6997a3ab374f5282a4bf211b797e35fe6ca02caa2ea1f20ae449791eed740876963242ea95bbe7eceb91311a13ed49303e808258ca064126bee5d807ccfd9fc039a367df4869b89b88ffea7b85c3f8ea11c1f30e726a96955a99af2be5e918ca074f27e270ea0158af84a2181b08b54b5cdf7d787bb0ab4bc96cc5b72fb94be669406c1b1cb525e1b7f31c204ff39ee6aba024e88e4653c2311e984d1649370e5004eee9ac72dc27136109c52df1e21dc4646d0882eed70d7f27f30cdb5cf09d5ee14af05f24f2bbd4b56381106db79d1ff0514c07d6055a33287841f90bb699dc2d8bb38864b245729840f6651c8bce7c05f3dd1eb79ad9479f7e7861296829add681f02a14603da931350d76f9ec7f4ad90158c269e93c0e7070b244282022721ae62834f31c87ece4c9e1e837b2a27aa08d7b0414425b0213a592660cb92e2c4a688c85778dbc9df1cb17388039850eec8912dd3c52ccd2e8e07dacc6590aee4214fb890e790b160d09256d25f4b1abe355e09bdf68a953880f5c21a8988ab04e8e0c9cc169a567f5c178ab7c1c45a40c6944926971f8d50af80b9f405d1834fbec450508908e10c367f77cd5f5cfa44d41456b5ed2da8450ede2dd0e6db5368c6ebdfe55bfc7c5148518e9327a17897de24480e41571fe5442bec3aeb406c4b02f0cd1159fd2a544c730c5222c11d9d8dac8af0b5a2d6ef83cd70b97b8de2814ba3a1d93d926df069a5fb736231e420d9fc6b90b0196281adcf4a8118121cc1374c28ab056ebf6700e2fbcdf5b13849df2e977c139cae585f8c25c1e89072cc208f6e08494b9be33b17d5551da87a14bc31d007c3813f0f63787d09e2aa31ca287c0622fcef77bf3f459ebe2b4c5ab0afc43ad7b095d448f2be699659c8ae3feddfbac73bc443a94a213497ae8d71b42975802edf8189b400d8e764b3c55e90bdbb1ae5b050af8bf867dcf982a6eda380a6ebf9badeb27bfff4dd095a00d0ecc2fb23f7ca7825f2678f8eb8249ca94b404ea7ea99189348acbb4c22528d357f588fef9b6c5cd651a7492a252955fb6e9a8bd4324d7d0e14d91ed79fc208c26c8c2773b7b326d9e78cd6ad8fdb57d42852d3d18f4a1584ed20375bca7c3720f9d0deefbabb6e64b9babed525fbea1221d5f8ca8801a9a147ec2073b6379273110418b4e3a16ac63267c6dded7dcf51d10af17ae7b6ddc593cbc2296cd7b786e333bed3170b9d1452603ae71bd1d758c2e0b5a3a4b5bcd77fcb648721c0536d091333146ba02f6421e71142e4c18172b7169e21feedece57e027182002a9051173df1ccf809a961a6657361ebfc04b32722eb8edf117d7e3d92d2344289318b0ef23836d28a6c3f820d55c63d5475bf064accb9198160b0a6e829aa1740d0a0912b091abd85f098f05f37720ee7accefb13a1b687bafaad86d1613d30f6aca5b933eadc5d3b2f8a459351eb37fcbc4c9781e2dc60e55b6be7c5baa7936a2fc09b1432b82c8cc666cd3eafcb836cf5ceff1e19ec3011db54a8e4a6f9c06668361511a30a24862cfeeebaf8729578553001bd8e086a86775a4900d77f597b60509c74accbb87923cd2f39c7368b9ebcd860df9e4f84306e1fc121aabc002eed988f0f0860a8137524d861c6317dd2f99c4d37abaf27074e87c3ad0cd22a75334e934684a66a4a89cf2196d8c69fa8a4a40d480df9907a48b9c41ee37d43952ecfdca3290d8acf893cbe8331905f8fe4e23bd32d10e7685fb4314177eb1f0502b4ade60594f5dec509fac81cc158a5b184c906ac37fa3f0ea598c9479b26d3453d8cb62e8766d86986a5eeae5ac0d7e44f255f1fe4963cedaa8939715b4538cda80f92a4daa7d90b4ed3765372cb2f137a00e9bc1c5245200e13888bd21e11a175278f0eb4598de82cfbf20fcb221662d7d0a0e6d557a19540d70c9298359e3ac2bc293046bc905f5ee720ad675bb14f89a36f453b15cdfe10ee669492b2c2bfb6a83ece590af29427d980f6d0b8eb410e6d88d9916151b4bc10f9d47d690f460aa065ec8e5192cd81ee898bfa50fac7055885c16c5c470f1c9be4c0449e562f88d8cc1c25042d8e9a19fe06ff4e1aedf0af9146cdc347a70807220a5351b3fcedf56ee799b016cd809b42835cada178bacb4b070381e1c4440c6b4a1cebe8f7c8c2bbd3a541a3a0b50a0b2a32982a876c6077450e98e357a7197822f1e4f263f3425e96f16f027c70b8de00aeafbaf7d3f3dc4cbd5c0789b136fd216bb39cd0a5a5090479a242dd106e4afa99b9cadf9d88c945956f533a6efd5d303fc2cebb1b0bbb7c4410862cdad329f8ca94f1ebd1439f06912b17fc4624a1c740d28a71ea9dd52772c8dc33cb4f9e3217fea891bed4c12bff6be5463d0b7f7ab737202156201192fd178d50a277086b6af5be4047c82f6e5714c8ec1781c609e475b04a6379045179e580153e56621a4be35a2f9068771ba055724c50bcc3bb072e3bb27dffb8f2eee0396b7f6ace5488264b4f4a25a11e0ea1fe9d912ea815aed2e0ef0c0050f1714d0ab0e5dbe432e9c5908d0511d0b4631f895c64d4ee896dc8c6fa64108984d0dd2120152a4a088281c8d49ec66f6e7d5aceb7adb130ca20b3b26fa5b9f870419c2211847953be7911652099ab5241feb9b0e775d9b5e6216dff076b54b750ab6ed9d9e05dacb8f017a61de17b2aa01380fe31b51444843d03619afa64e77aad6a3666cfbc77149370e50471d459f179b8e8ea4754db705028a01eb84ee276848c541142301b4b9cce99f7f1f607e6ea9fadce28af0aa1a1093081fc71f8762ae77427d4382e2e6595c439edd3bf406747e49003a5eaf4cd0ea210d7ce37d12693ea9a25d0b29473f26f4a2005d949544095f57b783f4bbe976c56f0b0122f6fa06f7f8c1bbaa265a899e64791c2bc4eb85d274bca9b29d040f51966d12df5b991ae247563daedd787b5b6a9f656564817852a2738359e5a357db6ca0dae081e94274e52f0358c78c12c6c3af0c0fcf22260671df0c370aa62082ee3557ef882a15966f28103e87e4bf56c67e29ac5e88ec580f2587f9e9ce37a9a603f121b0f15fc6eea9414f234f8fb358ed6b0a5d6b5f3e89cccdde3c72f418aaa7bd8d393bc95f959924e752a1b073da7819378e5d8c7c30fa0605a0d6b8ab502ad734bf771cc88a151a7d53693f402c49c778aa142e4ba4b75ff6f00ef07afd7c3fb3209437bafe0a1d802f3769f61e599fa363c0cda27a5a44a6acb9413c56b3198d761e290386d84e4aa417dd8b41e201e6944388d860152249e1716f3fd5f4ce23ca2cecd9b7daee5e70c2b6f8581deedce4a2cddfee0391ee11b133a33b662e8453781830494f68dbdc4a584c8db6b2bbda91d31b87dfb06e35f59b0386d8be23249fcd346420122ac363af00d40b30ae2180cfebe3ae00a71b04545597cf1676aa20aaedbaa3d61011f65b71960cfad9076ddcdaa201a5f34a6e768a0ef8647f241f8c67861f08b57f42d50db36fdbcd78c44a40bd20e7870e22a2273925ed13fe6beb2a720bc585172b4896b312d4d86ccf5a2819ce5d6e5d8982def67ab1624f4d8a8b477c38993e0e5f4788331b475eaf12dc203bb12282b939458afc8107fc3901d1c57c0f0e738648b05bc721782770eb0b9e7782586b372fed52516964950b86061bf2f818a34db50e1d01f8d4983865fd14168a3b2f6af3c4754b8af136134c703cf93cd92d48a5d5a3990ab3d85cc77fe7dd4424b5531fb7578ee9b9b5e189cbed3379d6c8cf83ff8ca2f4730eba6241f10de2af2ed2b5457df6ea9c473c631742115cde2f966fbef4fd347af822834d613dfdbbb369d1c82260ed8cc249d2c209b55a7d7f5d353a290b0833914a25fe468246035bafd5c3330b5f53f79e5aa968dd6f7f7bbd7968a552c23bacdac3fa5009f5bf534ec4fe9aa43495d9cc9648d16b1d80aded3cdbcc61851eddae8c0458054a651c221709ff35b0448317fea865452313d4332d13bd94240f6578a532dbdb71bfd52c2198eb22fbe0ff34397510a8e4d5b19a874c2719ca1388c3573abd7bf9f817a3c8a27a4cb51968cff353f73196a9629961021e14eeeeb1f3b5c6ca81afd9926e750c98bd1670d201604e582627e83c82de51a969657e0d4eb9f9e11f8d6b48280f59e45ac6beafeb942a2cdf5c5371d5cb1d535cc3cf3f151c511ae40f7e9f5339ab25238187e31052cc9cda09ca061bb65f7ee52cc81e95655a91ba1390630a60bc12e72e2cc36e7e8a2e58ad19670aa0a9ce73a970e4c77a4e5769848a83c0131137bbc96c6c57c87e9e261a17a5beb05afb858d3bf3a6974", 0x1000}, 0x1006) 02:01:28 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x1000002, 0x100010, r0, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x1, 0x442000) getsockopt$bt_l2cap_L2CAP_CONNINFO(r1, 0x6, 0x2, &(0x7f0000000040), &(0x7f00000000c0)=0x6) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 829.886138] binder_alloc: binder_alloc_mmap_handler: 11258 20001000-20004000 already mapped failed -16 [ 829.896208] binder_alloc: 11258: binder_alloc_buf, no vma [ 829.901764] binder: 11258:11306 transaction failed 29189/-3, size 0-0 line 3035 [ 829.910176] binder: undelivered TRANSACTION_COMPLETE [ 829.988093] hid-generic 0000:0000:0000.0001: item fetching failed at offset -1466969597 [ 830.003047] binder: 11311:11317 unknown command 0 [ 830.009761] binder: BINDER_SET_CONTEXT_MGR already set [ 830.018929] hid-generic: probe of 0000:0000:0000.0001 failed with error -22 02:01:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff9e}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:28 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 830.035420] binder: 11311:11317 ioctl c0306201 20000140 returned -22 [ 830.051514] binder: 11308:11321 ioctl 40046207 0 returned -16 [ 830.082434] binder: BINDER_SET_CONTEXT_MGR already set [ 830.106344] hid-generic 0000:0000:0000.0002: item fetching failed at offset -1475063997 [ 830.127271] hid-generic: probe of 0000:0000:0000.0002 failed with error -22 [ 830.139398] binder: 11311:11326 ioctl 40046207 0 returned -16 02:01:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pwritev(r0, &(0x7f00000016c0)=[{&(0x7f0000000500)="754e88c3333309038240d49c2974489508afc882cf06d2c3505e03e881ed232709af5438fc8b426ad005c1de5aa7dda109d193b3b643d13a3a2a55e0d8057c362397ddd0e992ede99116bfa982e0b746fe3f8d0e5648dc000bad5bc5e6e06896b8a9ddadabfc5e1776845c9679b36db23976621037a2d6f8b15c843fbc8d25a4c3de676a3927934ebb2231f8eadc0f393c57da2b3d6e1586bf97dd07f1c3577685d2c5a1fdde01b6dd6118a635c9ebd64b70eb1cda2ea549b879eb9b522358f8694683fa51fe197936d5e5ffc7de2d2a5ba96feb4ed9f618c4c92f2bc85068c0bc11b38ef0fe5518cd427a08b3d4e4e43adfa993fbd140b8fc959cab38e929013cd05d8ab11f11035552c9a5fce7540793d4e1d8b8df318f6235199becc6bc62019720de01aa9990c36f9d0b367645226ede6239a4bc9b5aea05f1009c1b2b99ab45e613c413d8b13cf7631b4f6f58e547917c13b95e426edc05df38237347e0b8e494e33f214b923a8ec6cdade2b1dcad88d0864742affae5477eff783eb181ef39d5ccd8a6f7912d8f4b5df2e6d5f7321316b7bf982729d361967cabdcf32ae133b05eecbf9680f8441825660fe814b64121df8e5ba27f74770b70e5f543afc5c078d4fce610ba36f38fa7534603ffa7f0c38ecf1cf5eb09a5bb8d19a627658821547f3245c20625307766529086d52fca121eddb19a8254cd169ebbed1c46e800e0a079fc0ce3518cbd27c9c32ab6781813aa2ecd785c2404de597edf482f6cae154bc7ac578fdeb9c5b20fbb1cee47bfe4b36f07a6d930c852a3f9737a28c0176ecbb416af630be216ac7c87c040b3dd2c33c1922a32378a527caa8e75ce33cf54b047c361c5afb0a209ad6b094f8f816663e912e49cf03e7748bbd009ba8c01c1cc1289ac8000a626d9a755dfba5383ec8c10a9e032bc827023636f1df98e10e3004aac82b83f930a185d6222f1696f4106a7c9c0a12d540afe06cfa5a1bd94eeccdbed721803d10d842453a87d2528d1af77d3dec116ba334b3579eac7de0e5bfdb6626ab10d3a9da56a28df64bd624d91ed48cb829d0237682aaa070ca8f56c10fcde6877e46c734c67a7c467b6d31cbace1f45c45d3d280f4b22bb93fcfc1265a84846af310a04a638ac09a4d9dc9a6325bec41c580ee58e03777cd900fa4dd4b2c51f741cabd00578dd58b4086aaa699df4cfacf9a88d4e95a688fc111068dd53d3958084002f4f63fe9509a215a80d907852c3fac84b8ecf69ce0ae7af60670e83a2a80c8d49adbe00f27899ee3b6589aee39685f2a7c2f4d2ef8bff3a96b09fe85a1c29209dbf93bb54648a0b249d5e8c1b5ebe1ecb2d8ca442dbd5fe528128f35bfb30f421b7e1b7ab53298d1b350e8be8575f82d185c3d6d497b6fbf4a9556e650b51621825320a701ddaf4c51b95dd8b3e12a4b748825e53c0976ec1395184c8c3c6b5289e7713bebe4dc9d4fb6b9e5dddeeefdd5941aa5689272ea718a1ded97bb8ece57b554f216384c08ae2829e334f54ed981d4c5f1292c62e5bcda8e7c4e94ccf74371f894daca312192a864c47734232498cf3942440b5e80a2365a9d82139b6cf5712c05c011525ba96abcb2fba85635aae2eac2e02b8b86070b9e708307dc07a5a4aec5715c9cb63cf6fb55cd3705e3143213928b39008baf07b3911ee799c9e244ab413a2692c6d5842ca1b92a67c9c474d08898834dfbc6b61c051ca0f6027789996f4d25c3c623c930c8f4c39a73cdc87eb723755eb5a2dbfba0be9fe855b79daa391281aa387045236a1228dc1857b944f03ff2dbef510c81896cad11cbd15aba450bc30d97569031225f617d0b42f6d1db47b523b95b0e8deb760affc7401ace9277bb2f8de1eec7fa0f036eb371af54016ff72e0bd4044ed4f418af19203462bc4cff513c04915746962ec84389fe22695f6a110231609eec42be0b67eb033b7fbda14d1a2d942ab6e365e61c61b7ace5359fd288a63def17b61c48909925a385008df521c852e7e04613e624e7dd2c6c65810179f16948e2a787e4164a92179ee301d3a7157e44be50a9707eb34cad3b125b3d10ac12bd84a9f92d6cbff46e3122c9ddcec4ce4b3834c935aeef7e167a0db82bca470bf36b59cda8354fbdc7a640c269151e4dba25191dba648504cca2e9162b15426edad52cb422b801937e9b48e0a515b539ce37655e99d4a4abaee8026bb825a9d5c5f0d55ea398896e71871de096d71a43bd03516e3808138d78181de77a6a2348d518af1524e116a25655df1f438fb531ed02b61e5423a156199ec5b3eb64d11cdde3830171522b0b2a0e4e2bf750b8eb566ccb31bbd0fc05b8a412308bbe943b81c27262243dd1c6b9b32d819880a0c011141cf4e5ca655f26cca16363b1fc46df3685031b39a6d072072696b2a422662dc026cabc8ce583e45baa318285ed700bd6c1ec1665ffdf527d4c64a6e67b58d5b93cf02ed85faac74e6cae4fe4ca634ece4000c0db538e4397d6aa6e68c13261b0925fa0cc67534052ef414e081cd1ded91cb2d7aca9304606d98bdd00a97f00840f947de72cd22c172e86dc6bdbd13eeae86b51116e4e0aec0dc621dbeeeaaecac47fd261510815950c6c9649b315f47b9349c3ef95cdb68a99b81feabf56a2e7318b2d8caa6b929648bafe948c36bb59bfd7ea357e5bab1561c35b31f5023f3d44f01cc448fce661c371e5525f36c6cc77baf8fbfbca98206f31ce7dad6c3580c5d115a5ed25c819ba4b8d7c94ff95153cbc1e15fec81b63cbf2af6843539d75554d469527c949c16137a8e404b142708e32229780210391fce74bb01a1836ef3cb7f8782d9cc4880d2eed4d146a608bc57580c80df33fc7dc51c00847b25384e23635b8b88ffaa918e8146fc21a2509488675fb6e8ef23364b2f8637651802f728d218af9566b5852069c791356f3ba8d3d013deb9b134ed0fc55a13a170973a41e0a309f84c81894399068e7d245f8887ca5121f28be56676571a4876d3b0d895dbe58e46260afa0c4dd52598a2bdf9b54333f2018f6db76fdd0b3de4a7e20a859bc9ed11d33ad7119f90507caf3149bf8989622ba73f4426a490f960c4a282aafb30c8973e2a607d9abe1b67274e4a5fab23c48337ba728fdcb32be81f25b3390efbf6c1866e127a767708521471086d6af619051c787fd688851cf5b1e0da23a032ead38c525d288a5effb9bdaa95160e5da3ed74fe219a5af8e0d358e8d70ab4ff61724cfd13b3003cc5f16e8d887fd6fdc993a87114fcb9c36c5ffda5bc3f5036b8f42daac64f748d5e38238421b88f3116a4bc3b7bcf8ed17d1e91030aabc0550e8a2e97fed10d1200478e5598474f96dcee31c9eb30292619b4992e85839391c756f8b9da7b57d8e76564657c050fa57893a693a2b7dc576c15a1e2b64193b60014c2015624369ac851d35568bf97b1adcdc09417392f5d7ffa695c7846e59e99e485f8050d8a40c159a87dd71fe9f58ca300e8c6e17b46b386969a66fd3775c97eac9c4622792476969eba2332dc65e1b072dd8b482d96c82c46e9c1093aae86e86b39b09e2cae798961795c89b360ee93569246790f6434c212ca07a7706d2f006f0fa2d9722347da24abb498ec14ece32989bd3daa8572fec9c4e25de8297a5d30bf848e8afa0f81860588df69c838c82e4c783b0b752fe1a7164fa040120ae2ed3c0d6aa3601724264d5a63b740354187ab5c1bd1918d257fdc78fca3db1edb98c3586d772547bc042db6ece34a79b7792f0509028f3eff685b8e4e1ebe3bde482bb30c7f6d8ddc5149b587547270b149af111c7e493c39e90e974963a1aaf94e4ad7b140bddba359f1e34398079124caec6e5d28d3b695098012b204773cb2aefaf414b7a0df56449050aa302a7758ec640c232db6091d79a940befbc977b4eb4aee2ad87e12785d8fa84a929cd92e27af5f542e260f3d2ce42358b97bf82dbeb710e0372bcc5b115d29b3ca35f167bae19f7f8c9d0c67ffd8e4c294e2d673513b0333b5b2d78670d1314c54022e97d5af950d14a7f0c06260292911539cc41a8b7403990b2fed8b3d2c5efee3ff7fe10ed7676384336f0cfe580f6219b3823e9a5f5c579783fcb2085b4ffa6c6fc74cadc01231e4844561c16c06229b3fa761407e799760c7618489141e803463f719c4fa42ddfc8c1edf5bf476dd63fd9e4947811f2e7f90cb8e8155e7e03f8fdbc33a7b00d7597174d2de7577d55f5e8adea467c63510391afb868622587c0ae24651b2d06b23b68039fbd2e461313e395a428942bef507dc73e268d770a897374802831e8757787bd4d6d68de92c815f262dbdea95f07fb7bb03030c4d461ff81585988b26ebb263f6775a612993b49e03000418a30334aa22230ac12775934850dd8331c97dde1e6f31db6cfadaea9ad0854dc1bb8d315239bfeadd8900e7f35760048467cece42b792e49dcb2de36e8f83e7498baa5f581ac09744244ffcdc0bfbd809e2ca954dc09465447974c99f86d13b4b0c40660b4be9a1d5cf5b636df3da7c8aefc6416f78d32a55308a175034262f9ea2f521b26c3abfacb713a48449a56353b1bba50fa8067ef9c3ff1b279f1ca7f2251e1676a188cb58c14f17d8b9e3ad6955740fa17689d4a4e1935a530dfa5d313ef9ff07caef822756d1e387e96c5e078bfb2ef0ea0b2bcc781aa2e68120b3c3db63fbd26db7196e957a514b4b958ae6bd4c858937ceb608848af9cdf30999502c0642f6f346228b8ba0eca002102431ceac20ae5362e1058b9f2a7e933f075cafdbf63cae177b6d08d408124a30da7ce7cbcb5d365d17a459812ea5aa67413caf342adf9fe146aed3bc949e502e0273e797125f30ff832b26fac24e170f2f8ebbba50051ff2e0ba47a80c9f4e1cdf50f3fc01c96c7412b2286c1f7df968dd16951eb4cdaca4322838300af85e0c8e9222d5642db0c44a22c56a95e21fa802bbea35b857180455786532c668d5602ed8d7aa6477380e8eeef301f67919375c44ca1cd5942b8ba854d8448b7418083c3b2eca17df63be655f8a536f2ccf6a8c8d871cc6bc7240f20b0c08f66520fc208a1d4cd7ceb1e22eeecef3042fefb35bbff6f666800fbef00e848f6c3f1ea5da0573e3867bf1c52a83bccada47e38b52e226d6899490bc3a52ae23d67280165d8fb42857ca1284a5649a89332f3f071a6f6c668286603a6965eb787a432b43f3682862972056f9426f41875a989f5446a6771b4234823ac1aba0ba43122b9b40f80b9ad8c037fa5edb953242dc259cde9bdd244f3a8856519cb30f5f77defdec45e463606b609042fe561c9f997b46551a3d812d7fee47086e71c246a1def7b2e485808279ec7d48ceed2ed14d3a10ab3b193eb5af61d9e35e49566ee95395c24c0b0c8c4e6856e0d9dfef94c09b48a6de314f7c8319226b1d732ed8b9d232be3d492c2c6ec3f139b60b27309581c8ef46a934c378567d3af03de5ccbe129c1cb0330698dd0ae362d1a2dfe2793a7cd718fe73eb506a74ec8154a051c4b44293dedd55c7739fbb88b26c5009589334da38f2b0fbc5822bf23bdfebd47fc4c9edd7bbf2efba551743edefe4456d4dc4931f6e6a588a677885ce102e285da8c386155397c99596643f4c4aca38d65133f7f0d401d786d7b36867af9d448c0dff19c666a98185989ffbab1de1b509de1f3a9c790e42004ca63f15bbeabbf0c77eba3cb24fe05e7f72732f6934115eb00e856e9ed586a16ccd389076f9ce206a19609e371a072123738c0cca69d4685230ab57", 0x1000}, {&(0x7f0000000180)="38f29a7f190ae9e7f2cc2adac9b4957d2d48634431870811f762d4eea8730184447218699ee8d19005f5b0a0c7f10eabfc86e56b2ef1335ee5f66fe1e7cd099ac469b3383b152e54fb8276b705e215534e0fd0d476d4c3cc212e40cf1afaa4123ab492c795bb63b62955b4bef885c97eaca7b01ac12fe41ac4321f89e3ce2273ff784525c77c5b24641327c90703f4e54a5092fc4298eb750ce8fba6adecdc2b5951d0b6ee6f213db9edaec3ac192ccce90b7d1802f1e3cd8394276f852de930e2c00104e6239825e04cd18763fe102f99fa8f16819d16835a", 0xd9}, {&(0x7f0000000000)="3158f4836398401d14eaac463dfaf00691097795bd9ccba9cdc2b9d6f3bd48b43ec38655", 0x24}, {&(0x7f00000000c0)="10401c29e0b3663e758fbacb2a39c93598d536a98363382144174ae2156b7551d2b6f4ceaaf0ef14b97329f57a71c2bbe756cdba1fca15a1ebb905a7bd0dd66a43b585601db27ab8bbecf35957021b498d172ba9eeef432855e8555e996c717aed47a5ad7d9e54ed7e18472612d52bed48d2bdebf9", 0x75}, {&(0x7f0000000280)="fb682c4842d42ae2a157a7fba32d604ecfbde967007ee2db17c8a75fd55ee0ea3fc77aee4450bf3d1350e2eaaf294e7bd98402b350cb15da83233f797ad1edc8e7b55c15f1", 0x45}, {&(0x7f0000000300)="b8f7eec662914c81ff2b781da385f904eff3ca690672a5dff1f5cd579a97127f5e26afc6732c1ecb2477c822891ac7d88d67de22839871f1e1db93e0fd6d700432596b0645e3f3d60e1be7440ced2f73202d22d132bfd3a0dbee9efdcc77e0084b54c0f19a4be2f25ef6672b4095dde8803cea062c5afe75825849af97e63efa4b5e509bdb89e3764023d40cc9e08162760e1f5ac86fe2250f26abcc924a9d9a639701139cba191ef10a7ed28ce1d0b6ac7550b6a4df734295f11acb6b84ee958c31a44df0efe8920cec76d844c9ba9611928b06e0999c41359cc6842b69311a162cf6fb5b57d598f021ddce3d542193b4e814af0cde6a1e96d42815ee", 0xfd}, {&(0x7f0000001500)="6f3e86f5a3cf85abc16c7fdac199ff2fbfe8dc098a94b0d665cd4eeb1c1cca1fcb6c4fefcd19996ee6f4eab3a2eb290ec1f61225d25b27c5781054f47cdbeb7dc6fd891cdb7147349efa0760c909eb8907243c388ad90a625c3b041827cdee335944c647b27f915a03d9ffce96c607f689e96a434cdf590624b7eaeb8ed9d6fbfd6be93143264b04078ccfdf6d34b1e8c80d17268e98d298b503aa299c415691a39338000d2eae58b5caf2d6065b80367099418476d5dc5e363cec943e0232a36ca043faa694f32cb5bfe6943c2d40d6ec5aebc3170590d44c129333", 0xdc}, {&(0x7f0000000040)}, {&(0x7f0000001600)="f3a9b85b51582d29f61e8646b3bf3242d6e5eb9e7f2a814580763aaecf0fdb5995914e60cbe837ddfb3bea1af2a5af2d297f2d95158014edb5c1afec7ca08766e37f36ebe380934f354f6afef8e1e773cb244eae04d93661e32f0461283c5ea4e1c14f21d700497bc4a4bf91b56fa1057603edc8392ee9fa0ff9aedf07a381f5ea9fc9d75b0a8ed458a89d20d1de2724adccb9575e83", 0x96}, {&(0x7f0000000400)="9965a845651d39afdd6f6bab7e7eecd9740556b16363db8d6cc9b5182ce09a6ccd4cde38e44133145d09816fe1b39d48b7", 0x31}], 0xa, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:28 executing program 2: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000240)='/dev/uhid\x00', 0x1, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, 'syz0\x00', 'syz1\x00', 'syz1\x00', 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "80"}, 0x119) write$UHID_INPUT2(r0, &(0x7f0000000000), 0x6) [ 830.168525] binder: send failed reply for transaction 665 to 11308:11322 02:01:28 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff0}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 830.353303] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz0] on syz1 [ 830.412249] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz0] on syz1 [ 830.809275] binder: BINDER_SET_CONTEXT_MGR already set [ 830.814696] binder: 11308:11322 ioctl 40046207 0 returned -16 [ 830.822195] binder: BINDER_SET_CONTEXT_MGR already set [ 830.827513] binder: 11335:11340 ioctl 40046207 0 returned -16 [ 830.845169] binder: release 11308:11352 transaction 667 out, still active [ 830.852125] binder: undelivered TRANSACTION_COMPLETE 02:01:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6800000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:28 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x136, 0x2f) 02:01:28 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:28 executing program 2: socket$inet6_tcp(0xa, 0x1, 0x0) setxattr$security_ima(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='security.ima\x00', &(0x7f00000004c0)=@v2={0x3, 0x0, 0x8, 0x7, 0xa8, "dd1d5a61afb93263ba2ddf960abd4bb9fbf114feda820542c57499b6bd66ff39f857d1cfafeb72630c2fa6d5e11518e9641475f33de218bcadb674c2cb625ebe25e1ae7deac5f9899c45e41786388317e8d32ef48e702a0b9096660dc2528afe755aa56a8db9176c44f2d55d23c5d2b87429421a060b06124a86db62a30a32936044820e1d3b2b00fa58299e3ca279aacf173fc65a8be22911c67e4a3d9f1b436f0c50f26b3c0ca5"}, 0xb2, 0x1) r0 = syz_open_procfs(0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) request_key(&(0x7f0000000340)='cifs.spnego\x00', &(0x7f0000000380)={'syz'}, 0x0, 0xfffffffffffffffe) r1 = add_key(&(0x7f0000000580)='en\x00\x00\x00\x00\x00\x00\x00\x7f', 0x0, &(0x7f0000002900)="c6bf656a954e4051ba3a925c051683aacf4009dd8dcdd88525dfeebcbbfcf40598461717792065fd32046208e94d55ba957ac20432dc54fb4d5dcea3678a04088fdf6e2cc24a36954a5564986da616ea8ce84c87fc07452e22431a913c26dcd14f84a2b8d03ff3289e46d6a0f454b9735616d34ab8e5b9cac75ca373a22a0857378b8dded10b1aee8d5a12bf744c4723ac5040eb4adc31f340e4461d78d6ac7fc1907472d3c53bb53f11e9115ee90d19b2072984a7b002129a0cd528b9aa6aaf72adef1c945da61988bdc5251e11f1e75b4cdd6373537df58b515138ec744b8063bca630d17d460d429ac5c45daee214d193320d30f21a8b3e36f3f01dfc1856574b21685361f33da75a45d5950c93bd3929cf549c55a60ec02c9413a4a148c1a148e4165fb9e6c8b85a85c0237e5287b12d2ad259d110318b11600fdae5a0a4427ae1b1963c484f801774f04555ef08acc3eb881261971849fcae987522d8638407ab1010e90a1b0301065337776d18b089b8fb81cdef3fcf6125d86bae0f7b3dde8f79068e91afa5daa6b632b397ec312f6013c5ef108d3e1fdef619d3e3b07b228630c148606c1e307231cf3e0a5f439041bebae43f268edb1b136d7f0391808b7fdcbc3aaf3a0a723d431cfc29b1ebc4c84dc0e73379effb446b9968efb3b71e982e342a50f83c8b17a2d2cadfb1733536433643c8bb8b3b56bb6ae800a44beb899aadab38b1b5e330a69e218f29c04479aa3e7ca5922e95079c741e7b091f73a6bd258c2492363b5d7b7ffb0567949ddb92762df989f5887c720b022ca526eb82d51bd33625e459a38b3142d53e94de0c1e07906242153f7cdf85939541c2e655488d28e442e78a068b2643fa5e8864f567cb0dde10b349191ecd57dd6a4bea6b9a338e354544326a0f25c069a5f5ffe2c1565b8ade0d747e0d4136bb27cb9f5c225dfc845ae2a3b84b9d2fbd6f99c8aa8237077783b038c2ae58ac1059e4e54811fdad0dde6c657b0f6726f35aa853d638c276057796ade5df6d2553603c79a39959dad5c1d402bab9b7e18c9b04f809e20a661e91dd82a990797f49a141e8a70a0872f807cd744cb4a57702b3ab746f304bafbed3bd8a0ce95009d101d7af600d08e4952e4ff4bb25ae6505d656fdd71a2ea382afe4887449efcb7c68233acead0fbc3a3c23bb4dd920ed17fe3858f8b2c7365f755bd74ac0874a992d8ab6466080facd0a9c5b1412ec1851cf6a913bf29d3436a56e7b9eaa2d6e049ca76d7a5521b2d6966b38093c9d1fdf8e9875bdc56b43c0c156a44144f4c665ab20d7b178fe9fab0bf58164c363303e67eab6276e83f514cd57913c2d6d7592427644d8bb6c41227b85b78bf926c5c4c0e29ce1cadeededdc3f923ee6be76a1303838cddcc65325aa523c6418920512858f9d8c6989696714e0b2f9d38c9b9207be8a28cb2b6bd33cc14fb378ce83df8c3183a661ee489887e2e987ba34a809833f2b502b6bfbeac845fbce29e67ababcc69ffd21f53c5d85299460558e9d19bdf4ee2b0b447f9cbe3afb2b4714cf7cef9d5a7e05f0d878c578797695c2209162e9c1f3a55e00e814598c7ee8e217735971036084dd258dfca0a4f7893067227143114e607fc2c76de0ccf61da633d5983a82fff1821b3bcc1fe7ab143fc9c405791a4ad998a268a51afa307287c905f9892df5b90860e1c14b7261ea57f972014d40ffb5966838fb585d1d627068d41ba66caca4c84b52d6c49ed6585103300fab4e3614581433310eaaa164a6271b97301af924385131321fd04aa54e4d2cdd25ebbfea650ec449b798fe96034a0a2bcf690d5fd2a3ee837483fe0b24dfdcc4727a94a40ffb2605ed5ef8eee02703b1d7156312a1707280762bda3b4f3adaf7356a3956fbcbfd3187e44d17361a391db5fed0367162117940e48ba4c65e70bed745648777e9df453ac42e1b2fc4d43dd759f13e551cd3a59f6576cef1b3184b08d21169687353dcf05bcaa6ef363e786e1a2b7d040271abf55515e6e8229bf9d3082f0fadbc575f876cc0cb0257c8fc5e72cd1210f717c47c64bbb8bd21f690b0d08d76b3d56a7e1c60844e02a9c8dd9288339deacd0da777f6084ad175047b8921c2ce569fe2bd0fcddb73783091c8856913a25819d58ad64fef952a0bd33b6fe292f7c3e45c27b48394aed68db517944d5a43df79db1bdaf3c66b0c958c8170a8247aa1f51e743b007d24d1e9a0be6054447292fdd866972b45b76582583beaa4f22966c71bc5bdda436d4161bf6a94c2d3c3bf63dfdde480b8dab3c822f8a8ddc9fca2459ed2c9f45c5a27a6eaa1417ea752cf1070c22ec17f63c43947136827845c393fe519a06d8f5c48ac70dfeb06f306a5c6f87d7050b0584408f332669a266ffda0c0aca6209c29b565123953520e20e72582cfd9fe2482ec93bab1bd51182b13f80b7050fa4d9dcf307a689310546b9b41d20a2314e9b5b5251b0ceee1e9b35fb13aed736d13ae7da70e3efe891244e9926b01a4bae21a3d3d360be2d042ab44c1beef8406c2775f2f055d68659b9b58a5a5a799166eeca7498f03589303f0ab17753479f85637d4e0b133ee1c4cedc5f3cce2121159ce2701f84b0c97699d86c52fe610398febde811a8855e3c82b7b97fa3a95088092bb6d3fe55653ac38d183ad9776e217bb24bef4f261b53d9c9f91c81356c7008139046a5d1bd523b64ef6165e2127b05f8ac7eb1f28cc3a26ccacc05b457ba9df9723a3a649255cefd2a2f88061bd68e7737d25a83037d198d20e19019032c562872524ea7eb8d98609c76abc94071a5447c0d1910aaf906d48e69eaad6c6c93f51e87c833ba57abddeef1dc266edbad8ebf49d8926195feeb5d05c30428854fcd119a1e1472e99c00141f1f36e6485e472053a947eb0e253a25b853a5440bf7f9856c0b52df6db4f71c323c1071e6471956f26228c8b30edbdb8beec2a814227acd85c3a54b0eba28ca7b0dbb0ed84d1ffb9ca7db5203ac1b65b4f0535ffcfbaf7b2bd896ae8db8c0fd7bfafbe2ab656207085d432b0968cb2ad9f888b3d4e2351b13f649a852fdf92bd050414d4ecd16adac3cab16048b5b3265cad8966de16e2e303d5c31af5a1ede7717d3689e9ea41578e37681de81c53b280dc011a981bb09576cd86fa3373dd71e1e3f6ed8ded0872c76568250ba8977a8a997e136bdf8d8fd33ab98f0bc9ad2e003f17662312ebc1c867892fac1f83d76d8d131746ffe0de2604244d895c8e757d0351dfb20961e352f433554e81e58411cbf292e771782cb7f8e696dbf64baeccd635a1de8eb012be53c68262769043ce47d6f0d31a96b07b1403753e909ef8a6315a3d2fc0cfbb165ac467f5d535f8a855959308c10f35c5ac4ef8cb7e82744bd40cf8772ee9fd0f26ee06833431b47f59c62c165da0af73dd6835a142a328e11880e174220302e42d81e673f5d35e9f17156da214d36325d0621afecf7ae20d6de71951bd97fc6c58b98c467139e8220785b61ba458813ce58b1456ba9f0049f7be18d5bdd9a488d883c497d304a68437abf66fc7f172d0e33b8cdc599eadd8abc02e73f5a679aefc06f4b5d8766d8945bac145ba368e67118ce61e7ec27c57cf4b7cfeba7d0587573bf5e55b6ba8770e3616413a2f85cdd1ad0ddc57485040a5d30ce72f324abdc2a7760324dde958a29dffe02f772c96f9f9413f4066ad06343591c8be0e333aa22e6263f461fb28e9baae3a01da709c5d895d27f71627eb17b91b777ac749ca435d304b6eda08af9f15cb770f84aab33c1dc955f4f7557587772a9daccdc6d1006998225efa62140b99c30921fa603d39dd6c89ff9c843950059a3fa2ce9de1dbf09cdcb42acae8426db6d3496f5585d74195195549f897e0323c0d3c15dd556e9622a008673e88d5340d3b266e1908225eb3a3299009aa980b97c8d9a1b43d824484429080fb5a61119e4555d9a94e7217fc95a3c0e8ebc0cea3ab8711c5c6cf2f75027131425859e9e398af50f3d30d526f69c2cd4c8b6dfcc3034aacf7eb36f7b8b573d1d3e9bfb93eeb75be06857751b340b152dd287008c112ccf03f932028a560c318d33b194c7c90a99d35375eefb7bff269defe7ac86cb79be42d65d0b3d7de0d7b27f2ddaaa18cf0a67e41b0d93926971da7dfe541f35a272243fd7abe7f40e538c69c4c774b45335c48dad575a828c156a0946e49c983d8dc11bb01a0d341bff745d9cfe30d5c4ed7944a2fd3bc1b5f29769ff43ae4e5bd477e7b74ddc5c94a09c8515e0c4899adec89bbbda437644430495709b6a82f3f2953478a09d1a876873021c006aeac9b3dc7849f9d4253bd728d68427a635bdd51450208ff5d6dce8ce2f07176ea4804084daa52e4852fa2727a391771bea17253d8cb57d2e9426d68528337636b8bf5bd7cda27c2d3125420a97fa9ed2d3492ee6c028b6b078cb71edc23e3324e7b495a575120064724223f70a287954b360daf258d7354d5132a9be1ed349109a6e721b1fe12dd8f2e275dbccdc5ea91d0bf3a6440e827dd5d038076497ce52222d253b83df7bbfec0a6933efbd2dd400a546696eb0837d99c89bc7f894f1d83ca5d48796f445fc8ca58e6e35c93ea5a872397a2d7a7601f2af668d815b4c0b2f36a67faba983d32bac19f7f4fc988a9f46673bd892456c6955fa74554f0ccc0c92a9f668d24f693d045fac180275a45507a381ea2753c79f67e875bd0d5f84eadca32d71c449d18b2b6c624c222ad84275de25ebc4075858e96e1fb4f6e25ade40f8b5cfa290a7513d37713eb8fce2b442caafbfe1eab0463924f7b0b904833820d3c3ddf1a8800ab4c9f099cf287ded58d0e2127809508b9556598c98b6b2efa86008333e0e3bd97e076264ee9f8945453de0ce8f6ca930200fb477b8704d5078fc5c0db929b688eb0e1a9e6513df7ee1211e6d8669c1bc1d879ce57474e6deaa88a9ef5dbc0f7cc0668bbfa51bbd41fae8aad4a221b3dd54580d9c10734774b2ea2d853b1e087b6479d47be57a71bd916ad657479177d18f2883ccbc714cedc51af4e92ffcd7f88ecff3cb49eba4f98a63b5b682ef83852c88bd3906334b793280e834d763158d920f4264f0bbade0bf449ad4bf9096762bc7f1882cf6a463113e79d1b6078dacabee03804061654ec0d63d2e604fab3ec9b0399d3f13e7ac782f32e9b9b61ffc1d620b8bd86f4a410d4523f45de78f6cf372f8f7b13dccfe2dddbb8740b05c4aa2cd09fb03b4a0ca04e5fccda05c9262b0032fa5eb154838a12d0b833aacadce823aa7af169b43868f5fbc84b469a281fad8d048d19a0b940486a6306dfadc13e01481c55ed92857b99cd18124ab0d32167e755f08b5b62bc406089bf28b24a6432014d9fab9805368692e3c07a8f3e8b37bde7c4a379c9ed2cceea5c3077d824ab30830ea8081e2343e89a57cad86909456c898bd12284ade11faa9fc7f6c29139ab", 0xf25, 0xfffffffffffffffe) add_key$keyring(0x0, 0x0, 0x0, 0x0, r1) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8) getegid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x20600) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) fstatfs(r2, &(0x7f00000003c0)=""/245) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f00000000c0)=0x4, 0x4) ioctl$LOOP_CTL_ADD(r2, 0x4c80, 0x0) mkdir(0x0, 0x0) chroot(&(0x7f0000000200)='./file0\x00') umount2(&(0x7f0000000280)='./file0\x00', 0x2) 02:01:28 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x20000, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 830.861431] binder: undelivered TRANSACTION_COMPLETE [ 830.868344] binder_release_work: 5 callbacks suppressed [ 830.868359] binder: undelivered TRANSACTION_ERROR: 29189 [ 830.909042] binder: release 11335:11340 transaction 667 in, still active [ 830.955212] binder: send failed reply for transaction 667, target dead 02:01:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40030000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:29 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 831.016687] binder: BINDER_SET_CONTEXT_MGR already set [ 831.023485] binder: 11365:11367 ioctl 40046207 0 returned -16 [ 831.041622] binder: BINDER_SET_CONTEXT_MGR already set [ 831.050576] binder: release 11363:11366 transaction 669 in, still active 02:01:29 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x0, 0x0) getsockname$netrom(r1, &(0x7f00000000c0)={{0x3, @default}, [@default, @rose, @bcast, @default, @netrom, @rose, @rose]}, &(0x7f0000000040)=0x48) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:29 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x137, 0x2f) [ 831.062216] binder: 11363:11366 ioctl 40046207 0 returned -16 [ 831.068472] binder: send failed reply for transaction 669 to 11365:11367 02:01:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffffffffff}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:29 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 831.391833] validate_nla: 10 callbacks suppressed [ 831.391842] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x6c00000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:29 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x138, 0x2f) 02:01:29 executing program 2: socketpair$unix(0x1, 0x20000000005, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_DUMPABLE(0x4, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6(0xa, 0x0, 0x0) dup3(r0, r2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='wchan\x00') recvmmsg(r1, &(0x7f0000000400)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendfile(r2, r3, 0x0, 0x2007ff) shmget(0x0, 0x2000, 0x4, &(0x7f0000ffe000/0x2000)=nil) 02:01:29 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1, 0x0, 0x0, 0x0}, 0x0) 02:01:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 831.794193] binder: BINDER_SET_CONTEXT_MGR already set [ 831.799922] binder: 11365:11371 ioctl 40046207 0 returned -16 [ 831.800837] binder: undelivered TRANSACTION_COMPLETE [ 831.812179] binder: BINDER_SET_CONTEXT_MGR already set [ 831.817541] binder: undelivered TRANSACTION_ERROR: 29189 [ 831.824181] binder: 11372:11373 ioctl 40046207 0 returned -16 [ 831.830319] binder: release 11372:11373 transaction 671 in, still active [ 831.871816] binder: send failed reply for transaction 671 to 11365:11397 [ 831.898374] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 831.906056] binder: undelivered TRANSACTION_COMPLETE 02:01:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f0000000000)={0x3, 0x7fff}) 02:01:30 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x2) [ 831.926768] binder: undelivered TRANSACTION_ERROR: 29189 02:01:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 832.016609] binder_alloc_mmap_handler: 4 callbacks suppressed [ 832.016627] binder_alloc: binder_alloc_mmap_handler: 11411 20001000-20004000 already mapped failed -16 [ 832.061549] binder: BINDER_SET_CONTEXT_MGR already set [ 832.078561] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 832.079817] binder: 11411:11415 ioctl 40046207 0 returned -16 [ 832.100159] binder_alloc: 11411: binder_alloc_buf, no vma 02:01:30 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x4) [ 832.115194] binder: 11411:11425 transaction failed 29189/-3, size 0-0 line 3035 [ 832.125022] binder: BINDER_SET_CONTEXT_MGR already set [ 832.154483] binder: undelivered TRANSACTION_ERROR: 29189 02:01:30 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x139, 0x2f) [ 832.166638] binder: release 11411:11415 transaction 673 in, still active [ 832.175310] binder: 11426:11427 ioctl 40046207 0 returned -16 [ 832.176129] binder: 11426:11430 ioctl 4008af12 20000000 returned -22 [ 832.198149] binder: send failed reply for transaction 673 to 11411:11415 02:01:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7400000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 832.219914] binder: undelivered TRANSACTION_COMPLETE [ 832.266629] binder: undelivered TRANSACTION_ERROR: 29189 [ 832.267616] binder_alloc: binder_alloc_mmap_handler: 11426 20001000-20004000 already mapped failed -16 02:01:30 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x8) [ 832.312724] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 832.361962] binder: BINDER_SET_CONTEXT_MGR already set [ 832.373657] binder: 11426:11442 ioctl 4008af12 20000000 returned -22 [ 832.384050] binder: 11438:11441 ioctl 40046207 0 returned -16 02:01:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 832.408884] binder: 11438:11447 transaction failed 29189/-22, size 0-0 line 2896 [ 832.536737] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000008c0)={0x90, 0x0, &(0x7f0000000640)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, @transaction={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:30 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000080)={0x9, 0x7, 0xb000}, 0x4) fcntl$setstatus(r1, 0x4, 0x6000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="2b0f3a00000000b296085fec43ff354e00c419d32c0000000e0000e653c645783b85d3858fb7075c2fedb4f474d7bb295fecf33f88f7060017e81ec888ea96a0a9110254dedbb22d63f0994c6384601f9331d5a24abb9e6bf8213d446bfeeac6f3362b71b0fbe3e95a51b097b8cc497c62f2ad2295560f8aafd21bc826b6ce64ee5820c0e6e59400af9cd9c217921fffeb753400bfac14be68ce2326bc241f6a2b5a4213785aa76c5b4c00100000c5fb4ec83a7b8a6acf5235cf35ba03a14e6ba2774bd0ad7bcd9cc21e52d7a729aee8f389e84f2b"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) prctl$PR_SET_DUMPABLE(0x4, 0x3) 02:01:30 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xa) 02:01:30 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x13a, 0x2f) 02:01:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 832.723707] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 832.798764] binder: 11467:11470 got reply transaction with bad transaction stack, transaction 678 has target 11460:0 [ 832.824362] binder: 11467:11470 transaction failed 29201/-71, size 0-0 line 2816 [ 832.837884] binder: 11460:11468 unknown command 3804971 02:01:30 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xe) [ 832.843274] binder: 11460:11468 ioctl c0306201 20000140 returned -22 02:01:31 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x13b, 0x2f) [ 832.916481] binder: release 11467:11470 transaction 678 out, still active [ 832.928732] binder_alloc: binder_alloc_mmap_handler: 11460 20001000-20004000 already mapped failed -16 [ 832.946107] binder: undelivered TRANSACTION_COMPLETE [ 832.964291] binder: undelivered TRANSACTION_ERROR: 29201 [ 832.975837] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 832.991076] binder: BINDER_SET_CONTEXT_MGR already set [ 833.009736] binder: 11460:11468 ioctl 40046207 0 returned -16 [ 833.031466] binder: 11460:11468 unknown command 3804971 [ 833.032173] binder: send failed reply for transaction 678, target dead [ 833.061714] binder: 11460:11468 ioctl c0306201 20000140 returned -22 [ 833.107045] binder_alloc: binder_alloc_mmap_handler: 11438 20001000-20004000 already mapped failed -16 [ 833.135294] binder_alloc: 11438: binder_alloc_buf, no vma [ 833.140879] binder: 11438:11487 transaction failed 29189/-3, size 0-0 line 3035 02:01:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x7a00000000000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000008c0)={0x90, 0x0, &(0x7f0000000640)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, @transaction={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:31 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xf) 02:01:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) fremovexattr(r1, &(0x7f0000000000)=@random={'osx.', '\\\x00'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:31 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x13c, 0x2f) [ 833.159982] binder: undelivered TRANSACTION_ERROR: 29189 [ 833.175179] binder: undelivered TRANSACTION_ERROR: 29189 02:01:31 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x10) [ 833.253250] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 833.281885] binder: 11490:11500 got reply transaction with bad transaction stack, transaction 683 has target 11493:0 02:01:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 833.326870] binder: 11490:11500 transaction failed 29201/-71, size 0-0 line 2816 [ 833.334366] binder: BINDER_SET_CONTEXT_MGR already set [ 833.340867] binder_alloc: binder_alloc_mmap_handler: 11493 20001000-20004000 already mapped failed -16 [ 833.368948] binder: 11501:11503 ioctl 40046207 0 returned -16 [ 833.386521] binder: release 11490:11500 transaction 683 out, still active [ 833.398630] binder: undelivered TRANSACTION_COMPLETE [ 833.405370] binder: BINDER_SET_CONTEXT_MGR already set [ 833.410673] binder: 11493:11495 ioctl 40046207 0 returned -16 [ 833.417268] binder_alloc: 11493: binder_alloc_buf, no vma [ 833.422873] binder: 11501:11503 transaction failed 29189/-3, size 0-0 line 3035 [ 833.424000] binder: undelivered TRANSACTION_ERROR: 29201 [ 833.455602] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000008c0)={0x90, 0x0, &(0x7f0000000640)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, @transaction={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:31 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x60) [ 833.466804] binder: release 11493:11495 transaction 683 in, still active [ 833.488088] binder_alloc: binder_alloc_mmap_handler: 11501 20001000-20004000 already mapped failed -16 02:01:31 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:31 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x13d, 0x2f) [ 833.536769] binder: send failed reply for transaction 683, target dead [ 833.581300] binder_alloc: 11501: binder_alloc_buf, no vma [ 833.589772] binder: 11501:11519 transaction failed 29189/-3, size 0-0 line 3035 [ 833.621035] binder_alloc: 11501: binder_alloc_buf, no vma [ 833.631495] binder: undelivered TRANSACTION_ERROR: 29189 [ 833.654638] binder: 11521:11526 unknown command 0 02:01:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0xfdfdffff00000000, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 833.675159] binder: 11521:11526 ioctl c0306201 20000140 returned -22 [ 833.678188] binder: 11515:11516 transaction failed 29189/-3, size 0-0 line 3035 02:01:31 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xf0) [ 833.725518] binder_alloc: binder_alloc_mmap_handler: 11521 20001000-20004000 already mapped failed -16 [ 833.759954] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 833.765301] binder: BINDER_SET_CONTEXT_MGR already set 02:01:31 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xedX#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') openat$cgroup_ro(r0, &(0x7f00000003c0)='mem\x00\x01y7SwaS.\x06ur\x89\xc9B\xab\xe3\xfarent\x00\xaa\x1a\xfd\xae\v\xbf\xd8d\xbb\xaf9Q\xde\xfb\x1fY\x8do\xd1\x16\xce(\x82\xf1\xbf{5Z\x13\x15\x14\xd7\xb8\xce\xf20\x1e\xc0\xc2\xed0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x28, 0x0, &(0x7f0000000100)=[@acquire_done={0x40106309, r1, 0x3}, @decrefs, @release={0x40046306, 0x8}, @exit_looper], 0x1000, 0x0, &(0x7f0000000500)="f61ae43380cbd8da33493873a2dfc1751aa55ea9986c2507e98221fbc3d85149ec3cafd8cb6d0419f45b895f11162b4c3e60d45c5e75560ec0a866bd536133e7732d133f165222d91e3ecada0112d3391aa29a414c40e4f8bfab8ca17afb095bca3e9aabd3bc80747de545a19fab4b2ffa28670ac783a5bbd0d6236ac968ac6264057d8b5fe304f8054338a80d23463136a831b39c12e3d37d5519338b1c13ee2889285c0a09e097ad9c56a24729a25c162b5450bbd63e09620e3fc6c273a15e3b945fd61e3649ae96078eba28e352a632486134577e0fb85dcdaadb56945863d978aba7590e2304a7098b054c7de78f954cea6124dda169d0d2daa85ab985689dc4e040955022c39b4969d0f287ecee61e94ae315c880bc5c6fbcbf98b597790530f51e1c93abb431abba9b579bb3c5a27b7c113987f8e8f1c4e5eeedaee70ee291bda870f1decb48d48b3b7df42cdd1babc9f5be9fd6d359c5972d39847f57036d2b7cb8810e9ff304a000046bc78524bd75070050d719e64ad75be177b5ab44a9721df8081f2765690a1a735699c5fd48736352ecb05cff8580502e7e026d410d251f62c59cd45b7d80aa9a6f9b81db5890481a6134ee34258d19fbed3b7b999c35c8a8e07aa64f97779076e5c698af9c7f8490ef2a764bddebc7d45c729f6e5cb0c74c155026e1e2b4b556c91d8e14949baf277b3de86b631e9e68d5e2db013cf2e3c44609bb8b601fbb2a4554a4672152bfa61cb3c1008f03044d0d15a06f0d3afe37d4fde9955382ea701db443701e3c4bdda676080ae45788b65c84918dd8e66ea0fd331d182d18cf730f7c8e94c29fb9e87ca58685ede758d730cb23f700df49c0967a091c91383a0dfaf99afc6216c4e9dd88f721150064d856b5b4c1d39641750469cc746faae8720cc3f30b1805d0934e16dfd0cc275e7ba63e0cf2108889b674c6ce9bc960816201b81c10db4e716047be5c80e71efba5a4cb65c0750463059bd5b2d379c72dc4471d35a401a6fd4c4e9b4a7c730240f923482a9d2d28de6894e830ba8486f9ea1a8da8489f104cda2fe8ce7bfb1640d26ab846173cf1a5b90712eb84c20666c80a32f807568dadb9034f6bc9cb26e12ecba49038c7f870f5efca49c98e492be8a0b448e8d142917d478c5bb73f2ed87ec8808dbb1bc6965900ab1d1296e9a3069eeb1ade783a0b4b416604f0f3d67389f9781952750335090b3f41d0efbddae0c31e2c0c42e4f5114153d679d851d0f0a573fecaf28033579491baa2dcb158ff8c1b57303ee4d0c86eed5b91595d98965a1ba585c9c176c1721a5eb45b07a452a8835ab8bc0546298c48209333f69906e259bc893c5706f26ee6b26121e822666d29f023357d04b4ddb4bcfdaad5a8a47af261df161f9e056c7501b4878e759792e8457311907acb18f1e7b63ad4b478ec88ceb56dbf72117703444bfca5b1af6dec939fa8840c07eef5471012db01530385cb953d1f358d33a99f02415c9dc6f464532db74b886020661626b5551d885a3f22a498988ea6cd6d6e3d6cf585a29b56952256cbee1297e9168131355179e87aed56d05bfe5155fcf2640fae01b8dd9ddf3ba434a952bccd3fd0d3f30be7f5638e3a47411cc90f2ae82afbc2c1eea4e8e31d073d5ed9cd9d9c9efa6467b4841da92f17ac84cefc8b0689a929d1a713e8af672582a9f267f89f4b9cb4ded41ecb7b5a9805c6dca39664b2cb6d0493ff7d551ea00040e47b6508c76285c1791b21ebc3ba77f2091eaa292ca89348b5676efe7ae5e7b2ed1b4c46cddbe6091cd59fdb55fb9b46ef91e68cb116bc37b6310999aa04df1fbad0d3842c69f74a557bd3ac08a30b8aa7dda0c9c0d83fa048713929cc3b3a6b83297e2613058256c00e1f02805596b41d4851209bacaf3f38160387c2b5e573be8f9ce96954acc7f05ae26ed113fc84f624826ed88797fd5babe18243e37e1402a1c0c6be8af0dccc5d6ed5a733152a991d0696ce19ffdbab9b3e4c5f7cd8be63566ae22858d4418a6f32a3ffe39d975f85ebaf33879e6b069f9ffc216922f7c634007cf95f1cb2ca202c3a246a5a8cb532a8c88f097695a2f34ad8be3f8d1707307a0f3d039c5da907fd48479fd358d5763508e478ba854d94725229a88a3f61f77a3b828a4029a2d00cf3c73b5ba924087a00a2d57f39b19f2f57975b41c4d237b27abfa8afc21a0fed93d5010bd18ea08234a5148c5db87f6bf6e286a8c0675b999e749680e41a3bd21940ebda3fd8f92b32ada17a19e8a953921311d061cc0f30075b7061282cc0e4b9f58127f6eac2d3e7e50f065c34dced8216561f0373ec6b9380b488eb01e07677bf63180c48ab41c3081a28b6d131b09b8df2bc754bff332c4c24378736ebbde3e4f80b7e8cd0c5a84e1dde76dce10454f9cbd1af2f489b6ce068d81754808df5cd7c68744dc327648ba760d590670068df5914ad488272789c82155e8b0681841fff5b57273219a40b00c58a0291eb1a4f85fdad267213d40349e06e096b3ea269d52d583cedfd03e5ac5be83c8a80741849e54e101ca8c69d57b453577d1b8aef9d211e67689c64452dac43c198650c33d642f04df3a849962ad50679d96a2fb15979b2df1184c54607de354c88394cfe279ec85b243ff90d94ab96ee8884a98eae57bff3b39be11e17a81759355a8fbdd4a1e2c6bd46ff51dc5a5bd70889f62522e0c6e014b52c6bc054d15c3b0a43b2face9c35c6d155c88a70e8c5f13331f023a7d9bd9c20cfd9fb64709d39727f98c96cca0e28b92ffdfbe4ced0bf4fd567f54fc8d4b2b674f3776633c33603d1d94b916a160d8ae5ef7b842d32fe3ca79bf484adca4e1940929b5ec1f9c952e101f8bdbeae921541fddf414ffa3434eafeec1d5c321122465ba1b4e60ea8675f0c8ccdf38d3c69f663025e250869c5a5df73d59a80b9e537cf13ec5646a255d9c97db5294ee178da68e28b554abfe0acab072e176683fc8cc150af229bec2c94d83b99daa9594d074f87318006597b00885ad0c2d0d524e1ce8ccd5c361ee01c04cf722af7a62d5b89cdd9c22647c92f90c9a62f8249f2eb13de3a12db43fe6b7ccee348227ab229c2eca46e0c2f544a2f8d39a69561f87ff643a3599218834742c18574e8eea47b3f3a23903182f26801bfc0568ce1109f3e035719abbe41662c86f9c2b4404536287c6267143aadc234f257d91657d192001732555fe399ca9a5769cfadfe7b6565ca2294acb7ac37da0d77498f733a645fdb551e30fe882eb5d09c4ca4ce7d02af34b908679b9e34dc75001ab7b4a1f49ec4d7ee8c09d1a4fef4201e1df23281b9e571775dc82675d824d4dc5c688683da2d6c8ee735d92f32a8b5548a7957ffd5a1beb98ed98f956a0594d5c7a65d32b4aa706e0b86cd944a6da8e0df799bc23882e025d952a9d0ba26eeda93940a738935109b5b8b53fd06d2b9f3232b928815e9e4b3ec4572afc5f581c259a73ff931a022f0f7457c5371cd5694cbd45a0513a1d992e117c112f59a80792784cfc293e7527dc68b11b03ca2a18713d2e1627c995f2f2234b467890c4dd9d6696cb1f67d4dbfa21f7d60bc028e8da0e7ac9a1c7100f74692158aed4131276bcdcd5561c93abfce1f36440146d7857248a2385f44a926dd80d4f024059871fe5b42717a15687c3e6a6c78806ee016284199917023f20aecc9b06d9982a2ea6d3633c51c18a66b41b0a9286d96e2836e71aa83621c7d66c31b20d81c4f04e766acc0b2a08a88cd62f6399b2137f92212309dc03412d078d8d02bad071f08299ac4b06bd524d827c72f2b724d6f4f3dbc0b6e7255158b5b5a3b38fe0434ea1f761fb853d9c50b7fa018da4aeb5ecf2a1ba7af8f8062212849734604ad4290266af0b62892e1fe10b1c234c6e268c4781f55e059906caa78c490baa179e2d124d005bdf440b6ab3a7220a031366c546f5489932f9d9beb59eef669adedf6a924ee9867a3ddc0cb9310cad9574b73b519160f490d8f845a6b42c0873804c29c636683e8e13bb75e55e41fe600771dc84cb144916beddd7d7cb6eb2da06bd747f66df9d39aa9a37951ee86934ac403514fe9e89b988f3fac5222ede78436e4e071f6a9d5095eb73aad654b4ad6a8b99ca9b6e3af6fe65a92ef68012b15112252b0d6b3253c850c005c82a9752aa1283e251ccc466a50479c35efeea50497224baba5428f49a0c2a47290346b6ba7b9897599ce1e8ef5987e9a592fae4450803397d179d9633af0d02cae1707907256236fa005b2eeaa7206d8625a92eeecd042580d2ac86a8ea1080604178dc17432d6f450638ed3dd256a987fe5d06526b72eae179382c4cfbf8be39f6a4adb7b438a75f8489e7b44b653acaad2ddcff2cceddd9ee5d2dcf5e10121f75371c4daa64ab03548e5647a9ae6808998876f0cc4f79fb51ef688e83b9c1f9c344be9a3f965e7dd1a93f00ba99bc0e40311818cf52bbd1db73efc62caff7b725931e9ca0d6a52ba99e1344e08de182e393c6edc402a9a04f85529854ed6d159d579ab83f1387bf17045955f7717ed2532160ead4313ab5b4f926382f6b2dde59916139a7aa5ba1c50c5f1651d29678eb10c87baaba1ef225981bf187d65e19192cbcf7b49a246c76f3a0e750a69a8fddac40fb07a7fbd3450708713839acd088dcddf5d3b0dfe647c9c1e801afc62413d1691f65f524d1408b66798e9a50ab05930bcc4f6e24a55c6230226f1e8d556e56ef81d0b6af465ae70315c43c7046ede98bf37b7450d327f3e6249a05ac6b1b2f5eaa7acca1bb6f33c261a26d459a12acabddc61344b28494d9424d4958a1606e239e04d1d538045bd71b1d63cab8bbe5b5cf5410f41cd66c4cd81bc36413bfa9136ac6771d0d6a27a1cebac5dc238153ab38ba48ddcdf9664430602cb8dbc8675e483cbe7a675c50aee39d8c90574b97ddb11ff93fc94f7e821a22f49d5cbcd1d4df87aec9c63f25923a9a0ca8eb3d888b541575557d3d1c96719aa6ccde2bca8dcf1cefa78f9ecabbf1a7666eb5272046637eea09b8a7abac0cfb0b989bbad926401a9e7b340f3c63ce0248c8d97aca8bd4b7fd5eb1b3296acff1684fe395e9d803cf78eb3c32f295df3f71d97ec5e76e14e407b0afa179d1ba4631b295f00cc84907a0f5237fae9cd0451a65fde3e736a1d7da01a7e44c61a4c84be543e718ff1740a104bdfab0d1d54b0b835f560e15d7c6ac2169b1fc002280483e77d688d4d29e21ead26a043baaf83de2d95acbe6bdcf617a718bb06f5b7d22ce75bbf854777834443fad51e4d7ea32167c2087019dee8b3c5c109b61697d498ad09853a09d13cbcb1b3d2f44aeca2aabb2efcb7e85b62cda7354426a82c87b8f9c8ef4664f66bf2595028fb4eb6f07bc6a25c682ccd2a49ece93f820b3731638c1e6980b2aa4a9afceb1cde3db7828e9f23d2c12cdfa763040306e52b5a098b1a3fa4346369ed6ff7459cf2ae2964f81591042e19cade3d5523fe3d9f675c9f1b71b16d265ccefeaf5a6a9fb19e3e3023b72ce02ac09e7973cfd41969e700b4e89cf4d069ca6fcbb52335ac5e04f18f6eae6f2e53e75755651102ae330e3c850e1a6358ff68e75f27c50c511c45ef09f2c51628c5056fef512d65038c5a0a498fdf8a976517a711cd9a55e2211b8c2bcd12257c61a8abce6d8c476a4321142d386ea4425067fc3c340a7e7a67ecd47f246c65e22f4be07d8a1778a0760723e3e6b5bf33634fcc33a349b06112548a4af10e03a2d2098347d1efb46c0150827e384d1840ec"}) syz_open_dev$cec(&(0x7f0000000340)='/dev/cec#\x00', 0x0, 0x2) r2 = syz_open_dev$binder(0x0, 0x0, 0x5) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xc, 0x108072, r2, 0x0) r3 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x7fffffff, 0x100) write$P9_RLERRORu(r3, &(0x7f0000000040)={0x10, 0x7, 0x1, {{0x3, '+]*'}, 0x6}}, 0x10) write$UHID_CREATE2(r3, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000073797a30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000035c600000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000036b0bb23000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006300030000000000030000008d000000a0000000f1cc7bc8f3376d447d1b9871cdf1163fd70a5f14af49b6ee00080000000000008d30199ae46ee5c68dcc58060900000000000000d67cedaf2989f188ff2b9067e47a6dec2f0620be562b0d9d78f1c258a611d93c8509745724a36746356950"], 0x17b) 02:01:33 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x7d0d) 02:01:33 executing program 2: syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x4, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x8202, 0x0) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, &(0x7f0000000080), 0x4) syz_open_dev$midi(&(0x7f0000000500)='/dev/midi#\x00', 0x5, 0x10000) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, 0x0, &(0x7f0000000340)) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f00000000c0), 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xb, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x100, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x47744279}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1) syz_genetlink_get_family_id$team(&(0x7f0000000580)='team\x00') r3 = accept4(r2, &(0x7f00000005c0)=@hci={0x1f, 0x0}, &(0x7f0000000640)=0x80, 0x80800) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000700)={'sit0\x00'}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000740)={'team0\x00', r4}) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000a00)={0x0, 0x3, 0x3}, 0x8) accept4$packet(r0, &(0x7f0000003280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000032c0)=0x14, 0x0) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) 02:01:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 835.740438] binder: 11640:11646 BC_ACQUIRE_DONE u0000000000000000 no match [ 835.775095] binder: 11640:11646 DecRefs 0 refcount change on invalid ref 0 ret -22 02:01:33 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xc00e) [ 835.809489] binder: 11640:11646 Release 1 refcount change on invalid ref 8 ret -22 [ 836.150851] binder: BINDER_SET_CONTEXT_MGR already set [ 836.159975] binder_alloc: 11640: binder_alloc_buf, no vma [ 836.172348] binder: 11620:11633 ioctl 40046207 0 returned -16 [ 836.192327] binder: 11620:11660 unknown command 0 [ 836.234984] binder: 11620:11660 ioctl c0306201 20000600 returned -22 02:01:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x630d, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:34 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 836.294072] binder_release_work: 4 callbacks suppressed [ 836.294079] binder: undelivered TRANSACTION_ERROR: 29189 [ 836.333771] binder: undelivered TRANSACTION_COMPLETE 02:01:34 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x142, 0x2f) 02:01:34 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xf000) [ 836.372566] binder: undelivered TRANSACTION_ERROR: 29189 [ 836.420763] validate_nla: 8 callbacks suppressed [ 836.420770] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:34 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x34000) [ 836.513429] binder: 11640:11650 BC_ACQUIRE_DONE u0000000000000000 no match [ 836.545243] binder: 11640:11650 DecRefs 0 refcount change on invalid ref 0 ret -22 02:01:34 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6558000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:34 executing program 2: syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x4, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x8202, 0x0) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, &(0x7f0000000080), 0x4) syz_open_dev$midi(&(0x7f0000000500)='/dev/midi#\x00', 0x5, 0x10000) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, 0x0, &(0x7f0000000340)) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f00000000c0), 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xb, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x100, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x47744279}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1) syz_genetlink_get_family_id$team(&(0x7f0000000580)='team\x00') r3 = accept4(r2, &(0x7f00000005c0)=@hci={0x1f, 0x0}, &(0x7f0000000640)=0x80, 0x80800) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000700)={'sit0\x00'}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000740)={'team0\x00', r4}) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000a00)={0x0, 0x3, 0x3}, 0x8) accept4$packet(r0, &(0x7f0000003280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000032c0)=0x14, 0x0) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) [ 836.585295] binder: BINDER_SET_CONTEXT_MGR already set [ 836.630434] binder: 11640:11650 Release 1 refcount change on invalid ref 8 ret -22 [ 836.651291] binder: 11673:11676 ioctl 40046207 0 returned -16 [ 836.658676] binder: BINDER_SET_CONTEXT_MGR already set [ 836.664184] binder: 11640:11685 ioctl 40046207 0 returned -16 [ 836.677216] binder: 11673:11689 unknown command 0 02:01:34 executing program 0: r0 = accept4$netrom(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80800) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000040)={'veth1_to_bridge\x00', {0x2, 0x4e23, @broadcast}}) syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x100013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001800)='/dev/autofs\x00', 0x400000, 0x0) ioctl$UI_ABS_SETUP(r2, 0x401c5504, &(0x7f0000001840)={0x22, {0x8, 0x100000000, 0x9d6, 0x8, 0x5, 0xffffffffffff0000}}) recvmsg(r0, &(0x7f00000017c0)={&(0x7f00000001c0)=@vsock={0x28, 0x0, 0x0, @host}, 0x80, &(0x7f0000001640)=[{&(0x7f0000000240)=""/194, 0xc2}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f0000000340)=""/166, 0xa6}, {&(0x7f0000000400)=""/106, 0x6a}, {&(0x7f0000001500)=""/22, 0x16}, {&(0x7f0000001540)=""/185, 0xb9}, {&(0x7f0000001600)=""/24, 0x18}], 0x7, &(0x7f00000016c0)=""/243, 0xf3}, 0x40) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0xc0000, 0x0) getsockname$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000180)=0x1c) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xfffffff6, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:34 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x400300) [ 836.712540] binder: 11673:11689 ioctl c0306201 20000600 returned -22 [ 836.732094] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:34 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:34 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x143, 0x2f) [ 836.773544] binder_alloc: 11673: binder_alloc_buf, no vma [ 836.804413] binder: 11673:11682 unknown command 0 02:01:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40046302, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 836.819621] binder: 11673:11682 ioctl c0306201 20000600 returned -22 [ 836.826441] binder: undelivered TRANSACTION_ERROR: 29189 [ 836.827406] binder: BINDER_SET_CONTEXT_MGR already set [ 836.844666] binder: 11693:11694 ioctl 40046207 0 returned -16 [ 836.845128] binder: undelivered TRANSACTION_ERROR: 29189 02:01:35 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xf0ffff) 02:01:35 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x1000000) [ 837.109231] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 837.144532] binder: BC_ACQUIRE_RESULT not supported 02:01:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 837.173516] binder: 11705:11710 ioctl c0306201 20000600 returned -22 02:01:35 executing program 2: syz_open_dev$ndb(&(0x7f00000000c0)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x0) [ 837.234275] binder_alloc_mmap_handler: 5 callbacks suppressed [ 837.234293] binder_alloc: binder_alloc_mmap_handler: 11705 20001000-20004000 already mapped failed -16 [ 837.292812] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 837.311114] binder: BINDER_SET_CONTEXT_MGR already set [ 837.322813] binder: 11705:11710 ioctl 40046207 0 returned -16 02:01:35 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x2000000) 02:01:35 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x144, 0x2f) [ 837.343237] binder_alloc: 11705: binder_alloc_buf, no vma [ 837.382613] binder_transaction: 3 callbacks suppressed [ 837.382646] binder: 11705:11721 transaction failed 29189/-3, size 0-0 line 3035 [ 837.382817] binder: BC_ACQUIRE_RESULT not supported 02:01:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 837.445799] binder: release 11705:11710 transaction 705 out, still active [ 837.464390] binder: 11705:11714 ioctl c0306201 20000600 returned -22 [ 837.473446] binder: undelivered TRANSACTION_COMPLETE [ 837.488651] binder: undelivered TRANSACTION_ERROR: 29189 [ 837.503100] binder: release 11705:11710 transaction 705 in, still active [ 837.522115] binder: send failed reply for transaction 705, target dead [ 837.547985] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:35 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpx.stat\x00', 0x275a, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, 0x0, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x7c774aac) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x300000a, 0x2011, r0, 0x0) 02:01:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40046304, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:35 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x4000000) 02:01:35 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.stat\x00', 0x0, 0x0) write$USERIO_CMD_REGISTER(r1, &(0x7f0000000040)={0x0, 0x7fff}, 0x2) 02:01:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:35 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x8000000) [ 837.726535] binder: 11741:11747 unknown command 0 [ 837.731440] binder: 11741:11747 ioctl c0306201 20000600 returned -22 [ 837.740428] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 837.768003] binder_alloc: binder_alloc_mmap_handler: 11741 20001000-20004000 already mapped failed -16 [ 837.778513] binder: BINDER_SET_CONTEXT_MGR already set [ 837.805214] binder: 11746:11750 ioctl 40046207 0 returned -16 [ 837.812548] binder: BINDER_SET_CONTEXT_MGR already set 02:01:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8100000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:35 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x145, 0x2f) [ 837.823458] binder: 11741:11747 ioctl 40046207 0 returned -16 [ 837.835919] binder_alloc: 11741: binder_alloc_buf, no vma [ 837.854467] binder: 11741:11753 transaction failed 29189/-3, size 0-0 line 3035 [ 837.882273] binder: 11741:11751 unknown command 0 [ 837.902194] binder: 11741:11751 ioctl c0306201 20000600 returned -22 [ 837.923322] binder: release 11741:11747 transaction 709 out, still active 02:01:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40046307, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 837.935206] binder: undelivered TRANSACTION_COMPLETE [ 837.953044] binder: undelivered TRANSACTION_ERROR: 29189 [ 837.961256] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 837.969377] binder: release 11741:11747 transaction 709 in, still active 02:01:36 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xa000000) [ 837.995471] binder: send failed reply for transaction 709, target dead [ 838.042581] binder: 11764:11765 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 838.070055] binder: 11764:11765 unknown command 0 02:01:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x88a8ffff00000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 838.089779] binder: 11764:11765 ioctl c0306201 20000600 returned -22 [ 838.136184] binder_alloc: binder_alloc_mmap_handler: 11764 20001000-20004000 already mapped failed -16 [ 838.167322] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 838.177700] binder: BINDER_SET_CONTEXT_MGR already set 02:01:36 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xe000000) [ 838.190883] binder: 11764:11765 ioctl 40046207 0 returned -16 [ 838.221618] binder_alloc: 11764: binder_alloc_buf, no vma [ 838.250525] binder: 11764:11771 transaction failed 29189/-3, size 0-0 line 3035 [ 838.250538] binder: 11764:11776 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 838.250552] binder: 11764:11776 unknown command 0 [ 838.327098] binder: 11764:11776 ioctl c0306201 20000600 returned -22 [ 838.333113] binder: release 11764:11765 transaction 714 out, still active [ 838.349235] binder: undelivered TRANSACTION_COMPLETE [ 838.368855] binder: undelivered TRANSACTION_ERROR: 29189 [ 838.384527] binder: release 11764:11765 transaction 714 in, still active [ 838.414262] binder: send failed reply for transaction 714, target dead [ 838.546446] binder_alloc: binder_alloc_mmap_handler: 11746 20001000-20004000 already mapped failed -16 02:01:36 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8dffffff]}}}}, 0x48) 02:01:36 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x146, 0x2f) 02:01:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9effffff00000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:36 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xf000000) 02:01:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40086303, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) getsockname(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, &(0x7f0000000200)=0x80) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f00000002c0)={0x0, 0x841d}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r2, 0x84, 0x78, &(0x7f0000000340)=r3, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c630000e85e2a2317bc855524287b1b7472790b1d055617851e612e392b4fe1ac18956bc45dbbfcd45cd5363a66ae4a32b14176c5daf489795b665b0e28c2eeb0f855a40952e2f0eff7ebbf9275708a36ac55bf4cc16b03"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) write$evdev(r0, &(0x7f0000000080)=[{{0x0, 0x7530}, 0x0, 0x3f, 0x5}, {{0x77359400}, 0x15, 0x10001, 0x3}, {{0x77359400}, 0x17, 0x9}, {{0x0, 0x2710}, 0x0, 0x5fa, 0x7f}, {{0x77359400}, 0x12, 0x8d65, 0x800}, {{}, 0x2, 0x8001, 0x5}, {{0x77359400}, 0x0, 0x62d6, 0x100}], 0xa8) socket$inet_udp(0x2, 0x2, 0x0) [ 838.706969] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:36 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x10000000) [ 838.753586] binder: 11788:11797 BC_FREE_BUFFER u0000000000000000 no match [ 838.764074] binder: BINDER_SET_CONTEXT_MGR already set [ 838.782547] binder: 11789:11799 ioctl 40046207 0 returned -16 [ 838.794909] binder: 11788:11797 unknown command 0 02:01:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa907000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 838.808291] binder: 11788:11797 ioctl c0306201 20000600 returned -22 [ 838.826892] binder_alloc: binder_alloc_mmap_handler: 11789 20001000-20004000 already mapped failed -16 [ 838.827834] binder_alloc: binder_alloc_mmap_handler: 11788 20001000-20004000 already mapped failed -16 02:01:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) syz_genetlink_get_family_id$team(0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) mkdirat(r1, &(0x7f00000001c0)='.//ile0\x00', 0x0) renameat(r1, &(0x7f0000000240)='.//ile0\x00', r1, &(0x7f00000000c0)='./file0/f.le.\x00') [ 838.879204] binder: BINDER_SET_CONTEXT_MGR already set [ 838.884535] binder: 11789:11810 ioctl 40046207 0 returned -16 02:01:37 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x3f000000) [ 838.927117] binder: BINDER_SET_CONTEXT_MGR already set [ 838.931521] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 838.932451] binder: 11788:11797 ioctl 40046207 0 returned -16 [ 838.945610] binder_alloc: 11788: binder_alloc_buf, no vma [ 838.974079] binder: 11788:11817 transaction failed 29189/-3, size 0-0 line 3035 02:01:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff00000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:37 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x101000, 0x0) setsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000000040)=0x6848, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0c630000a102a0a1da0035dfec29e28abfe34748642bdf4b1d3ccefda2b3e9db8d909b598194493f63da4e9a5fae89e6c0a1434770bbae1c4e7fa1c10efcd429f09645bdd5bb3c7ecc9de0c6be62f04c761efb9d551827b69004a872ef260d5e0e8e96de7d4ccebaa55e7e96559ea66a34fe10fe15dac9d8417453dab4431068f89eceeb54f5cc998f4d9876903b0c9a6727aade5614ae6dffcc3d2908d13d35c68dc56b4383f8debda17901476e126facbdd2d4ebedd044fd49f644a8e642cbc32ee8345192e43c68560d2d13594cc15b84f22362a5f4580b9e7f90e66f98e2debb9a770dd08714db530726c0afec6282986b26154cc26b2128bb"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 839.021893] binder: 11788:11806 BC_FREE_BUFFER u0000000000000000 no match 02:01:37 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x147, 0x2f) [ 839.073348] binder: undelivered TRANSACTION_ERROR: 29189 [ 839.091214] binder: 11788:11806 unknown command 0 [ 839.115208] binder: release 11788:11797 transaction 718 in, still active [ 839.135330] binder: 11788:11806 ioctl c0306201 20000600 returned -22 [ 839.150030] binder: send failed reply for transaction 718 to 11788:11797 [ 839.174911] binder: undelivered TRANSACTION_COMPLETE 02:01:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x4008630a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) syz_genetlink_get_family_id$team(0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) mkdirat(r1, &(0x7f00000001c0)='.//ile0\x00', 0x0) renameat(r1, &(0x7f0000000240)='.//ile0\x00', r1, &(0x7f00000000c0)='./file0/f.le.\x00') 02:01:37 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x60000000) [ 839.220708] binder: undelivered TRANSACTION_ERROR: 29189 02:01:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfeff000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:37 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x7d0d0000) [ 839.375822] binder: BINDER_SET_CONTEXT_MGR already set [ 839.405041] binder: 11841:11845 ioctl 40046207 0 returned -16 [ 839.414275] binder_alloc: binder_alloc_mmap_handler: 11833 20001000-20004000 already mapped failed -16 02:01:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xff0f000000000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 839.429350] binder: BINDER_SET_CONTEXT_MGR already set [ 839.449574] binder: 11833:11837 ioctl 40046207 0 returned -16 [ 839.459399] binder: BC_ATTEMPT_ACQUIRE not supported [ 839.464531] binder: 11841:11853 ioctl c0306201 20000600 returned -22 02:01:37 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x148, 0x2f) [ 839.509934] binder: release 11833:11837 transaction 721 in, still active [ 839.554588] binder: send failed reply for transaction 721 to 11841:11845 02:01:37 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0xfffffffffffffde0, 0x0, &(0x7f0000000080)=[@enter_looper], 0x8, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:37 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x9effffff) 02:01:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) syz_genetlink_get_family_id$team(0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) mkdirat(r1, &(0x7f00000001c0)='.//ile0\x00', 0x0) renameat(r1, &(0x7f0000000240)='.//ile0\x00', r1, &(0x7f00000000c0)='./file0/f.le.\x00') 02:01:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffff000}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 840.157276] binder_alloc: binder_alloc_mmap_handler: 11841 20001000-20004000 already mapped failed -16 [ 840.166898] binder: BINDER_SET_CONTEXT_MGR already set [ 840.172349] binder: 11841:11853 ioctl 40046207 0 returned -16 [ 840.178151] binder: BC_ATTEMPT_ACQUIRE not supported [ 840.183384] binder: 11841:11892 ioctl c0306201 20000600 returned -22 [ 840.190197] binder: undelivered TRANSACTION_COMPLETE [ 840.195391] binder: undelivered TRANSACTION_ERROR: 29189 02:01:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40086310, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:38 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xc00e0000) 02:01:38 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x149, 0x2f) 02:01:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:38 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) syz_genetlink_get_family_id$team(0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) mkdirat(r1, &(0x7f00000001c0)='.//ile0\x00', 0x0) renameat(r1, &(0x7f0000000240)='.//ile0\x00', r1, &(0x7f00000000c0)='./file0/f.le.\x00') [ 840.200945] binder: release 11841:11891 transaction 723 out, still active [ 840.215221] binder: undelivered TRANSACTION_COMPLETE [ 840.262891] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'. 02:01:38 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xf0ffffff) [ 840.310434] binder: BINDER_SET_CONTEXT_MGR already set [ 840.323918] binder: 11899:11903 ioctl 40046207 0 returned -16 02:01:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0xa, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 840.422047] binder: 11899:11910 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 840.436692] binder: 11899:11910 unknown command 0 [ 840.447411] binder: 11899:11910 ioctl c0306201 20000600 returned -22 [ 840.483820] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 840.524113] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.1'. [ 840.552489] binder_alloc: binder_alloc_mmap_handler: 11870 20001000-20004000 already mapped failed -16 [ 840.563857] binder: BINDER_SET_CONTEXT_MGR already set 02:01:38 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) clock_settime(0x7, &(0x7f0000000000)={0x77359400}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c63ce47"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:38 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xfffff000) 02:01:38 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) syz_genetlink_get_family_id$team(0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) mkdirat(r1, &(0x7f00000001c0)='.//ile0\x00', 0x0) 02:01:38 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x14a, 0x2f) 02:01:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x25, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 840.569469] binder: 11870:11917 ioctl 40046207 0 returned -16 [ 840.576074] binder: send failed reply for transaction 723, target dead [ 840.584078] binder: send failed reply for transaction 724 to 11899:11903 [ 840.722365] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'. [ 840.750322] binder: 11928:11933 unknown command 1204708108 [ 840.762446] binder: 11928:11933 ioctl c0306201 20000140 returned -22 [ 840.779906] binder_alloc: binder_alloc_mmap_handler: 11928 20001000-20004000 already mapped failed -16 [ 840.864013] binder: BINDER_SET_CONTEXT_MGR already set [ 840.896226] binder: 11928:11940 ioctl 40046207 0 returned -16 [ 840.902543] binder: 11928:11933 unknown command 1204708108 [ 840.911428] binder: 11928:11933 ioctl c0306201 20000140 returned -22 02:01:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x52, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:39 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xffffff7f) 02:01:39 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) syz_genetlink_get_family_id$team(0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) 02:01:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x400c630e, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:39 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x14b, 0x2f) 02:01:39 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\fc\x00\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 841.102102] binder_alloc: 11899: binder_alloc_buf, no vma [ 841.107854] binder: 11899:11946 transaction failed 29189/-3, size 0-0 line 3035 [ 841.115843] binder: 11899:11946 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 841.123209] binder: 11899:11946 unknown command 0 [ 841.128411] binder: 11899:11946 ioctl c0306201 20000600 returned -22 [ 841.144319] binder: undelivered TRANSACTION_COMPLETE [ 841.224556] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'. 02:01:39 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xffffff9e) [ 841.268088] binder: BINDER_SET_CONTEXT_MGR already set [ 841.290856] binder: 11954:11962 ioctl 40046207 0 returned -16 02:01:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x60, 0x12, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 841.331197] binder: BINDER_SET_CONTEXT_MGR already set [ 841.341489] binder: release 11952:11958 transaction 729 in, still active [ 841.352451] binder: 11952:11958 ioctl 40046207 0 returned -16 [ 841.359696] binder: send failed reply for transaction 729 to 11954:11964 [ 841.372805] binder: 11954:11964 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 02:01:39 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) syz_genetlink_get_family_id$team(0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0) [ 841.396423] binder: 11954:11964 unknown command 0 [ 841.409677] binder: 11954:11964 ioctl c0306201 20000600 returned -22 02:01:39 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r1, 0xc04c5349, &(0x7f00000000c0)={0x2, 0x10000, 0xfffffffffffff000}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\f\a\x00\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 841.442378] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'. 02:01:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x9, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:39 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xfffffff0) 02:01:39 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x14c, 0x2f) [ 841.648911] binder: 11975:11986 unknown command 1804 02:01:39 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x40030000000000) 02:01:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x33, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 841.694061] binder: 11975:11986 ioctl c0306201 20000140 returned -22 [ 841.717862] binder: BINDER_SET_CONTEXT_MGR already set [ 841.732403] binder: 11975:11991 unknown command 1804 [ 841.757257] binder: 11975:11986 ioctl 40046207 0 returned -16 [ 841.775985] binder: 11975:11991 ioctl c0306201 20000140 returned -22 [ 841.858872] validate_nla: 5 callbacks suppressed [ 841.858881] netlink: 'syz-executor.1': attribute type 51 has an invalid length. [ 842.058426] binder_alloc: 11954: binder_alloc_buf, no vma [ 842.064007] binder: 11954:12005 transaction failed 29189/-3, size 0-0 line 3035 [ 842.075250] binder: 11954:12005 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.082419] binder: 11954:12005 unknown command 0 [ 842.087670] binder: 11954:12005 ioctl c0306201 20000600 returned -22 [ 842.094329] binder: undelivered TRANSACTION_COMPLETE [ 842.099565] binder_release_work: 2 callbacks suppressed 02:01:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x400c630f, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:40 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) syz_genetlink_get_family_id$team(0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0) 02:01:40 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x4004c0, 0x0) ioctl$VIDIOC_TRY_DECODER_CMD(r0, 0xc0485661, &(0x7f00000000c0)={0x7, 0x2, @stop_pts=0x99}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) openat$capi20(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/capi20\x00', 0xfffffffffffffffe, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c0032509c81cf83ba5408a2b27a3eeb9418dc55f4"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:40 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x14d, 0x2f) 02:01:40 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xf0ffffffffffff) 02:01:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x52, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 842.099571] binder: undelivered TRANSACTION_ERROR: 29189 [ 842.165377] binder: undelivered TRANSACTION_ERROR: 29189 02:01:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x63, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:40 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x100000000000000) 02:01:40 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 842.223548] binder: 12013:12020 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 842.302301] binder: 12013:12020 unknown command 0 02:01:40 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) syz_genetlink_get_family_id$team(0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0) [ 842.340499] binder: 12013:12020 ioctl c0306201 20000600 returned -22 [ 842.360422] binder_alloc_mmap_handler: 4 callbacks suppressed [ 842.360440] binder_alloc: binder_alloc_mmap_handler: 12013 20001000-20004000 already mapped failed -16 [ 842.409374] binder: BINDER_SET_CONTEXT_MGR already set 02:01:40 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x200000000000000) 02:01:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x3c6, @ip6erspan={{0x10, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 842.429683] binder: 12013:12020 ioctl 40046207 0 returned -16 [ 842.437935] binder: BINDER_SET_CONTEXT_MGR already set [ 842.443533] binder: 12034:12036 ioctl 40046207 0 returned -16 [ 842.450158] binder_alloc: 12013: binder_alloc_buf, no vma [ 842.457209] binder: 12013:12037 transaction failed 29189/-3, size 0-0 line 3035 [ 842.472557] binder: 12034:12036 unknown command 0 [ 842.509102] binder: 12034:12036 ioctl c0306201 20000140 returned -22 [ 842.522755] binder: 12013:12032 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 842.560606] binder_alloc: binder_alloc_mmap_handler: 12034 20001000-20004000 already mapped failed -16 [ 842.602651] binder: release 12013:12020 transaction 734 out, still active [ 842.613608] binder: 12013:12032 unknown command 0 [ 842.619411] binder: undelivered TRANSACTION_COMPLETE [ 842.632623] binder: BINDER_SET_CONTEXT_MGR already set [ 842.644407] binder: 12013:12032 ioctl c0306201 20000600 returned -22 [ 842.655117] binder: undelivered TRANSACTION_ERROR: 29189 [ 842.660625] binder: release 12013:12020 transaction 734 in, still active [ 842.668195] binder: 12034:12036 ioctl 40046207 0 returned -16 [ 842.684908] binder: 12034:12053 unknown command 0 [ 842.692821] binder: send failed reply for transaction 734, target dead 02:01:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40106308, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:40 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x400000000000000) 02:01:40 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x14e, 0x2f) 02:01:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x2, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 842.704517] binder: 12034:12053 ioctl c0306201 20000140 returned -22 [ 842.789003] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.1'. 02:01:40 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x800000000000000) 02:01:40 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) 02:01:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0xfffffffffffffff6) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm-monitor\x00', 0x2000, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) symlink(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='./file0\x00') mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x3000005, 0x110, r0, 0xfffffffffffffffc) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="647b8235bbd57ce9c2c6397e6cbe007a9b21d800a6044cc74c1d80c39329ebe0c0101fd3082b1ab2012b6ba741ecfefc18941273978a6a55cd453607feddc56a22e35bdc60429bbcaaa8c422d6ee4b66b290ff389a3999bcb5b828fe3fe6134415302e516805319cc10dca53324170372c86f3d3f72e76d52dba80d932edab126fd45a0abb8e7c04d1bf0a09e4a92867eb51ea514edd38108925400a86c418476f6ecb4e66f09787756f3cfa8c9cf33dc8279bdf6a1802f8d544626d44a9fc43f0ccfb66ed95b2c689dacc821afe877eab000000000000000000000000c291ecf081199461955fb598e26505d86da394b2a2a32d82a3c480c5ec360a32b57080fc7f4aaebe2fa5d14ec366079d4602198bd0a11bc18a98abc1a3ea024bf1658736b53489dada15b90b62e425bb0423616c127aa7dde759d559ae6fecfc2e784b5503e36f6cd032a7c741d4216d053459b90000000000"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000440)='lp\x00', 0x3) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) r4 = openat$zero(0xffffffffffffff9c, 0x0, 0x220200, 0x0) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000340), &(0x7f0000000380)=0x4) bind$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f00000001c0)) r6 = socket$inet6(0xa, 0x3, 0x7) openat$vsock(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vsock\x00', 0x2200, 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000140)) r7 = openat$uhid(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uhid\x00', 0x7eab175ef0c165ec, 0x0) ioctl$KVM_HYPERV_EVENTFD(0xffffffffffffffff, 0x4018aebd, 0x0) sendfile(r3, r7, 0x0, 0x10002) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) fcntl$setsig(r4, 0xa, 0x2f) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100)=0x3e0, 0x4) ioctl$DRM_IOCTL_GET_STATS(r6, 0x80f86406, &(0x7f0000000900)=""/4096) fstatfs(r5, &(0x7f0000000500)=""/88) prctl$PR_CAPBSET_DROP(0x18, 0x400002) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000480)={0x0, 0x1, {0xffffffffffffffff, 0x3, 0x7f, 0x0, 0x9}}) [ 842.835499] binder: 12062:12065 BC_INCREFS_DONE node 736 has no pending increfs request [ 842.844179] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.1'. [ 842.893369] binder: 12062:12065 unknown command 0 [ 842.921961] binder: 12062:12065 ioctl c0306201 20000600 returned -22 02:01:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x3, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:41 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xa00000000000000) [ 842.977561] binder_alloc: binder_alloc_mmap_handler: 12062 20001000-20004000 already mapped failed -16 [ 843.023711] binder: BINDER_SET_CONTEXT_MGR already set [ 843.041776] binder: 12062:12065 ioctl 40046207 0 returned -16 02:01:41 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x14f, 0x2f) [ 843.065382] binder: BINDER_SET_CONTEXT_MGR already set [ 843.076824] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.1'. [ 843.085873] binder: 12073:12078 ioctl 40046207 0 returned -16 [ 843.103945] binder: 12062:12086 BC_INCREFS_DONE u0000000000000000 no match 02:01:41 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) [ 843.138635] binder: 12073:12089 unknown command 897743716 [ 843.144457] binder_alloc: 12062: binder_alloc_buf, no vma [ 843.167736] binder: 12073:12089 ioctl c0306201 20000140 returned -22 02:01:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x4, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 843.185436] binder: release 12062:12065 transaction 737 out, still active [ 843.188706] binder: 12062:12082 transaction failed 29189/-3, size 0-0 line 3035 [ 843.192907] binder: undelivered TRANSACTION_COMPLETE [ 843.215762] binder: 12062:12086 unknown command 0 [ 843.220654] binder: 12062:12086 ioctl c0306201 20000600 returned -22 [ 843.246070] binder: release 12062:12065 transaction 737 in, still active [ 843.252941] binder: send failed reply for transaction 737, target dead [ 843.295099] binder: 12073:12089 unknown command 897743716 [ 843.313834] binder: undelivered TRANSACTION_ERROR: 29189 [ 843.321934] binder: 12073:12089 ioctl c0306201 20000140 returned -22 02:01:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:41 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xe00000000000000) 02:01:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x5, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:41 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) fcntl$notify(r0, 0x402, 0x2e) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 843.443473] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000203) [ 843.474186] FAT-fs (loop2): Filesystem has been set read-only [ 843.478019] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. 02:01:41 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xf00000000000000) [ 843.489709] binder: 12111:12112 BC_ACQUIRE_DONE node 740 has no pending acquire request 02:01:41 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x150, 0x2f) [ 843.555500] binder: 12111:12112 unknown command 0 [ 843.568299] binder: BINDER_SET_CONTEXT_MGR already set [ 843.580293] binder: 12111:12112 ioctl c0306201 20000600 returned -22 02:01:41 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) [ 843.604182] binder: 12114:12118 ioctl 40046207 0 returned -16 02:01:41 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x1000000000000000) 02:01:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x6, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 843.630225] binder: BINDER_SET_CONTEXT_MGR already set [ 843.636116] binder_alloc: binder_alloc_mmap_handler: 12111 20001000-20004000 already mapped failed -16 [ 843.687463] binder: 12114:12122 ioctl 40046207 0 returned -16 [ 843.687467] binder: BINDER_SET_CONTEXT_MGR already set [ 843.687495] binder: 12111:12112 ioctl 40046207 0 returned -16 02:01:41 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x3, 0x10400) ioctl$KVM_GET_NR_MMU_PAGES(r1, 0xae45, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0000f6d272460000"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:41 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x3f00000000000000) [ 843.763427] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000203) [ 843.793024] FAT-fs (loop2): Filesystem has been set read-only [ 843.803804] binder_alloc: 12111: binder_alloc_buf, no vma 02:01:42 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) [ 843.896380] binder: release 12111:12112 transaction 741 in, still active [ 843.907839] binder: send failed reply for transaction 741 to 12111:12112 [ 843.909162] binder: 12111:12137 transaction failed 29189/-3, size 0-0 line 3035 [ 843.939695] binder: undelivered TRANSACTION_COMPLETE 02:01:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x7, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:42 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x151, 0x2f) 02:01:42 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x6000000000000000) [ 843.967386] binder: 12145:12146 unknown command -755630080 [ 843.972709] binder: undelivered TRANSACTION_ERROR: 29189 [ 844.005291] binder: 12145:12146 ioctl c0306201 20000140 returned -22 [ 844.011712] binder: undelivered TRANSACTION_ERROR: 29189 [ 844.085979] binder_alloc: binder_alloc_mmap_handler: 12145 20001000-20004000 already mapped failed -16 02:01:42 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) 02:01:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x8, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 844.150881] binder: BINDER_SET_CONTEXT_MGR already set [ 844.175221] binder: 12145:12159 unknown command -755630080 [ 844.195079] binder: 12161:12162 ioctl 40046207 0 returned -16 [ 844.205272] binder: 12145:12159 ioctl c0306201 20000140 returned -22 02:01:42 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x7d0d000000000000) [ 844.221461] binder: BINDER_SET_CONTEXT_MGR already set [ 844.239987] binder_alloc: 12145: binder_alloc_buf, no vma [ 844.245745] binder: 12145:12146 ioctl 40046207 0 returned -16 [ 844.256104] binder: 12161:12169 transaction failed 29189/-3, size 0-0 line 3035 02:01:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x9, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:42 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x9effffff00000000) 02:01:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 844.373047] binder: 12161:12169 transaction failed 29189/-22, size 0-0 line 2896 02:01:42 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x152, 0x2f) 02:01:42 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) [ 844.558065] binder_alloc: binder_alloc_mmap_handler: 12190 20001000-20004000 already mapped failed -16 [ 844.590048] binder: BINDER_SET_CONTEXT_MGR already set [ 844.608970] binder: 12190:12194 ioctl 40046207 0 returned -16 [ 844.916057] binder_alloc: binder_alloc_mmap_handler: 12161 20001000-20004000 already mapped failed -16 [ 844.925832] binder_alloc: 12161: binder_alloc_buf, no vma [ 844.931376] binder: 12161:12202 transaction failed 29189/-3, size 0-0 line 3035 [ 844.939112] binder: 12161:12202 got transaction to context manager from process owning it [ 844.947540] binder: 12161:12202 transaction failed 29201/-22, size 0-0 line 2887 02:01:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406302, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0xa, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:43 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xc00e000000000000) 02:01:43 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000f4eff8)='./file0\x00', 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) 02:01:43 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) setxattr$security_selinux(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.selinux\x00', &(0x7f00000000c0)='system_u:object_r:initrc_exec_t:s0\x00', 0x23, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x2, 0x30, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0xffffffffffffff5f, 0x0, &(0x7f0000000100)=[@exit_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) 02:01:43 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x153, 0x2f) [ 844.964214] binder: undelivered TRANSACTION_ERROR: 29201 [ 844.978936] binder: undelivered TRANSACTION_ERROR: 29189 [ 844.992923] binder: undelivered TRANSACTION_ERROR: 29189 [ 845.009993] binder: undelivered TRANSACTION_ERROR: 29189 02:01:43 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xf0ffffff00000000) 02:01:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0xb, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 845.083626] binder: BINDER_SET_CONTEXT_MGR already set 02:01:43 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_buf(r0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x0) [ 845.111061] binder: 12215:12216 ioctl 40046207 0 returned -16 [ 845.184118] binder: 12215:12220 unknown command 1077961474 [ 845.195147] binder: 12215:12220 ioctl c0306201 20000600 returned -22 02:01:43 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xffffff7f00000000) 02:01:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0xc, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:43 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x154, 0x2f) [ 845.355901] __nla_parse: 7 callbacks suppressed [ 845.355911] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.1'. [ 845.780760] binder_alloc: binder_alloc_mmap_handler: 12204 20001000-20004000 already mapped failed -16 [ 845.790443] binder: BINDER_SET_CONTEXT_MGR already set [ 845.799539] binder: 12204:12247 ioctl 40046207 0 returned -16 [ 845.851724] binder: send failed reply for transaction 751 to 12215:12220 [ 845.871767] binder_alloc: binder_alloc_mmap_handler: 12215 20001000-20004000 already mapped failed -16 [ 845.891300] binder_alloc: 12215: binder_alloc_buf, no vma 02:01:44 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xffffffff00000000) 02:01:44 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000040)='./file0\x00', 0x0) 02:01:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0xd, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x155, 0x2f) 02:01:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x4040630a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:44 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c2354ef524326405aad7ae6"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 845.899298] binder: 12215:12248 transaction failed 29189/-3, size 0-0 line 3035 [ 845.908157] binder: 12215:12248 unknown command 1077961474 [ 845.913828] binder: 12215:12248 ioctl c0306201 20000600 returned -22 [ 845.921118] binder: undelivered TRANSACTION_COMPLETE [ 846.004936] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 846.031313] binder: 12253:12258 unknown command -279698676 02:01:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0xe, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) 02:01:44 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0xfffffffffffff000) [ 846.053921] binder: BINDER_SET_CONTEXT_MGR already set [ 846.063966] binder: 12260:12261 ioctl 40046207 0 returned -16 [ 846.070517] binder: 12253:12258 ioctl c0306201 20000140 returned -22 [ 846.097484] binder_alloc: binder_alloc_mmap_handler: 12253 20001000-20004000 already mapped failed -16 [ 846.142677] binder: BINDER_SET_CONTEXT_MGR already set 02:01:44 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000040)='./file0\x00', 0x0) [ 846.165190] binder_alloc: 12253: binder_alloc_buf, no vma [ 846.170874] binder: 12253:12258 ioctl 40046207 0 returned -16 [ 846.173743] binder: 12253:12273 unknown command -279698676 [ 846.189363] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 846.189579] binder: 12260:12261 transaction failed 29189/-3, size 0-0 line 3035 [ 846.198496] binder: 12253:12273 ioctl c0306201 20000140 returned -22 02:01:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x156, 0x2f) 02:01:44 executing program 5: r0 = socket$kcm(0x10, 0x4000000001, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 846.229432] binder: 12260:12261 unknown command 1077961482 [ 846.264067] binder: 12260:12261 ioctl c0306201 20000600 returned -22 02:01:44 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) [ 846.310010] binder_alloc: 12260: binder_alloc_buf, no vma 02:01:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0xf, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 846.360613] binder: 12260:12275 unknown command 1077961482 [ 846.395252] binder: 12260:12275 ioctl c0306201 20000600 returned -22 [ 846.401915] binder: 12260:12281 transaction failed 29189/-3, size 0-0 line 3035 02:01:44 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000040)='./file0\x00', 0x0) 02:01:44 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) r1 = shmget$private(0x0, 0x1000, 0x4, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_STAT(r1, 0x2, &(0x7f0000000180)=""/133) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x280000) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x10000, 0x0) connect$pptp(r2, &(0x7f00000000c0)={0x18, 0x2, {0x1, @empty}}, 0x1e) 02:01:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:01:44 executing program 0: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x1) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) [ 846.504002] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 02:01:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, @ip6erspan={{0x11, 0x1, 'ip6erspan\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_IFLAGS={0x8, 0x3, 0x30}]]}}}]}, 0x40}}, 0x0) [ 846.635897] binder: 12301:12305 unknown command 1077961490 [ 846.654518] binder: BINDER_SET_CONTEXT_MGR already set [ 846.679236] binder: 12301:12305 ioctl c0306201 20000600 returned -22 [ 846.695343] binder: 12304:12310 ioctl 40046207 0 returned -16 [ 846.721739] binder: BINDER_SET_CONTEXT_MGR already set 02:01:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x157, 0x2f) [ 846.742283] binder_alloc: 12301: binder_alloc_buf, no vma [ 846.747783] kasan: CONFIG_KASAN_INLINE enabled [ 846.747859] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 846.747875] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 846.747891] CPU: 1 PID: 12319 Comm: syz-executor.1 Not tainted 5.0.0-rc7+ #85 [ 846.747898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 846.747922] RIP: 0010:ip6erspan_set_version+0x5c/0x350 [ 846.747937] Code: 07 38 d0 7f 08 84 c0 0f 85 9f 02 00 00 49 8d bc 24 b0 00 00 00 c6 43 54 01 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 9a 02 00 00 4d 8b ac 24 b0 00 00 00 4d 85 ed 0f [ 846.747945] RSP: 0018:ffff888098207168 EFLAGS: 00010202 [ 846.747959] RAX: dffffc0000000000 RBX: ffff888058cbeb58 RCX: ffffc90008070000 [ 846.747969] RDX: 0000000000000016 RSI: ffffffff86215234 RDI: 00000000000000b0 [ 846.747983] RBP: ffff888098207180 R08: 1ffff1100b197d6b R09: ffff888058cbeb58 [ 846.761085] kobject: 'loop3' (000000009e3dff9e): kobject_uevent_env [ 846.766155] R10: ffffed100b197d75 R11: ffff888058cbebaf R12: 0000000000000000 [ 846.766164] R13: ffff8880a546c080 R14: ffffffff86224150 R15: ffff888058cbeb58 [ 846.766192] FS: 00007f07fbf91700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 846.766202] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 846.766214] CR2: 00007fe980807000 CR3: 00000000a46ba000 CR4: 00000000001406e0 [ 846.783094] binder: 12301:12305 ioctl 40046207 0 returned -16 [ 846.788093] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 02:01:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406325, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 846.788103] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 846.788109] Call Trace: [ 846.788142] ip6erspan_newlink+0x66/0x7b0 [ 846.788161] ? ip6gre_newlink+0x7a0/0x7a0 [ 846.812594] kobject: 'loop3' (000000009e3dff9e): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 846.819678] __rtnl_newlink+0x107b/0x16c0 [ 846.819701] ? rtnl_link_unregister+0x250/0x250 [ 846.819715] ? lock_downgrade+0x810/0x810 [ 846.819753] ? is_bpf_text_address+0xd3/0x170 [ 846.840871] binder: release 12301:12305 transaction 760 out, still active [ 846.847949] ? kernel_text_address+0x73/0xf0 [ 846.847964] ? __kernel_text_address+0xd/0x40 [ 846.847980] ? unwind_get_return_address+0x61/0xa0 [ 846.847995] ? __save_stack_trace+0x8a/0xf0 [ 846.848021] ? save_stack+0xa9/0xd0 [ 846.848039] ? save_stack+0x45/0xd0 [ 846.883599] binder: undelivered TRANSACTION_COMPLETE [ 846.889790] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 846.889805] ? kasan_kmalloc+0x9/0x10 [ 846.889818] ? kmem_cache_alloc_trace+0x151/0x760 [ 846.889831] ? rtnl_newlink+0x4b/0xa0 [ 846.889844] ? rtnetlink_rcv_msg+0x465/0xb00 [ 846.889887] ? check_preemption_disabled+0x48/0x290 [ 846.889902] ? rtnl_newlink+0x4b/0xa0 [ 846.889918] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 846.889940] rtnl_newlink+0x69/0xa0 [ 846.908461] binder: release 12301:12305 transaction 760 in, still active [ 846.917467] ? __rtnl_newlink+0x16c0/0x16c0 [ 846.917483] rtnetlink_rcv_msg+0x465/0xb00 [ 846.917501] ? rtnetlink_put_metrics+0x560/0x560 [ 846.917515] ? netdev_pick_tx+0x300/0x300 [ 846.917533] ? netlink_deliver_tap+0x22d/0xbf0 [ 846.917548] ? find_held_lock+0x35/0x130 [ 846.917567] netlink_rcv_skb+0x17a/0x460 [ 846.917583] ? rtnetlink_put_metrics+0x560/0x560 [ 846.929275] kobject: 'loop4' (000000006366fff6): kobject_uevent_env [ 846.930518] ? netlink_ack+0xb50/0xb50 [ 846.930534] ? kasan_check_read+0x11/0x20 [ 846.930554] ? netlink_deliver_tap+0x254/0xbf0 [ 846.937338] binder: send failed reply for transaction 760, target dead [ 846.941987] rtnetlink_rcv+0x1d/0x30 [ 846.942002] netlink_unicast+0x536/0x720 [ 846.942019] ? netlink_attachskb+0x770/0x770 [ 846.948376] kobject: 'loop4' (000000006366fff6): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 846.950900] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 846.950919] netlink_sendmsg+0x8ae/0xd70 [ 846.950940] ? netlink_unicast+0x720/0x720 [ 847.114735] ? selinux_socket_sendmsg+0x36/0x40 [ 847.119408] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 847.124945] ? security_socket_sendmsg+0x93/0xc0 [ 847.129704] ? netlink_unicast+0x720/0x720 [ 847.133942] sock_sendmsg+0xdd/0x130 [ 847.137663] ___sys_sendmsg+0x806/0x930 [ 847.141643] ? copy_msghdr_from_user+0x430/0x430 [ 847.146405] ? lock_downgrade+0x810/0x810 [ 847.150558] ? kasan_check_read+0x11/0x20 [ 847.154706] ? __fget+0x367/0x540 [ 847.158170] ? iterate_fd+0x360/0x360 [ 847.161974] ? lock_downgrade+0x810/0x810 [ 847.166123] ? __fget_light+0x1a9/0x230 [ 847.170107] ? __fdget+0x1b/0x20 [ 847.173512] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 847.179056] __sys_sendmsg+0x105/0x1d0 [ 847.182948] ? __ia32_sys_shutdown+0x80/0x80 [ 847.187370] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 847.192123] ? do_syscall_64+0x26/0x610 [ 847.196140] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 847.201529] ? do_syscall_64+0x26/0x610 [ 847.205506] __x64_sys_sendmsg+0x78/0xb0 [ 847.209567] do_syscall_64+0x103/0x610 [ 847.213455] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 847.218656] RIP: 0033:0x457e29 [ 847.221862] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 847.240775] RSP: 002b:00007f07fbf90c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 847.248479] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29 [ 847.255742] RDX: 0000000000000000 RSI: 0000000020001340 RDI: 0000000000000003 [ 847.263008] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 847.270275] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f07fbf916d4 [ 847.277538] R13: 00000000004c54d4 R14: 00000000004d93b0 R15: 00000000ffffffff [ 847.284812] Modules linked in: 02:01:45 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x100000000000) [ 847.295650] kobject: 'loop5' (00000000a76c7745): kobject_uevent_env [ 847.314753] binder: 12324:12327 unknown command 1077961509 [ 847.317203] kobject: 'loop5' (00000000a76c7745): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 847.334726] binder: 12324:12327 ioctl c0306201 20000600 returned -22 02:01:45 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) creat(&(0x7f0000000880)='./file0/f.le.\x00', 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000040)='./file0\x00', 0x0) [ 847.349980] kobject: 'loop2' (000000000a6b4bc1): kobject_uevent_env [ 847.364586] kobject: 'loop2' (000000000a6b4bc1): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 847.378982] binder_alloc_mmap_handler: 3 callbacks suppressed [ 847.378998] binder_alloc: binder_alloc_mmap_handler: 12324 20001000-20004000 already mapped failed -16 [ 847.381711] ---[ end trace 2f0b7e4c6870db4c ]--- 02:01:45 executing program 5: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000005c0)='/selinux/mls\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000480)}) sendmsg$TIPC_NL_MEDIA_GET(r0, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f0000000600)=ANY=[@ANYBLOB="f8010000", @ANYRES16=r1, @ANYBLOB="0d0b29bd7000fcdbdf250b0000001c000600040002000400020008000100f500000008000100570000006c00070008000100030000000c0004000500000000f1ffff0b00030006000000000000000c00030000010000000000000c000400080000000000000008000100060000000c00040097070101000008000200050000000c00040001800000000000004400010008000300ff070000380004001400010002004e23ac1414150000000000000000200002000a004e2000000002ff02000000000000000000000000004100000000640001002c00020008000400ff00000008000300f8ffffff070003000700000008000400040000000800020001000000100001007564703a73797a3000000000100001007564703a73797a31000000001400010069623a73797a6b616c6c6572310000007400010008000300210f0000100001007564703a73797a310000000008000300070000000c00010069623a65716c000044000200080002007f000000180003000800000008000300ff030000080002008000000008000100050000000800030005000000080004000001000008000300f4560000400004000c00070008000200ffffff7f1400010062726f6164636173742d6c696e6b00001c000700080004000100000008000100090000000800030006000000c44a1a310625248da5d3a4a92696023be4030fba5615117609cde57d661ebebb8b1b5c9070ca61a23212691e00368e7fdb7189226ca4248e21eaa660f3312303bd465cf94c1bcba83a280b63f37a5f044fb8675f4a03af116bd8d8b34f36f81f15259e50a1d969a439b33b87f13b5febd905fffb7c1bb346af17159d4d59308afcad0eccd092303b061e39969ce4f7e418690115a2cde1cb173fe02fe932301c0c4744e1bf522d835e"], 0x1f8}, 0x1, 0x0, 0x0, 0x4000000}, 0x8001) r2 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) [ 847.393829] binder: BINDER_SET_CONTEXT_MGR already set [ 847.405124] kobject: 'loop2' (000000000a6b4bc1): kobject_uevent_env [ 847.408688] RIP: 0010:ip6erspan_set_version+0x5c/0x350 [ 847.414722] kobject: 'loop2' (000000000a6b4bc1): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 847.421052] Code: 07 38 d0 7f 08 84 c0 0f 85 9f 02 00 00 49 8d bc 24 b0 00 00 00 c6 43 54 01 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 9a 02 00 00 4d 8b ac 24 b0 00 00 00 4d 85 ed 0f 02:01:45 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x158, 0x2f) [ 847.440433] binder: 12324:12335 unknown command 1077961509 [ 847.445618] binder: 12324:12327 ioctl 40046207 0 returned -16 [ 847.451702] binder: 12324:12335 ioctl c0306201 20000600 returned -22 [ 847.462860] binder_alloc: 12324: binder_alloc_buf, no vma [ 847.464907] binder_alloc: binder_alloc_mmap_handler: 12304 20001000-20004000 already mapped failed -16 [ 847.469754] binder_transaction: 1 callbacks suppressed [ 847.469769] binder: 12324:12332 transaction failed 29189/-3, size 0-0 line 3035 [ 847.489758] binder: release 12324:12327 transaction 763 out, still active [ 847.502332] kobject: 'loop3' (000000009e3dff9e): kobject_uevent_env [ 847.509309] kobject: 'loop3' (000000009e3dff9e): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 847.517051] RSP: 0018:ffff888098207168 EFLAGS: 00010202 [ 847.523695] binder: undelivered TRANSACTION_COMPLETE [ 847.529478] RAX: dffffc0000000000 RBX: ffff888058cbeb58 RCX: ffffc90008070000 [ 847.532236] binder: release 12324:12327 transaction 763 in, still active [ 847.542546] RDX: 0000000000000016 RSI: ffffffff86215234 RDI: 00000000000000b0 [ 847.544330] kobject: 'loop5' (00000000a76c7745): kobject_uevent_env [ 847.563493] binder: send failed reply for transaction 763, target dead [ 847.570072] RBP: ffff888098207180 R08: 1ffff1100b197d6b R09: ffff888058cbeb58 [ 847.580506] kobject: 'loop2' (000000000a6b4bc1): kobject_uevent_env [ 847.589734] kobject: 'loop5' (00000000a76c7745): fill_kobj_path: path = '/devices/virtual/block/loop5' 02:01:45 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x522000000003, 0x11) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x9}, 0x20) sendmsg$kcm(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nl=@unspec={0x0, 0xffffff7f00000000, 0x7e4c, 0x80fe}, 0xfd3d, &(0x7f00000001c0), 0x12f}, 0x0) r1 = socket$kcm(0x11, 0x3, 0x300) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000001200)={0x1, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000a01000000000000000000009500000000000000"], 0x0, 0x5c0, 0x1000, &(0x7f0000002800)=""/4096}, 0x48) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000440)=r2, 0x4) 02:01:45 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x100, 0x0) ioctl$VIDIOC_S_AUDIO(r1, 0x40345622, &(0x7f0000000180)={0x3dd, "2540c3c58772a779bb46cd98778d2eaf9ebedaf4020f2463c841446ab86b45ac", 0x1, 0x1}) fsetxattr(r0, &(0x7f0000000040)=@known='system.posix_acl_default\x00', &(0x7f0000000080)='wlan0self\x00', 0xa, 0x1) r2 = getpgrp(0xffffffffffffffff) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000240)=0x0) kcmp$KCMP_EPOLL_TFD(r2, r3, 0x7, r1, &(0x7f0000000280)={r1, r0, 0x1}) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) getsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f00000001c0)=0x5, &(0x7f0000000200)=0x2) [ 847.591976] R10: ffffed100b197d75 R11: ffff888058cbebaf R12: 0000000000000000 [ 847.610399] binder_release_work: 5 callbacks suppressed [ 847.610405] binder: undelivered TRANSACTION_ERROR: 29189 [ 847.628794] kobject: 'loop2' (000000000a6b4bc1): fill_kobj_path: path = '/devices/virtual/block/loop2' 02:01:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406351, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 847.658368] kobject: 'loop0' (00000000e358fc4f): kobject_uevent_env [ 847.672192] audit: type=1400 audit(1550973705.771:71): avc: denied { setattr } for pid=12353 comm="syz-executor.5" name="NETLINK" dev="sockfs" ino=158131 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 02:01:45 executing program 5: readlink(&(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)=""/61, 0x3d) r0 = socket$kcm(0x10, 0x7, 0x10) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000040)) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e0000002600815fe45ae087185082cf0300b0eba06ec40000230e00090008000000000000843a9e986c0872183b", 0x2e}], 0x1}, 0x0) r1 = gettid() r2 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x2, 0x80002) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000200)='}\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={r1, r2, 0x0, 0x2, &(0x7f00000001c0)='/\x00', r3}, 0x30) socket$key(0xf, 0x3, 0x2) [ 847.703615] binder: 12357:12358 unknown command 1077961553 [ 847.710775] kobject: 'loop0' (00000000e358fc4f): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 847.720688] binder: 12357:12358 ioctl c0306201 20000600 returned -22 [ 847.743262] binder_alloc: binder_alloc_mmap_handler: 12357 20001000-20004000 already mapped failed -16 02:01:45 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/mcfilter\x00') sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000002840)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000017c0), 0x159, 0x2f) [ 847.763492] kobject: 'loop4' (000000006366fff6): kobject_uevent_env [ 847.764273] R13: ffff8880a546c080 R14: ffffffff86224150 R15: ffff888058cbeb58 [ 847.793105] FS: 00007f07fbf91700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 847.801711] kobject: 'loop4' (000000006366fff6): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 847.810938] binder: BINDER_SET_CONTEXT_MGR already set [ 847.827245] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 847.834790] binder: 12357:12358 ioctl 40046207 0 returned -16 [ 847.844787] kobject: 'loop5' (00000000a76c7745): kobject_uevent_env [ 847.852194] CR2: 00000000004cddb0 CR3: 00000000a46ba000 CR4: 00000000001406f0 [ 847.860394] kobject: 'loop5' (00000000a76c7745): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 847.870566] binder_alloc: 12357: binder_alloc_buf, no vma [ 847.871565] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 847.883809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 847.892948] kobject: 'loop3' (000000009e3dff9e): kobject_uevent_env [ 847.899735] Kernel panic - not syncing: Fatal exception [ 847.906111] Kernel Offset: disabled [ 847.909752] Rebooting in 86400 seconds..