, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$KDSETMODE(r1, 0x4b3a, 0x4) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) 18:18:24 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) eventfd(0x7ff) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) r2 = gettid() fcntl$lock(r0, 0x24, &(0x7f0000000000)={0x2, 0x1, 0xfffffffffffffffa, 0xffffffff, r2}) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000002004e24ac1414bb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000300000002004e247f00000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e24ac1414bb000000000000000000000000004c72c405472b6baf633fe62b98850000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e21e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x210) ioctl$SNDRV_TIMER_IOCTL_START(r3, 0x54a0) 18:18:24 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000700)='/dev/ptmx\x00', 0x0, 0x0) ioctl$VT_WAITACTIVE(r0, 0x5607) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000007b80)='/selinux/load\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = add_key$user(&(0x7f00000002c0)='user\x00', &(0x7f0000000380)={'syz', 0x2}, &(0x7f00000003c0)="d4428ca6d50b29bc53b8369d291a449bbbcc7ee1156418fd7c74080cf3f8d5bf0ab1cec5a3e0352a97538a5cea7204d050925ef478a17e9ea142e992bfa45553ffaccd178f14c4356891ef29e5a4f8bec8802eda9bff961da96178721843755e678a5637a8a2618189e0794e0b35bb94079af061437d241875ee715c30e2553cb8b015443e67d15711345057db152a8240a12708dd583613cac93214114952dc95ade91423151fb989754dc1fce8a9a0ddc22a69", 0xb4, 0xfffffffffffffff9) r3 = add_key$keyring(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$unlink(0x9, r2, r3) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000240)='/dev/zero\x00', 0x0, 0x0) ioctl$UI_SET_PROPBIT(r4, 0x4004556e, 0x1c) fsetxattr$trusted_overlay_redirect(r0, &(0x7f00000001c0)='trusted.overlay.redirect\x00', &(0x7f0000000280)='./bus\x00', 0x6, 0x3) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000100)={@mcast1, 0x800, 0x0, 0x2, 0x6, 0xfffffffffffffff7, 0x400}, &(0x7f0000000180)=0x20) r5 = creat(&(0x7f0000000340)='./bus\x00', 0x0) recvmmsg(r5, &(0x7f0000007900)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, {{&(0x7f0000004180)=@in={0x2, 0x0, @remote}, 0x80, &(0x7f0000004600)=[{0x0}, {&(0x7f0000004540)=""/187, 0xbb}], 0x2}}, {{&(0x7f0000007480)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}}], 0x3, 0x40000120, 0x0) fcntl$setstatus(r5, 0x4, 0x44000) io_setup(0x40000100000003, &(0x7f0000000200)=0x0) prlimit64(0x0, 0xf, &(0x7f0000000300)={0x0, 0x87}, 0x0) r7 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ioctl$void(r1, 0x0) ftruncate(r7, 0xbb1) io_submit(r6, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r5, &(0x7f0000000000), 0x377140be6b5ef4c7}]) bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0x3, 0x9}, 0x2c) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 18:18:24 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000200)={{{@in=@multicast2, @in=@multicast1}}, {{@in=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000300)=0xe8) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000640)) fcntl$lock(r1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) get_robust_list(0x0, 0x0, &(0x7f00000005c0)) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x4c0b, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x2000000000000000, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1000) r2 = socket$inet_udp(0x2, 0x2, 0x0) rmdir(&(0x7f0000001700)='./file0\x00') close(r2) r3 = socket(0x840000000002, 0x3, 0xff) connect$inet(r2, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) ioctl$RTC_UIE_OFF(r0, 0x7004) r4 = syz_open_procfs(0x0, &(0x7f0000000740)="2f6578650000c10000000000e9ff0700000000000054fa07424adee916d2da75afe70b35a0fd6a1f0200f5ab26d7a071fb35331ce39c5a6568641006d7c0206a74e33326530000000000000000000000") sendfile(r3, r4, &(0x7f0000000180), 0x100000001) 18:18:24 executing program 2: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x8040, 0x0) fcntl$setlease(r1, 0x400, 0x0) rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) ioctl$EVIOCGID(r1, 0x80084502, &(0x7f00000000c0)=""/246) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000104a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb0e, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x200000000000}, 0x0, 0xffffffffffffffff, r1, 0x0) r2 = eventfd(0x5) r3 = syz_open_procfs(0x0, &(0x7f0000000200)='pagemap\x00') sendfile(r2, r3, 0x0, 0xffffffff) open(&(0x7f0000000280)='./file0\x00', 0x802, 0x0) openat$selinux_member(0xffffffffffffff9c, 0x0, 0x2, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x2, 0x4, 0x2d41) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000300)=0xfffffffffffffdc7) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, 0x0, &(0x7f0000000100)) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6}]}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x20000000, 0x0, 0x0) getrlimit(0x0, 0x0) 18:18:25 executing program 3: write$P9_RUNLINKAT(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x2, 0x80f, 0xda6) r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 18:18:25 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:25 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x4, 0x0, @mcast1}}}, 0x88) setxattr$trusted_overlay_upper(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='trusted.overlay.upper\x00', &(0x7f00000002c0)={0x0, 0xfb, 0xdd, 0x5, 0x6, "c7ab4b2b98bcb9422c2f3e603cbdc767", "f467cd6849bb8969b5aa190f0afd2d118ac74d045a53e3a16edcc9c4976e7087c87611b50587698db4509117681a3f5b41939ce0837a51eba1b4352ddc5436cfee2c9c36e669edef68610f134beaac0bbf862eb98ebd2d4c9ec6552ad0b54c6c14d63c1b6480156906096498fcfb645aa41b4000f8615928791aab818f9205cf4381e6ed87ab2444ea3e55c71631b78b513a0786d3f2c19b1f158983c81bf475e24527e6bc8ebabba0e5498e8ff4b95df64fe7ea214d84e27bcc148de24d84a7d1cb026d7a8a48f3"}, 0xdd, 0x74cfe7b4cd4b82c5) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007324af17ca00000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f5d3075004703f1800000000000000000000000000000000000000000000000000000000000000000000000000"], 0x210) 18:18:25 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000200)={0x20, {{0x2, 0x4e24, @remote}}}, 0x88) r1 = accept(0xffffffffffffff9c, &(0x7f0000000040)=@can, &(0x7f00000000c0)=0x80) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000004d80)={'bpq0\x00', 0x0}) recvfrom$packet(r1, &(0x7f0000000100)=""/19, 0x13, 0x40, &(0x7f0000004dc0)={0x11, 0xfa, r2, 0x1, 0xffffffffffffff83, 0x6, @dev={[], 0x16}}, 0x14) chmod(&(0x7f00000002c0)='./file0\x00', 0x1b) clock_gettime(0x3, &(0x7f00000001c0)) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_settime(0x0, &(0x7f0000000640)={0x0, 0x1c9c380}) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000000)={r3, 0x0, 0x8001, 0x6, 0x9}) 18:18:25 executing program 1: r0 = memfd_create(&(0x7f00000001c0)='/dev/zero\x00', 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, 0x0, &(0x7f0000000300)) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000280)) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000140)={@local, @empty, @mcast2, 0x0, 0x78}) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000380)={0x0, &(0x7f0000000300)}) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) gettid() bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000004c0), 0x4) mkdir(&(0x7f0000000040)='./file0\x00', 0x10) unshare(0x2000400) sendmsg$key(0xffffffffffffffff, &(0x7f000011bfe4)={0x0, 0x0, &(0x7f000069a000)={&(0x7f0000000500)=ANY=[@ANYBLOB="020e000014000000000000000000000005000600000000000a0000008fe0ce10184aadaa92e9182f60c05c6d0000000000000000000000000000ffff0000000000000000000000000800120000000000000000000000000006000000000000000000000000000000000000000000000000e000000100000000000000000000000005000500000000000a0000000000000000000000000000000000ffff00000000000000000000000000"], 0xaa}}, 0x0) timerfd_gettime(0xffffffffffffffff, &(0x7f00000005c0)) 18:18:25 executing program 5: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x10000, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000200)={&(0x7f00000003c0)={0x134, r2, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x1000}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1e}}]}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x40}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast1}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x9}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x80}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1000}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xff}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x87}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xaff}, @IPVS_CMD_ATTR_DEST={0x38, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [], @remote}}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x9c}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x10}, 0x11) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="38010000100013070000000014000000e0f7ff010000000000000000000000000000000000000000000000000057aa2f385e0875a5a1b80569aaa30000000000000000003b0000000000000000229fd40d5f881fcaf8afec2a250c59f9535a0deb24b76431f4869e728706691a1d3b6f098fdb0bc1f85c979ad1f57960edb76704ef1ccf809aaa03e8ac6187a33f3d5f33", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff000000003240000000000000000000000000ffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000480a0200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002feda489d90404681ab2c92bfc"], 0x138}}, 0x0) pselect6(0x40, &(0x7f0000000140), &(0x7f0000000280), &(0x7f00000002c0), &(0x7f0000000300)={0x0, 0x989680}, &(0x7f0000000380)={&(0x7f0000000340), 0x8}) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000500)) 18:18:25 executing program 4: r0 = open(&(0x7f0000000000)='./file0\x00', 0x10000, 0x100) ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000040)=""/241) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f00000001c0)=0x1) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) write$P9_RREMOVE(r0, &(0x7f0000000140)={0x7, 0x7b, 0x2}, 0x7) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:25 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10) recvfrom$inet(r1, &(0x7f0000000080)=""/221, 0xdd, 0x140, &(0x7f0000000180)={0x2, 0x4e23, @empty}, 0x10) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) 18:18:25 executing program 2: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r0, 0x208200) r1 = open(&(0x7f00000000c0)='./bus\x00', 0x14103e, 0x0) ioctl$EVIOCRMFF(r1, 0x40044581, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r1, 0x0) setitimer(0x0, &(0x7f0000000100)={{}, {0x77359400}}, &(0x7f0000000140)) ioctl$UI_END_FF_ERASE(r0, 0x400c55cb, &(0x7f0000000180)={0x7, 0x0, 0x2}) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) write$P9_RLERRORu(r0, &(0x7f00000001c0)={0x14, 0x7, 0x2, {{0x7, 'cpuset-'}, 0x80}}, 0x14) [ 212.706330] netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. [ 212.726416] netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. [ 212.733412] netlink: 72 bytes leftover after parsing attributes in process `syz-executor5'. 18:18:25 executing program 3: write$P9_RUNLINKAT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)="e78a3a3c10fa6973c8b75d4bfb1f5976ad5962d8785dc41d25c65a83065c1fe7ab030c3179b01b79b06db92e0d561b617d75cc4b558d6ce9b1d26bd8c1e2d02f9d6031afce6b9daa4d7703e6183d9e72e173676a69517c29c557577288da0e5d8e8da4b320d4dda6da9e7d0c4867317d2db5c1f5d0e0f57b1bfc9a4df3c2e2a694b29633f27aede10e3546ef649adc9a6fb398e035ed1b0326b128ec0553ca19a43baa06e8b53405dd1f92e1752bc4740a2b94cfa829c1b00435fb17c9c9a5233bba0d8f", 0xc4, 0xfffffffffffffffd) r2 = add_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)="7441132f9925fded03d2e70efdb5487e4388debd2e757bfd1bbf4b17b0ce89811346978d0510e7fe", 0x28, 0x0) keyctl$search(0xa, r1, &(0x7f00000001c0)='dns_resolver\x00', &(0x7f0000000200)={'syz', 0x0}, r2) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 18:18:25 executing program 5: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002ff7)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000001000)=""/246) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000000)=""/4096) ioctl$EVIOCGREP(r0, 0xc008744c, 0x0) [ 212.766216] netlink: 72 bytes leftover after parsing attributes in process `syz-executor5'. 18:18:25 executing program 4: r0 = socket(0xd, 0x3, 0xffffffffffff7fff) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x6, &(0x7f0000000000)=[{0x6, 0x2, 0x1, 0x7}, {0xab76, 0x7ff, 0x3af7c55, 0x4}, {0xfffffffffffffff8, 0x7, 0x0, 0x100000001}, {0x40, 0x10000, 0x0, 0xa7da}, {0x10000, 0x2, 0x8, 0xb6a}, {0x3ff, 0x6, 0x4, 0x7}]}, 0x10) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x46}], 0x1) [ 212.891173] netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. 18:18:25 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) connect(r0, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x2, 0x0, 0x4, {0xa, 0x4e20, 0x100000000, @loopback, 0x7f}}}, 0x80) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) 18:18:25 executing program 3: write$P9_RUNLINKAT(0xffffffffffffffff, 0x0, 0x6e) r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000000)={0xf53c, 0x0, 0x10001, 0xfffffffffffffffe}, 0x10) 18:18:25 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @remote}}}, 0x392) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @remote, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x0, @broadcast, @empty, @dev, @local}}}}, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f00000002c0)={'security\x00', 0xe5, "1f1940934ba9108501624ad93f9c692bec9ba8995e5d906e49b2566fac6a5935399bcf24f2c4e253b5aa5d6fef2d08274ac9063e8e6a41aece9dc54f362e2af3f6023c1239d244146606e727319c60eaa5b0430e35c7e6bb74b29b8c772db08088d693dc35c2b737fc83af6823261942bb4891acff3f29796ce6a07b41a6a7e367eab0d3da9d65363dbffd65181040062b6d097e8608bc532cff4ae9e58d89eaa7720f8aaf41efc4ff518960ce94b3b6ccce46e05253841f41d45f5a5471144476efe6dddddcbf05cc74ab2e9fcb0078486352f795e23fcb57d153d077692a645b8d37f030"}, &(0x7f0000000140)=0x109) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x1e}, 0x5}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x30, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0xfffffffffffffff9) 18:18:25 executing program 3: write$P9_RUNLINKAT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b71fa6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x32a}], 0x129}, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x4000, 0x0) fchmodat(r1, &(0x7f0000000040)='./file0\x00', 0x44) [ 213.055496] audit: type=1400 audit(1544897905.549:74): avc: denied { setopt } for pid=9614 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 18:18:25 executing program 1: r0 = dup(0xffffffffffffffff) ioctl$TIOCLINUX6(r0, 0x541c, &(0x7f0000000440)={0x6, 0xc956}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x80, 0x100) ioctl$TIOCSTI(r1, 0x5412, 0xe1ed) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) listxattr(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)=""/6, 0x6) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$key(0xf, 0x3, 0x2) readlink(&(0x7f0000000100)='./file0\x00', &(0x7f00000002c0)=""/137, 0x89) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000003c0)=0x0) fcntl$setownex(r2, 0xf, &(0x7f0000000400)={0x0, r3}) sendmsg$key(r0, &(0x7f0000b6dfc8)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="0213fc03ea1300000000000000000000976417dfb67ece11141296906184f7a367293edb4868d8e71763928bd91123f9068e6b7992ea390369998d00e02c66a0d25a8c39a85837cc4661e432b6c91580f05e32206241e6a8e6a7dee87f00012dc8fd8cd0ba25f0aefe7550ea1119ab3c24befc"], 0xffffffffffffffe1}}, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/enforce\x00', 0x0, 0x0) 18:18:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f00000000c0)={'raw\x00', 0x4, [{}, {}, {}, {}]}, 0x68) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:25 executing program 2: r0 = getpgid(0x0) perf_event_open(0x0, r0, 0x0, 0xffffffffffffffff, 0x2) r1 = inotify_init() r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, 0x0, 0x0) r3 = socket$packet(0x11, 0x1fffffffffff, 0x300) ioctl$RTC_PIE_ON(0xffffffffffffffff, 0x7005) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x100000e, 0x40810, r3, 0x0) ioctl$sock_SIOCBRADDBR(r3, 0x89a0, &(0x7f0000000000)='syzkaller0\x00') ioctl$EXT4_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000380)=0x4d) ioctl$sock_proto_private(r1, 0x89e2, &(0x7f00000002c0)="ced02874a2857ad2c61ece73acafdc") ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000300)=0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={0x0, r2, 0x0, 0x5, &(0x7f00000003c0)='syz0\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000440)={r4, r2, 0x0, 0x1, &(0x7f0000000340)='\x00', r5}, 0x30) inotify_add_watch(r1, &(0x7f0000000240)='.\x00', 0x80000002) r6 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) write$cgroup_type(r6, &(0x7f0000000200)='threaded\x00', 0x9) ioctl$TIOCGSOFTCAR(r6, 0x5419, &(0x7f0000000280)) write$UHID_DESTROY(r6, &(0x7f00000001c0), 0x4) write$UHID_CREATE(r6, &(0x7f0000000080)={0x0, 'syz0\x00', 'syz0\x00', 'syz0\x00', 0x0}, 0x120) 18:18:25 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0xf) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x61}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r1, 0x800, 0x70bd25, 0x25dfdbff, {{}, 0x0, 0x4107, 0x0, {0x4c, 0x18, {0x1, @media='eth\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x4000014}, 0x800) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:25 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000000)={0x1ff, 0x1, 0x4, 0x5, 0x10000}, 0xc) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) 18:18:25 executing program 3: write$P9_RUNLINKAT(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$loop(0x0, 0x0, 0x2) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fcntl$notify(0xffffffffffffffff, 0x402, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) rt_sigprocmask(0x0, &(0x7f0000000680), &(0x7f0000000280), 0x8) unshare(0x40000000) fsetxattr$trusted_overlay_redirect(0xffffffffffffffff, 0x0, &(0x7f0000000140)='./file0\x00', 0x8, 0x0) fsetxattr$trusted_overlay_opaque(0xffffffffffffffff, &(0x7f0000000340)='trusted.overlay.opaque\x00', &(0x7f0000000180)='y\x00', 0xffffffffffffff32, 0x3) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) rt_sigprocmask(0x3, &(0x7f0000000000), 0x0, 0x8) r2 = socket$inet(0x10, 0x10000000000002, 0x9) sendmsg(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="240000dde80307031dfffd946f618300", 0x10}], 0x1}, 0x0) open$dir(&(0x7f0000eb6000)='./file0/bus\x00', 0x0, 0x0) creat(&(0x7f0000000580)='./file0/file0\x00', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x9) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000480)="8d909969d2a9330328d8975a7ea0a25167c83ee8ecc53b388cce5c2e52", 0x1d) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={0xffffffffffffffff, &(0x7f0000000040), 0x0}, 0x20) r3 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x101002) write$evdev(r3, &(0x7f00006f7fe8)=[{}], 0xfdd0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000006c0)) ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, &(0x7f00000001c0)={0x1, 0x5ce6}) pipe(&(0x7f0000000100)) openat$rtc(0xffffffffffffff9c, &(0x7f0000000300)='/dev/rtc0\x00', 0x240, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) inotify_init() fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000200)='trusted.overlay.upper\x00', &(0x7f0000000380)={0x0, 0xfb, 0xe2, 0x2, 0x80000000, "005870ad8feceac66b5c3842ca51a19e", "0b6208f947896443eb3e10d58083d6df9ce62604cd75317ddb8abd5a54fbe54b3572ef2012a76a464bd8b38d84e8b8a0cc6abccd0751bc6d5d132f9257b3173da2d332f189e90c3c268e0a0a7a1e148c5774549b01fc93342782120d8bac651207e1489c4057d537000bcca2b6f25492f42ac9c9e37ed28341b9e88fd965086f42046629216aeae15b4278628a2bb92cadc7345eb97fd6621a4f3084fb48e7332a7dc3c051c4732babc5a2a76cb2b829c3d6f01139b20d10d9b19ce338005ab8802c65d66bc1fadbe026091f8c"}, 0xe2, 0x3) [ 213.259982] audit: type=1400 audit(1544897905.749:75): avc: denied { call } for pid=9631 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 213.262776] binder: 9631:9639 got new transaction with bad transaction stack, transaction 3 has target 9631:0 [ 213.262799] binder: 9631:9639 transaction failed 29201/-71, size 0-0 line 3039 18:18:25 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x80400) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) r1 = socket$netlink(0x10, 0x3, 0x4) r2 = dup2(r1, r1) write$P9_ROPEN(r2, &(0x7f0000000040)={0x18, 0x71, 0x2, {{0x2, 0x1}, 0x7}}, 0x18) [ 213.308419] binder_alloc: binder_alloc_mmap_handler: 9631 20001000-20004000 already mapped failed -16 [ 213.318077] binder: BINDER_SET_CONTEXT_MGR already set [ 213.324708] binder: 9631:9639 ioctl 40046207 0 returned -16 [ 213.325587] binder_alloc: 9631: binder_alloc_buf, no vma [ 213.325619] binder: 9631:9647 transaction failed 29189/-3, size 0-0 line 3135 [ 213.325795] binder_alloc: 9631: binder_alloc_buf, no vma [ 213.325821] binder: 9631:9644 transaction failed 29189/-3, size 0-0 line 3135 18:18:25 executing program 0: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x3, @remote, 0x80000001}, 0x1c) r1 = socket$inet6(0xa, 0x80805, 0x8003) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000040)={0xfffffffffffffffd, {{0xa, 0x0, 0x0, @mcast1, 0xfffffffffffffffe}}, 0x1, 0x1, [{{0xa, 0x4e24, 0x5, @local, 0x9}}]}, 0x110) [ 213.326376] binder: undelivered TRANSACTION_ERROR: 29189 [ 213.326394] binder: undelivered TRANSACTION_ERROR: 29189 [ 213.326452] binder: send failed reply for transaction 3 to 9631:9639 [ 213.330972] binder: undelivered TRANSACTION_COMPLETE [ 213.330982] binder: undelivered TRANSACTION_ERROR: 29201 [ 213.330986] binder: undelivered TRANSACTION_ERROR: 29189 [ 213.395467] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=625 sclass=netlink_tcpdiag_socket pig=9652 comm=syz-executor4 18:18:25 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = add_key(&(0x7f0000000240)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffd) request_key(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz'}, &(0x7f00000000c0)="d13ff3d776", 0x0) syz_genetlink_get_family_id$ipvs(0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r2 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000340)='/proc/self/attr/current\x00', 0x2, 0x0) write$P9_RREAD(r2, &(0x7f0000000380)={0xaa, 0x75, 0x2, {0x9f, "5b4fe5a5d6f949fe36f73c4f6430205a96f2d852f2d2c5159f1b8fa7c2ba737bbd521f2dc4f0c3bb9cf99677dc1ab70266db58374e5b25f5545c25bc18bc71d567191c1c268f5ec7512670d768237d5523d145fd9941e4e0093387a59eed91c0b64c0240bdcb3a83f9b4669cd66cf1fea116047f68e74904f37c746b03ac710ee5b64d15a32adb457585a6f74d25b6f7242898f21105d0b4abf1c7f8f29507"}}, 0xaa) mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) r3 = memfd_create(&(0x7f0000000180)='vmnet1trusted\'eth0&+vboxnet1beth1\x00', 0x6) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1010000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r4, 0x200, 0x70bd28, 0x25dfdbfc, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x1}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x800) connect$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x0, @broadcast}, 0x10) request_key(&(0x7f0000000000)='ceph\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000140)='\x00', r1) 18:18:25 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000000)={{0xa, 0x4e22, 0x4, @dev={0xfe, 0x80, [], 0xc}, 0x9}, {0xa, 0x4e21, 0xfffffffffffffffa, @dev={0xfe, 0x80, [], 0xa}, 0x6}, 0x2, [0x20, 0x9, 0x2, 0x401, 0x7, 0x8, 0x1f, 0x8001]}, 0x5c) 18:18:25 executing program 4: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x2, 0x0) ioctl$TIOCLINUX4(r0, 0x541c, &(0x7f0000000040)) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) [ 213.432313] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=625 sclass=netlink_tcpdiag_socket pig=9660 comm=syz-executor4 18:18:26 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff01000000000000000000000000000100000000000000005b2fa063000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000ac1463ae60c6200000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000966a397f46a88800000069b148d6ecac4900000000eeffffffffffffff00000000000000000000e32b0d98e024852812540a6f9c8749f50d1f1f863d2315bf3b4bce5db2d97b445fe73a8e83e22d644019a83682dcb3f4"], 0x210) 18:18:26 executing program 1: r0 = dup(0xffffffffffffffff) ioctl$TIOCLINUX6(r0, 0x541c, &(0x7f0000000440)={0x6, 0xc956}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x80, 0x100) ioctl$TIOCSTI(r1, 0x5412, 0xe1ed) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) listxattr(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)=""/6, 0x6) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$key(0xf, 0x3, 0x2) readlink(&(0x7f0000000100)='./file0\x00', &(0x7f00000002c0)=""/137, 0x89) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000003c0)=0x0) fcntl$setownex(r2, 0xf, &(0x7f0000000400)={0x0, r3}) sendmsg$key(r0, &(0x7f0000b6dfc8)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000500)=ANY=[@ANYBLOB="0213fc03ea1300000000000000000000976417dfb67ece11141296906184f7a367293edb4868d8e71763928bd91123f9068e6b7992ea390369998d00e02c66a0d25a8c39a85837cc4661e432b6c91580f05e32206241e6a8e6a7dee87f00012dc8fd8cd0ba25f0aefe7550ea1119ab3c24befc"], 0xffffffffffffffe1}}, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/enforce\x00', 0x0, 0x0) 18:18:26 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000000)=0x7, 0x4) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x802122001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, &(0x7f0000000180)={0x3, 0x2, 0x1}) write$selinux_load(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e757815000000000000000800000007000000402c0000000000002315c908e62da298"], 0x30) setxattr$security_smack_entry(&(0x7f0000000140)='./bus\x00', &(0x7f00000001c0)='security.SMACK64\x00', &(0x7f0000000200)="2f6578650000c10000000000e9ff0700000000000054fa07424adee916d2e975afe70b35a0fd6a1f0200f5ab26d7a071fb35331ce39c5a6568641006d7c0206a74e333265300", 0x46, 0x1) fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYBLOB], 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0xc00) ioctl$TIOCSBRK(0xffffffffffffffff, 0x5427) getpid() r3 = creat(&(0x7f0000000080)='./bus\x00', 0xc1) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000500)={{{@in6=@local, @in6=@mcast2}}, {{@in6=@loopback}, 0x0, @in=@multicast1}}, &(0x7f0000000700)=0xe8) stat(&(0x7f0000001ec0)='./bus\x00', &(0x7f0000001f00)) lstat(&(0x7f0000001f80)='./bus\x00', &(0x7f0000001fc0)) stat(&(0x7f0000002040)='./bus\x00', &(0x7f0000002080)) sendmsg$netlink(r3, &(0x7f0000002180)={&(0x7f0000000440)=@proc={0x10, 0x0, 0x25dfdbfb, 0x1000}, 0xc, &(0x7f00000004c0)=[{&(0x7f0000000e00)=ANY=[@ANYBLOB="10000000370000042bbd6feafd62df25"], 0x10}], 0x1}, 0x20000000) creat(&(0x7f0000000100)='./bus\x00', 0x100) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6100) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000740)={{0x7f, 0x45, 0x4c, 0x46, 0xfffffffffffffffa, 0x3, 0xa3, 0x9, 0x9, 0x3, 0x7, 0x5, 0x2f, 0x40, 0x3b1, 0x8001, 0x4, 0x38, 0x2, 0xffffffff80000001, 0xaa}, [{0x70000000, 0x40, 0x2, 0x7, 0x8, 0x3, 0x3ff, 0x1ff}], "ca1c6c7dc8f5056ec278239aeb8821279d87cc1c23e400149664ea375bf022d6364409f67dc42501fcfb55a0bad0509cf747c93aa9704576", [[], [], [], []]}, 0x4b0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000600)={{{@in6=@mcast1}}, {{@in6=@remote}, 0x0, @in=@local}}, &(0x7f0000000400)=0xe8) ioctl$EVIOCGMTSLOTS(0xffffffffffffffff, 0x8040450a, &(0x7f0000000280)=""/239) add_key$user(&(0x7f0000000380)='user\x00', &(0x7f00000003c0)={'syz', 0x0}, &(0x7f0000000500), 0x0, 0xfffffffffffffffc) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='reno\x00', 0x5) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) 18:18:26 executing program 4: r0 = getpgid(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0xa}, 0x0, 0x0, 0x0, 0xf}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0xbffffffffffffffd) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f00000000c0)={'raw\x00', 0x4, [{}, {}, {}, {}]}, 0x68) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:26 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1, 0xffffffffffff8000}}, {{0xa, 0x0, 0x0, @mcast1, 0x2}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) [ 213.591405] binder: 9680:9684 got new transaction with bad transaction stack, transaction 8 has target 9680:0 [ 213.602642] binder: 9680:9684 transaction failed 29201/-71, size 0-0 line 3039 [ 213.629095] binder: release 9680:9684 transaction 8 out, still active [ 213.637264] binder: undelivered TRANSACTION_COMPLETE [ 213.654858] binder: undelivered TRANSACTION_ERROR: 29201 [ 213.662008] binder: send failed reply for transaction 8, target dead 18:18:26 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 18:18:26 executing program 4: socket$netlink(0x10, 0x3, 0x10) io_setup(0x0, &(0x7f0000000080)=0x0) io_getevents(r0, 0x0, 0x8, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) r2 = getpgrp(0xffffffffffffffff) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write$P9_RGETLOCK(r3, &(0x7f0000000040)={0x1f, 0x37, 0x2, {0x0, 0x7, 0x7, r2, 0x1, '*'}}, 0x1f) ptrace$pokeuser(0x6, r2, 0x65, 0x3) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:26 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0xfffffffffffffffd, 0x0, @mcast2}}, 0x0, 0x3, [{{0xa, 0xfffffffffffffffc, 0x0, @mcast1}}, {{0xa, 0x0, 0x1, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x3) 18:18:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f00000000c0)={'raw\x00', 0x4, [{}, {}, {}, {}]}, 0x68) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:26 executing program 1: r0 = eventfd2(0x0, 0x0) r1 = open(&(0x7f0000000080)='./file1\x00', 0x200800, 0x18) getsockopt$ARPT_SO_GET_INFO(r1, 0x0, 0x60, &(0x7f0000000100)={'filter\x00'}, &(0x7f0000000180)=0x44) r2 = dup(r0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'eql\x00', 0x100}) r3 = open(&(0x7f00000000c0)='./file1\x00', 0x220141042, 0x0) ftruncate(r3, 0x280080) sendfile(r2, r3, 0x0, 0x2008000fffffffe) signalfd4(r2, &(0x7f0000000000)={0x7}, 0x8, 0x80800) 18:18:26 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x210) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}, &(0x7f0000000040)=0x10) 18:18:26 executing program 4: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/policy\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, r0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r1, &(0x7f0000000340)=[{&(0x7f0000000000)="bbd3121c71cb01373c2804c19add720663cb8a075c29360b306550d9508b3f11fb9b8fc3adc01ecf421090d0e0a9226fc0fb5c323f3c4cf65f4f25530fbb9206d486eead6484008e93bc0abe93f6637828d3d9df5c898c50cd9f59a85bdbac46707cdcebea5a43223a48497472c7938ace64c4d4aac18f89b5582c7dc626d3bf3cbaf9613e5df2f6c3a8171f9e", 0x8d}, {&(0x7f00000000c0)}, {&(0x7f00000001c0)="dd3d9c2260a00a2dc90cd735591034f6d360f757108bd523160f972ba7cdbf6fcec7d8ba41b9f98af24614109a98a2f4a4a95fef1ae1824c419fc05656e6a8eb575f2a70dad63fcf66518440e75153a7001be317d707735fc97a70789bf8895b8fedfd2710cf621e8efd16a15b071bcc3eef142b614bbf3d16c86c793f8dd8d25870a29281434a6c8ef0fe439beb6d0ff37b7df09f4b1f0a7a8be2911d36e6ebd250154e67e1149de1060420e7c193ef88419b4a5fe7958b0fab5ebeb3c1cc953acd6c49e88281d0d22f6364d1829a7c51fa2034ac61ec0399c364e555af3259c576835223177b5f0b", 0xe9}, {&(0x7f0000000100)="e2273b635722aa0bd1886a0be148b636d59d44bfc4311c53b70df60d699191afb0f452134ee4d12597de774a9663e43c948ac97ec93e67d76ca373e144f4a1e38765805a4c768098f411d08faff05b87edc6ebfbc86ae1e9bfdf3eeacdd1fc646da29c01f109dc56da68b97b", 0x6c}, {&(0x7f00000002c0)="13dcc0ee7ab9179d638e26a661743f5991a4b922aa788479efd0a51653bab34185e419ddb40fc1a660", 0x29}, {&(0x7f0000000300)="08ffc947c66c6da4e3d2d989dbccbe5310d5f704fb999c866bb279307dfde1a90f7827d8e8eb776ce8796cc00b8cc78fcb88f905a61d", 0x36}], 0x6) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:26 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002681a9aa7a7b183c000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000067444d210000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800700e23903a87460da3b6e278fc6da8293fb2aadd6e387c5a9e902da4d42cd545085622150a9d550ed0412be3b8946b4b660a7f6cc33a5f68e6a783be44924ab5551fd2ba3872f52d1f6dbe3cb08d2fcd1c2dfba77a8b601b107348da9ce69633d4ea50affc3b0433b65eade6c8a2130eb363efda4b13ea1701b6653d2030095ec5718543eebec6321939290b30d0e4d18816ae02f008dab1838eede21f855b78f7c85793c8f37898afcd4a60d00810d57ac57c4396390800000000000000ce764e46d2730027115b4dcfba409ab4b9c431f32e33cb7a2e8528437bcfdc0eb726e0e91bf4ffc2a37f60a1d53339232aae977b73e3a246bc4f5b06461f827dc463664523a50eb2705a86f0a9b28b229f6f9257c52812c278098731ca055d44aabe000000"], 0x210) bind$inet6(r0, &(0x7f0000000340)={0xa, 0x4e22, 0x7, @loopback, 0x2}, 0x1c) [ 214.083988] binder: 9702:9706 got new transaction with bad transaction stack, transaction 11 has target 9702:0 [ 214.107107] binder: 9702:9706 transaction failed 29201/-71, size 0-0 line 3039 [ 214.138179] binder: release 9702:9706 transaction 11 out, still active [ 214.146171] binder: undelivered TRANSACTION_COMPLETE [ 214.164415] binder: undelivered TRANSACTION_ERROR: 29201 [ 214.176478] binder: send failed reply for transaction 11, target dead 18:18:26 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x400000, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000000380)={0x3, {{0xa, 0x4e21, 0xff, @ipv4={[], [], @rand_addr=0x7}, 0x7ff}}}, 0x88) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast1}}, &(0x7f0000000300)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000440)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast2}, 0x0, @in6=@mcast1}}, &(0x7f0000000140)=0xe8) setsockopt$inet6_mreq(r2, 0x29, 0x1f, &(0x7f0000000340)={@loopback, r3}, 0x14) r4 = socket$inet(0x2, 0x2, 0x0) ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x2) ioctl$sock_inet_SIOCGIFNETMASK(r2, 0x891b, &(0x7f0000000080)={'bond_slave_1\x00', {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x17}}}) setsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f00000000c0)="8907040000", 0x5) getsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f0000001180)=""/4096, &(0x7f0000000000)=0x1000) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r4) 18:18:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f00000000c0)={'raw\x00', 0x4, [{}, {}, {}, {}]}, 0x68) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:26 executing program 3: openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x400001, 0x8) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x181000, 0x0) write$P9_RUNLINKAT(r0, 0x0, 0xfffffffffffffffd) r1 = socket$inet(0x10, 0x3, 0x8) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 18:18:26 executing program 4: r0 = perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0xd) close(r1) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) fcntl$setpipe(r0, 0x407, 0x400) 18:18:26 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @local}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) [ 214.432806] audit: type=1400 audit(1544897906.929:76): avc: denied { create } for pid=9731 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_iscsi_socket permissive=1 [ 214.459974] binder: 9730:9736 got new transaction with bad transaction stack, transaction 14 has target 9730:0 18:18:26 executing program 0: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x101000, 0x0) write$selinux_access(r0, &(0x7f00000000c0)={'system_u:object_r:clock_device_t:s0', 0x20, 'unconfined', 0x20, 0x1ff}, 0x44) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000000180)) r1 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x10000000, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000200)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff0100000000000000b04abb9a9309db4f71c3779970140000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fdffffffffffffff0000000000000000"], 0x210) ioctl$IOC_PR_PREEMPT_ABORT(r0, 0x401870cc, &(0x7f0000000140)={0x1f, 0x9, 0x5, 0x800}) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000000)={'ah\x00'}, &(0x7f0000000040)=0x1e) ioctl$KDGETLED(r0, 0x4b31, &(0x7f00000001c0)) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000440)={0x1, 0x5, 0x13, 0x7, 0xb, 0x5, 0x0, 0x14a, 0x821aad268d8d9261}) 18:18:27 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x40000, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000001c0)={0x0, 0x72bb34d21ab296ba, 0x6, 0x0, 0x7}) r1 = epoll_create1(0x0) r2 = epoll_create1(0x0) r3 = timerfd_create(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)={0x20000001}) timerfd_settime(r3, 0x0, &(0x7f0000005000)={{}, {0x0, 0x989680}}, 0x0) epoll_pwait(r2, &(0x7f0000000000)=[{}], 0x1, 0xfffffffffffffffe, 0x0, 0x0) epoll_pwait(r2, &(0x7f00008c9fc4)=[{}], 0x1, 0xfffffffffffffff7, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000021ff4)={0x2001}) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x200, 0x0) write$9p(r4, &(0x7f0000000100)="92cc3a7d7023bfbd59ea0b82cbb04372a8bdef735e9984d3e772f970a750c334e6a52f9b6b7aef249523f61f23db8e2d567bb4c5f97c0d6bbb8dd222d56c65a9af46b378e6c77417984fc9b46fc6479c1854a7ea2be980cf0a13d1dd60ae8be9ff64738626d6e1defec3ab8d17526b2bf1e3c611684768537e73447c9e78992433863261abc007a233cd26ce31e1dbf6872e22cd491db6115541daef2e66965efa85714c33020df73e129b0896c22129", 0xb0) [ 214.485895] binder: 9730:9736 transaction failed 29201/-71, size 0-0 line 3039 [ 214.519008] binder: release 9730:9736 transaction 14 out, still active 18:18:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$KDSETLED(r0, 0x4b32, 0xb2c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = socket$netlink(0x10, 0x3, 0x12) r2 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) r3 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00') accept$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000001c0)={0x0, @local, @dev}, &(0x7f0000000200)=0xc) accept4$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0}, &(0x7f0000000640)=0x14, 0x800) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000000800)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4001010}, 0xc, &(0x7f00000007c0)={&(0x7f0000000680)={0x10c, r3, 0x121, 0x70bd29, 0x25dfdbff, {}, [{{0x8, 0x1, r4}, {0xf0, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r6}}}]}}]}, 0x10c}}, 0x4) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x80800, 0x0) [ 214.538415] binder: undelivered TRANSACTION_COMPLETE [ 214.571798] binder: undelivered TRANSACTION_ERROR: 29201 [ 214.584700] audit: type=1400 audit(1544897907.029:77): avc: denied { block_suspend } for pid=9750 comm="syz-executor2" capability=36 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=capability2 permissive=1 [ 214.626483] binder: send failed reply for transaction 14, target dead 18:18:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@ipv4={[], [], @local}, @in=@dev, 0x0, 0xfffffffffffffffd, 0x4e20, 0x0, 0xa, 0xa0, 0x0, 0x87}, {0x6, 0xf2}, {0x0, 0x8000, 0x9, 0x6}, 0x80000000, 0x6e6bb5, 0x1, 0x1, 0x1}, {{@in6=@ipv4={[], [], @rand_addr=0x25a4}, 0x4d2, 0xff}, 0xa, @in=@remote, 0x3506, 0x3, 0x2, 0x75e, 0x20, 0x0, 0x10001}}, 0xe8) set_tid_address(0x0) openat$keychord(0xffffffffffffff9c, &(0x7f0000000100)='/dev/keychord\x00', 0x121800, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)="7374617409c0d2febcf9df2deac8c177ff171248e91193513049f831550d6f7de66cf637bdbf1311920c8a26eda4dcc3783f9db5116b34d31b0512a5608aaff01e7952340cd6fd00000000", 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0x7c774aac) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) ioprio_set$pid(0x1, r2, 0x1) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x800003, 0x8012, r1, 0x0) 18:18:27 executing program 3: bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f00000000c0)=0x1000000000017, 0xfffffffffffffdd0) write$P9_RUNLINKAT(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write$P9_RREADDIR(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="68000000290200ff0f000002030000813a4b0000000000005a09000000000307002e2f66696c6830080000000008000000000000000566696c653000020000000200000000000000ffffffff00000000ff07002e2f66696c6530"], 0x68) 18:18:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f00000000c0)={'raw\x00', 0x4, [{}, {}, {}, {}]}, 0x68) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:27 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000000)={0x401, {{0xa, 0x4e20, 0x2, @local, 0x5}}}, 0x88) 18:18:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x800000000000000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) openat$keychord(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f00000001c0)='./file0/bus\x00', 0x6857b21ff1155d90) fcntl$lock(r0, 0x7, &(0x7f0000000040)={0x1}) r1 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x5a41fb80, @dev={0xfe, 0x80, [], 0x16}, 0xe12300000}, 0x1c) fchdir(r1) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RSTAT(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="510000007d021000004a0004080000000005030000000721000000c7ef32b4a16d940e9082d645c40000000000000000000000"], 0x33) sendfile(r2, r2, &(0x7f0000000140), 0x7fff) r3 = socket$netlink(0x10, 0x3, 0xe) writev(r3, &(0x7f0000000140)=[{&(0x7f00000000c0)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b00000000a080c7c449a4248d400000070000000000", 0xffffffffffffff17}], 0x100000000000043d) 18:18:27 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x40000, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000001c0)={0x0, 0x72bb34d21ab296ba, 0x6, 0x0, 0x7}) r1 = epoll_create1(0x0) r2 = epoll_create1(0x0) r3 = timerfd_create(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)={0x20000001}) timerfd_settime(r3, 0x0, &(0x7f0000005000)={{}, {0x0, 0x989680}}, 0x0) epoll_pwait(r2, &(0x7f0000000000)=[{}], 0x1, 0xfffffffffffffffe, 0x0, 0x0) epoll_pwait(r2, &(0x7f00008c9fc4)=[{}], 0x1, 0xfffffffffffffff7, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000021ff4)={0x2001}) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x200, 0x0) write$9p(r4, &(0x7f0000000100)="92cc3a7d7023bfbd59ea0b82cbb04372a8bdef735e9984d3e772f970a750c334e6a52f9b6b7aef249523f61f23db8e2d567bb4c5f97c0d6bbb8dd222d56c65a9af46b378e6c77417984fc9b46fc6479c1854a7ea2be980cf0a13d1dd60ae8be9ff64738626d6e1defec3ab8d17526b2bf1e3c611684768537e73447c9e78992433863261abc007a233cd26ce31e1dbf6872e22cd491db6115541daef2e66965efa85714c33020df73e129b0896c22129", 0xb0) 18:18:27 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='children\x00') ioctl$RTC_EPOCH_SET(r0, 0x4008700e, 0x1) r1 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000ee00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x210) 18:18:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f00000000c0)={'raw\x00', 0x4, [{}, {}, {}, {}]}, 0x68) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 214.726679] binder: release 9774:9778 transaction 17 out, still active [ 214.738677] binder: undelivered TRANSACTION_COMPLETE 18:18:27 executing program 3: r0 = eventfd(0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000680)='/proc/self/net/pfkey\x00', 0x40c02, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f00000005c0)) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r1, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100080}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="020027bd7000fddbdf25060000001c00030008000800740000000800030004000000080005007f00000148000100080006000d207bb473dc046e71000008000900fdffffff08000500010000000800080001000000080004004e22000008000500000000000c0007001000000000000000080001000a0000002c0002000800090000020000080002004e24000008000500040000000800060001000080080002004e21000028000300080007004e23000008000300040000001400060000000000000000000000000000000000080005000000000048000100080006006e710000080001000200000008000b00736970000c0006006e6f6e650000000014000300e00000020000000000000000000000000c0006006e"], 0x1}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) mkdir(&(0x7f00000001c0)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) sched_setaffinity(0x0, 0xfffffffffffffd8d, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0xa51, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0x16852105}, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getresgid(&(0x7f00000003c0), &(0x7f0000000400), &(0x7f0000000440)) fstat(r1, &(0x7f0000000480)) stat(&(0x7f0000000500)='./file1/file0\x00', &(0x7f0000000540)) r2 = getegid() setregid(r2, 0x0) rmdir(&(0x7f0000000600)='./file0//ile0\x00') clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) inotify_rm_watch(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x0) eventfd2(0x10001, 0x0) fallocate(r3, 0x1, 0x0, 0x10000101) ioctl$LOOP_SET_DIRECT_IO(r3, 0x4c08, 0x80000000) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) write$P9_RAUTH(r3, &(0x7f0000000340)={0x14, 0x67, 0x1, {0x1, 0x4, 0x4}}, 0x14) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000000140)) fcntl$dupfd(r1, 0x406, r1) pwrite64(0xffffffffffffffff, &(0x7f0000000280)="8fa222b1bffe12d977baec052cd71c40e0f14c7e49a8412c0f82e0ac09c020ca1e08524cb543c7671c8fe1353eea72d751f76df13758e4c68101c00d48fc89c17bceefd13d46812a08bc6e7999d54b7b788a558c204ef93faf389002be7a4697fed3ba1c8cc415e9d73e73c20afa21c8f55aa1", 0x73, 0x0) 18:18:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) fremovexattr(r0, &(0x7f0000000000)=@random={'osx.', '!\x00'}) r1 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) [ 214.775602] binder: send failed reply for transaction 17, target dead 18:18:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f00000000c0)={'raw\x00', 0x4, [{}, {}, {}, {}]}, 0x68) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 214.826021] binder: release 9791:9800 transaction 19 out, still active [ 214.860077] binder: undelivered TRANSACTION_COMPLETE 18:18:27 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005590c86453bffbe20000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ecffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x210) getsockopt$inet6_mreq(r0, 0x29, 0x0, &(0x7f0000000240)={@remote}, &(0x7f0000000280)=0x14) [ 214.890275] binder: send failed reply for transaction 19, target dead [ 214.934217] binder: release 9807:9810 transaction 21 out, still active [ 214.987097] binder: undelivered TRANSACTION_COMPLETE [ 215.011629] binder: send failed reply for transaction 21, target dead 18:18:27 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r1) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000140)=0x0) fcntl$setownex(r0, 0xf, 0x0) r3 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$describe(0x6, r3, &(0x7f0000000280)=""/231, 0xe7) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="3afbab954d9b46b9baf2b31be160b9d5159911467ebe20127180f0d50209d0c6827a389f86be0fe6bfd16d4857d277b97c7984ac0b4b81b9d8f03e1a8dcfd4ba53b927ef30a6487c25962c2b617bc2a5eec0e0a57c1411ef76dfa7311dd1666c0849dbeaa7529ff9a0db241cd5601e53f2735560a1a6341962ab761257"], 0x7d) r4 = syz_open_procfs(r2, &(0x7f0000000240)='net/snmp\x00') preadv(r4, &(0x7f0000000480), 0x2000000000000113, 0x0) ioctl$UI_SET_FFBIT(r1, 0x4004556b, 0x6f) ioctl$UI_SET_KEYBIT(r4, 0x40045565, 0x15b) rt_sigprocmask(0x2, &(0x7f0000000100)={0x2}, &(0x7f0000000380), 0x8) 18:18:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe2(&(0x7f0000000080), 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) epoll_create(0x4b0) msync(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x6) socket$netlink(0x10, 0x3, 0x8000000000000004) 18:18:27 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) munlock(&(0x7f0000fff000/0x1000)=nil, 0x1000) 18:18:27 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x40000, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000001c0)={0x0, 0x72bb34d21ab296ba, 0x6, 0x0, 0x7}) r1 = epoll_create1(0x0) r2 = epoll_create1(0x0) r3 = timerfd_create(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)={0x20000001}) timerfd_settime(r3, 0x0, &(0x7f0000005000)={{}, {0x0, 0x989680}}, 0x0) epoll_pwait(r2, &(0x7f0000000000)=[{}], 0x1, 0xfffffffffffffffe, 0x0, 0x0) epoll_pwait(r2, &(0x7f00008c9fc4)=[{}], 0x1, 0xfffffffffffffff7, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000021ff4)={0x2001}) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x200, 0x0) write$9p(r4, &(0x7f0000000100)="92cc3a7d7023bfbd59ea0b82cbb04372a8bdef735e9984d3e772f970a750c334e6a52f9b6b7aef249523f61f23db8e2d567bb4c5f97c0d6bbb8dd222d56c65a9af46b378e6c77417984fc9b46fc6479c1854a7ea2be980cf0a13d1dd60ae8be9ff64738626d6e1defec3ab8d17526b2bf1e3c611684768537e73447c9e78992433863261abc007a233cd26ce31e1dbf6872e22cd491db6115541daef2e66965efa85714c33020df73e129b0896c22129", 0xb0) 18:18:27 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$BLKFLSBUF(0xffffffffffffffff, 0x1261, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) syz_emit_ethernet(0x1e, &(0x7f0000000280)=ANY=[@ANYBLOB="0180c2000000000000000000000c00000000faffffff911aab5cc21f21b9855acf60ee815764db5d097bd64d4cf11182"], 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/rt6_stats\x00') bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000100)={r2, 0x50, &(0x7f0000000200)}, 0x10) ioctl$sock_SIOCADDDLCI(r2, 0x8980, &(0x7f0000000180)={'syzkaller0\x00', 0x5}) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 18:18:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x400, 0x0) write$P9_RXATTRWALK(r1, &(0x7f0000000040)={0xf, 0x1f, 0x1, 0xffff}, 0xf) socket$inet6_tcp(0xa, 0x1, 0x0) 18:18:27 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) r1 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc0046209, &(0x7f0000000040)) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000280)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001436aebc9484f87447547e008ddbb460000000000003b94ad9b8f795ed5ae79318751b4a6d9000000000000000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000009000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000"], 0x210) getsockname(r0, &(0x7f0000000200)=@rc, &(0x7f00000000c0)=0x40c) [ 215.330115] binder: 9823:9832 got new transaction with bad transaction stack, transaction 23 has target 9823:0 [ 215.369406] binder: 9823:9832 transaction failed 29201/-71, size 0-0 line 3039 18:18:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) socketpair(0x0, 0x4, 0x79, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f0000000040)=@srh={0xbf, 0xa, 0x4, 0x5, 0x8, 0x38, 0x19, [@local, @mcast2, @empty, @mcast2, @loopback]}, 0x58) 18:18:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x400, 0x0) write$P9_RXATTRWALK(r1, &(0x7f0000000040)={0xf, 0x1f, 0x1, 0xffff}, 0xf) socket$inet6_tcp(0xa, 0x1, 0x0) [ 215.379669] binder: release 9823:9832 transaction 23 out, still active [ 215.393729] binder: undelivered TRANSACTION_COMPLETE 18:18:27 executing program 0: r0 = creat(&(0x7f0000000440)='./file0\x00', 0x10) getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000480)={@empty, @multicast2}, &(0x7f00000004c0)=0xc) r1 = socket$inet6(0xa, 0x800, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000280)={0x4}) syslog(0x2, &(0x7f00000002c0)=""/249, 0xf9) fallocate(r1, 0x0, 0x3, 0x401) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000001e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ddffffffffffffff0000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a80323593c6234e47663983f3a66036f294ce73cfb3c524531b724ef68f3bf5d6f4ea6"], 0x210) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f00000003c0), &(0x7f0000000400)=0x14) [ 215.428722] binder: undelivered TRANSACTION_ERROR: 29201 [ 215.454758] binder: BINDER_SET_CONTEXT_MGR already set [ 215.480239] binder: send failed reply for transaction 23, target dead [ 215.487006] binder: 9847:9852 ioctl 40046207 0 returned -16 [ 215.511039] binder: 9847:9861 transaction failed 29189/-22, size 0-0 line 3012 [ 215.519339] binder: 9847:9852 transaction failed 29189/-22, size 0-0 line 3012 [ 215.536502] binder: undelivered TRANSACTION_ERROR: 29189 [ 215.542287] binder: undelivered TRANSACTION_ERROR: 29189 18:18:28 executing program 1: r0 = socket$inet6(0xa, 0x800, 0x4) socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffffff144e0000ff000207835eebf116b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4d027f6577cec085156ef8d070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4e2540019ccbd9f6672837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6db", 0x118) 18:18:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe2(&(0x7f0000000080), 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:28 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) r1 = socket$netlink(0x10, 0x3, 0x1f) fcntl$notify(r1, 0x402, 0x24) writev(r1, &(0x7f0000000000), 0x9a) 18:18:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe2(&(0x7f0000000080), 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 216.079346] binder: 9870:9873 got new transaction with bad transaction stack, transaction 28 has target 9870:0 [ 216.094532] binder: 9870:9873 transaction failed 29201/-71, size 0-0 line 3039 [ 216.103132] binder: release 9870:9873 transaction 28 out, still active [ 216.109805] binder: undelivered TRANSACTION_COMPLETE [ 216.142462] binder: undelivered TRANSACTION_ERROR: 29201 [ 216.157371] binder: send failed reply for transaction 28, target dead 18:18:28 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="38010000100013070000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000040000000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff000000003200000000000000000000000000ffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000048000200656362286369706865725f6e756c6c2900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x138}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$IP_VS_SO_SET_DEL(0xffffffffffffffff, 0x0, 0x484, &(0x7f0000000140)={0x2c, @multicast1, 0x4e20, 0x0, 'fo\x00', 0x5, 0x0, 0x74}, 0x2c) 18:18:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe2(&(0x7f0000000080), 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:28 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) r2 = getpgid(0x0) perf_event_open(&(0x7f0000000300)={0x7, 0x70, 0x7, 0xcc0, 0x4, 0x40, 0x0, 0x0, 0x10, 0x2, 0x3ff, 0x85, 0x9, 0x4, 0x81, 0x3, 0x1, 0x1, 0x7, 0x1, 0x7, 0x0, 0x8000, 0x1, 0x1, 0x8, 0x0, 0x1f, 0x2, 0x80, 0x8, 0x80000000, 0xd3, 0x4, 0x6, 0x401, 0x0, 0x7, 0x0, 0xe0, 0x4, @perf_config_ext={0xfffffffffffffff7, 0xaca}, 0x20, 0xea, 0x6, 0x5, 0x10000000200000, 0x8, 0x1}, r2, 0xb, 0xffffffffffffffff, 0x0) writev(r1, &(0x7f0000000180)=[{&(0x7f00000001c0)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b0000000000000700000000006cc3f7922e6ca621658cf275ba398ed57c45ed1c7eb6e6fd8636e8224cc8049855b1104db965cc5b8487f3d88a8888f5d2c547894d8760f88bc7e68879f0c759cba6172a61e31c1d987e7512a1f81abfce1a58cfeee11a014af0288483aca94604f939ca0334b895d6337750f4924ab4471d9b3320182ccff71d141c4988d71f8af199b4fb5e9e84f822c8f057c8fed5147f1b9c9d5f7214810171e0528ce2b61ee54ea043b087a824b7e58338270355847f76802db725bab783880a", 0x104}], 0x1) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, [], [{0xa654, 0x2, 0xda, 0x9, 0x8, 0x5}, {0x7db, 0x80, 0x1e, 0x4, 0xffffffffffffc8f0, 0xdafa}], [[], []]}) 18:18:28 executing program 1: sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x40000000000009) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x800000000000002, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={"00000000000000000000000002000303", 0x5002}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x2007fff) syz_emit_ethernet(0x46, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd60f7166100100004000000000000000000000000000000010000000000000000000000000000000100000000046c9078009fbf2600baf400bbfe75cefcd3b44891a6224d5926de3b7ff64f6a45f7026804fac2aaec3e842f104a7c384030a06b9f48c2178b0d6c7226e8e42d752d1c9fd1be3bb727742b4eedde3171962aaab7b8bc7e2d38550f27e7f1a0dbc8ab21cb2eb801ff8113f5a5d83d837deefff571cce93505e7a265"], 0x0) write$P9_RXATTRCREATE(0xffffffffffffffff, 0x0, 0x0) sendfile(r1, r4, 0x0, 0x800000000024) r5 = fcntl$getown(r0, 0x9) prlimit64(r5, 0x0, &(0x7f0000000280)={0x0, 0xffff}, &(0x7f0000000340)) pause() r6 = creat(&(0x7f0000000200)='./bus\x00', 0x0) ioctl$RNDZAPENTCNT(0xffffffffffffffff, 0x5204, 0x0) write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCGSOFTCAR(r6, 0x5419, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) ioctl$TUNGETFILTER(r6, 0x801054db, &(0x7f00000000c0)=""/21) fsetxattr$trusted_overlay_origin(r3, &(0x7f0000000500)='trusted.overlay.origin\x00', &(0x7f00000005c0)='y\x00', 0x2, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) 18:18:28 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) 18:18:28 executing program 2: sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="05000000000000000000000000000000e309"], 0x12}}], 0x1, 0x0) sigaltstack(&(0x7f0000001000/0x1000)=nil, 0x0) sigaltstack(&(0x7f0000001000/0x3000)=nil, &(0x7f0000000080)) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x4000, 0x0) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f00000000c0), &(0x7f0000000100)=0x8) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) 18:18:28 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000240)=ANY=[], 0x0) 18:18:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:28 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'tunl0\x00', 0x1000}) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000000)=0x2) [ 216.309976] binder: 9897:9905 transaction failed 29189/-22, size 0-0 line 3012 [ 216.334308] binder: undelivered TRANSACTION_ERROR: 29189 18:18:28 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="38010000100013070000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000040000000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff000000003200000000000000000000000000ffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000048000200656362286369706865725f6e756c6c2900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x138}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$IP_VS_SO_SET_DEL(0xffffffffffffffff, 0x0, 0x484, &(0x7f0000000140)={0x2c, @multicast1, 0x4e20, 0x0, 'fo\x00', 0x5, 0x0, 0x74}, 0x2c) 18:18:28 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) r1 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x800005, 0x0, 0x0, 0x0, 0x0, 0x1, 0x40004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RWSTAT(r1, 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(0xffffffffffffffff, 0x40485404, 0x0) write(r5, &(0x7f00000001c0), 0xfffffef3) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r5, 0x29, 0xd2, &(0x7f00000019c0)={{0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, [], 0x1b}}, {0xa, 0x4e20, 0x4, @loopback, 0x7}, 0xfffffffffffffff7, [0x4, 0x7, 0x7f, 0x3f, 0xef, 0x7ff, 0xdfb0]}, 0x5c) readv(r0, &(0x7f0000000340)=[{&(0x7f0000000500)=""/196, 0xc4}, {&(0x7f0000000600)=""/241, 0xf1}, {&(0x7f0000000700)=""/202, 0xca}, {&(0x7f0000000140)=""/135, 0x87}, {&(0x7f0000000300)=""/26, 0x1a}, {&(0x7f0000000800)=""/194, 0xc2}, {&(0x7f0000000900)=""/192, 0xc0}, {&(0x7f00000009c0)=""/4096, 0x1000}], 0x8) read(r4, &(0x7f0000000200)=""/250, 0x50c7e3e3) lseek(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@mcast2, @in=@empty}}, {{@in=@dev}, 0x0, @in6}}, &(0x7f0000000040)=0xe8) syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_SET_INFO(r1, 0x0, 0x200408c0) syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0)='IPVS\x00') ioctl$EVIOCGSND(r0, 0x8040451a, 0x0) 18:18:28 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="5140a0b0e13f7e3d5d42955d311ccf17de4fbb22eb", 0x15, 0xfffffffffffffffd) r1 = add_key(&(0x7f00000000c0)='cifs.spnego\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000480)="1bf39c99ef0b0fb14d0fb1f30109ac0362d57954d59e9e780e1826ad77197fd5779d459d813f6a84b8026684a2bef92a331ae9acfef63e2674ff03441c73378c47ec524add48bace2d80e4407f92b6ae271c25ee632a678f2ee6b27900c29e6a4ba13171484950f932a80bd9c670062077d401d158475cddf77d2bb059e586e899c4ed0d88324eafc677cfab190d7037b9da077fa897e37f1bf7c08a0308042974289ebb9d021ac427a08064152c22e53094f8eabc73f9b8b54d0641701501ccdf6c5ea710bbd2d201aee0b30bdd2f34d6260aa8d3a756866c6b595c87ecea6b720dec21b98c4922132c6302044d6d8ccce92c070448fd3de7e705154a51d90fecfc8180bacfa87bfc0f7a4540685e92c93b1d325b1448dd1999f6827adb55b920af8bfe66ad82977b73d1d93eeac35064cdf63635b52d32cdc72f32989898894be3a66affd06e9ebdd69dd4d96f62177b6e3d1acb9dbd9e2065be97235f34a2526a7b669132ea88e86f9ad465a7cd958e84967e6512c8c58a3b06dcb672ee3a0c9d9d10ed32f35748e7e88f9a2cc6a6df5f1a43efccd7469e35301ad87aad2d631d754b5ebed503d9c9506bfe0c708a3d4cf173faf63ca810324c999b47c1dce6b7fc17c216bfce9e62aeb2fd54790d2417c019a5caf000ec65aa53f1217fdd6c5fb18c6f093a76276d7dc8adb50274853588264b26ebecce62c274874c1e8f7135a32e206a71688d0a72cc76d380bec56f5458cf54a953072b9ae2f448875fe2ba8b3c7ff6be2aa862d1f55549a186d0f818a050a74e3378bbf10e3780802182809c0e1585704f1d89b4525a1d1fcaba3b784e12c2ca873596354d4700507e0b17082d25db4e0aadd259c0a1d0639778cbbe51042faaf8a00f1d11eee47c4532d42118bed09681c7f1c0a99baf9c2255f6499c072c5867574b2b0502d2b80e9332a9f78caa9a05c68376b0ac8f29d549890cd976c64d03e98c43502d9c77bc2b6ebd39bd4af06e511b0b120aa26839b1e788555e1ef3b74bc9130797833c12d11224484bf379b777bc10c460625838b774de5a235389556de7f880d0b2de769c23f0262866ea128d4ec7d8a0aa324f246a205fa21a2327b6944be2e1789f602a23176513a226aa01e7dea6bf247c5d86ec625fe3d67c2b9602be59e140b41493bd1ad12d99ca6160dcbdf55ca50d4c0aae87a05612c35837239efea4342d0bc63bbc321ebb3ec697b0dc76b6a69219b9284a64416db968a3a454d39bf689844603ca25ff87c7266b72e85bfcb235e113290a57cdeb026348f72358423439e805fb60496c75cb153ef51f047465ea337cd04c75944949bb6a851b9a10e1327b3fc5ef9d0b614e36738360a9f8fb310640c2ed234c850f7baa57f8c284f9dd74d64ff8768851763b9e3458ad345e291c71ec561415233918eca8d6e93e0d8fbc562dc03d18f856621fbe52f68d403c1cc28e97ea1c640efa44d9e7621f628718062181e37561e8c189644648375b85c477eb3cbc2f03a21310ab3ad0c73e01e9bc3878d1691e4ca49813ca6c0ee3b439491be366f8198698c4235145427b357e82aedda70bc87a5063a9f015d125f2f27b1b938c87c70e45f13292d1be3d0574d34565ca5b009861ca7499aa1c3d7c5a7c5fa31acd4dba40e15c8020dc7cd3b861b0371fdd3e3b20ecfc4a7e7661fff3247d4a730b37fd00ac73426705c4e3f54b85fe7251e353f78dc346bc6a7378aa47fe16f4cdb659ef4590954f8e754064da62daabf3e207d76c6a019372211c326a1feb00a2e1b9cd87ca395b80ec6cbd4e1be3e2bfaf29009c6358837867e2d8456206370366fc40ee620e809305fc688a80c854350cd3601650ebf204879b38008f76e0026919338b9c6cddcc746d57d79c3488b0a9bb19cf206f9b322077b95e9b929c24f274ba8b90949a1eed5a515d3a410bcce32b13e68bfbf1ef75ca59e9a20d7fc12eef30e4ae8bd28d71851d159380a72eae710f2dd0d852f53b9b8c6136a549a0d82b2e6489cd7bead15110179730d0b497af1a1c9e52ddc5e9c9de66e9518e31a09772448bfbeeb2a36cc62fe0b0682e4afd94b188eaf80d97de9d1e96ea3fe00a4bf79be297e1b3f4f7bfad1124157b94dcc5612dec9201c456548ee5baa897f5464fcf90c343c7ab09222ecb6858756df6f7c2a6cfadc06a20e98e9a91782c086b9486b7fd6864aae3229e35001298529c6fc34f0c077bc50b3c2a77a414d945877db80e1270ebe1fc7287f906ff3278a4b767e34aa03cf590df442db149abeac1a7c2a60aaea8c1ddcee61ed8ab947b559378de8722da5a0a1ddff4245e70dbde70ecceee1b54768ed17a6b8683e1aaf079942af7c32d1336fd085250b0abd1c182bb68a0a091f72558c4d9070e67ed7cc3412ef5dc5e9e0b9b2bfafd29e93a2f733e6de39558fb684b8d43915c57acf1fa1b34a0cd13a596e8e1c36d37303c8fefc74359a836130cb2e28360453f786c156c348cb41f2f4e741e502cf16235d4be22e24ec80ed57cb804c50597e7d216334b190e39a4c79f2ea0783e748f736ea36b050ed472a45f6b6f8c0de25b80fff858cc7468dcdd542a21b429cdc9f142e1ff599f9a7cbc29e69f042397f6e11df3e8b9a284910813679173f9a8e0eb452c81a13fcb8da8b3dffa271070f9d5ea5e0b1a2982168b9a2231ed55dc1190bb44f6875e1a27d7c3949da7485a6a443bf4c1d7c1f2a2f0af8f61f14b88ecfadd7b160108c3379a6b0d993cda005966eb91a22b03d3c108b083f356752c00dba80754d6c913cab9ef69d56d06c90c154d16ff395fd30a225551ee9bc3538b47ddd6a9a7062e3e99c3ab7b626a9be5a14cbcc09f964fe4d19f6de888cc011d6ba6d09e3ab077857040660b4f21e0881250f05c74bf13b1d7b4e2a2555437387e445abe4708c1dc118dce0f50e16dbe8d081f2b55fe1b6b51417d0159cbededa6779bdbefae275cd39c013b45c9a461a6b7a40feceba05ed311b7cc59acba8d3d30ec84abfd6a309b2a4232facc6f16d7e208d2514f0035ad92417a8ba03c786469711609838d2df9ae385731ffed2eae007f93028edadf3314ed0c41bc22a0f2c2f403d448acd49f62378867f07d0091b2455f60a144b9c87aaf3a4a8586ea1b0ead37addaac949ed697a1cc010aa7566f20e6dbf8a46ed4d6cf5dfacb77a5ea863ae4ed54b44999f4cfbd741ea4fd7bc07100a06a34417496cbfecb13166da72408246140274609296346f09634ef992ee7fe93170f15910b6b6008780b1bb8868e5e400a180f1a23412633b2abe42a79608f5f141b6773fa6e917c8811a94e7dcf6385fe342e78032401629f0b6559bbe4cf67a3cd57ab47ba5267372cda3564d9865db4fa76db8c157dd2f1938ca3707c0692e4a131cfc9caba716f5ce2857a4d0de025c1a4951801cd876efbbc785cc13d8a715f6a8123cfec80fec9df7090ffd8329d0b97091ab3f130d9b203bde5aaada658d9b4e806f4ab8210d16946bd34e79e2c2eed6ca774d74bba7e5bd57919c8612ff0372ec00884f7a8139b629a66a845f5207b31697477a65436bbe1df4712a5e0f7a4f92855c108fd0b9fdbf7d7720964a2cfad822f08d8cc6d7d5839c63427340130f78d1dbabc1c971097a182bec7a7e1c805fae1d967d2852169ce85c8be14153b646c11dce9873ef2c1002207968d52b52a1e76d1fc186eb3f60a3e6ffad4e205cee5ecaccd64bc760b295a1e80df293d971152097448c03e2a26c14e467166d22abe2e6bd1092a12d1fe2ec30e54c1b3be9ed81a9cde2eeaeba5a6a30bfc9113e6131a5b99745ba1341337b0ebb2ce3207835f15b524606f9614a0ebc4d3fcdfa8c0e60d9eea67ef34aa6a56aa108974df2a39ef77f127a84b4e9085369f61dc7fae2100778733e2c4468f234bef5deae666183984e5d7c29be12d69361fd4538f1e76b533c8f5287ed5e31b5a52b4960730b0bcb286fd9c51215637144d1e6a495cbd7a8e5fb7888b0571740ed3c89f078e2fe9bbc7c4ed80b8875eb66c15b69ed558dba4de7770a8a3b2731c725eae2f342986fb8e84b9b33300c372cacfc74bf61d41e5138516d7ff2f9faf211bec2f322cdc42025356a5f328ee358ff5ba4903725a82806478c4b98502585f8180f56ce4621d7ced548b318d8dd72abc34ae2d3054a3ad887c67ba082ba1402b09160a147dfaa5dab45d18e39f53b8097a7ac1d6c74de2ff96d3709bfda0be4ad76bbd3db8fe32770b60b0b1fd3b4c41593da9e5ab5fd3d4ac22995c71aaf744f7f4807ba86f7244ab3f86841a94ab59df0eb65399374dc448529bba600642b6dd6d4310a68fe6ccb30e2983897433079d9dfcdb32cd83ef445a8508f564433b8a11be3308350dba8c02a5cdd2a4ff0bf7600f132692cf622787e660cd53d6e74720124dfe2fda9a584fefb55854131757d685f53283062d60b18aa60a2715997c497afff60e5290dd4f9e3356d3b15113794cece8f8da12ebf828b2f0951757fbb52bdcd92c07a1cd464a8143166d9ae5ec0749cee95b6faf54ae39231b2adfe75324ff2c6c12607f87a52902008446f9ee02b7e2e1b71ce6deb836637e7df6a18ccccb4a100d2129bc95bee26f0790759599290fc2294548098e74c051fd0000f716c481898dbebf51c93d686d3b0b2a0a0fdb151dca1478bf77366fcc63de61636ecb09be98bc5b5df2877e3402225f9e5450af91f7d6005d787f2e99fda8e6c7d7ec5224f42b3b93eb0a3e94c51fba3832beab8f68f07fd391c819c101eaf25d7848970b6a91fd09b55097ec282a776696c880c72403182d320b10ab09aa1f878741a7b881a37f8108c2ba57467fe2d906f58d55c5da1be3c012422a9c5059a2a835a7b0bdc792a38086685cabcdf5d00d0681b8a3784971f9be9eb6741cc919168e445c6d1523e25571aceeeaf22add7165e440f228387eb645d9241b71752b1adef9e4350ec1da07a66bf2743740a5fe274ecb7486e6e342971641f08786e179fc468cb07dd07a971c4bea0d32ae2d276b672e120a25795af4dfa8994421341f8dd6baf77f7290a2178a28d6de5822393519ebbd2e90cbf9f0273d7eda8d1ddc0d4fe2080236b00f75ba7bdb57e690ac824b26f8a04ed5f05cb536d9bd143bb4da2d1ed4142f0557ab5dc51be0f9a8b11280e4d0b2e498c31657d9a30697ba773d586794d81141b1bc8043b3a6481c63ba0f2ba8c6fd0589fd26fd93d190a00d0e2a9a1051dcc0b093b6423693b168b5cfc87712e44f79034dda3f44f3ed081d0c365c52fcc839265212b1ceccf34f0f48114a8acdc7ad885f99c187673ba5dc677436d0cf78d6b20d198a762eeac11703d7d4f62006ea8cf83c824a6fed6b82d853566c42cd316486ad84dbd6748d2a47e5a2fb5fd17fb3bb3876caf586d22d54d87a8f9191cba35cf563ef933324eb016e8dd6de5e2ac70596071f776a25ee8446260ce6eb2589db602ecef36f2746ebcf7827510cc525cfc6b87bdb4efc542d0cd9e4b7f1171258caf04103c72417c9f8f8334cd3a73cc778c1a37c436774bad018a12c10d71f424a5afc02a4eb0b26ce4f3d943589c0df557eec9a6e1f08b6de0356e359e910c892ec1d4d0ac35fb89e938b90256e89ca55b72d29f12ab14cdb32090fed04c99a3a0269bb5984d09ed45b5f6a2afb4436fe1c5ced537a91b70193ee0a4fcf7042b7df406a40429b6abc3911ebb239e8f538b6dbcfd093f6bfb3949b88c38671f555e7503f3ffb720390f7ceb6b3c6ef023d22a0a5ef8a1b6f", 0x1000, 0xfffffffffffffffc) keyctl$negate(0xd, r0, 0x5, r1) r2 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 216.394431] binder: 9915:9922 transaction failed 29189/-22, size 0-0 line 3012 [ 216.418798] binder: undelivered TRANSACTION_ERROR: 29189 18:18:28 executing program 0: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/arp\x00') sendfile(r1, r1, &(0x7f0000000040)=0x4000005d, 0x239bffffffffffb) openat(r0, &(0x7f0000000000)='./file0\x00', 0x40000, 0xe) r2 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) r3 = add_key(&(0x7f00000000c0)='trusted\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000140)="5451701590572abdfb7ab6cfbf7f1db14a02b7d15ba6b2278f70b766f02bc9782b28a7c024154f3cd7827de7ddfce657a89ed6c8939ff3362437af3bdf171c3673e492d5dc3f6c6aa326b476bea4d131d2da89abaa8a5406a47b5d6857b9a3dad5b02ffe568b5513cebc4cc5aa986c31708b7edf3b406fa7d009b8125a0c1464ccb0a95849fe5eb627b3dc7e", 0x8c, 0xffffffffffffffff) keyctl$get_security(0x11, r3, &(0x7f0000000200)=""/40, 0x28) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000340)=ANY=[], 0x0) 18:18:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0xf) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) [ 216.507161] binder: 9935:9940 transaction failed 29189/-22, size 0-0 line 3012 [ 216.540838] binder: undelivered TRANSACTION_ERROR: 29189 18:18:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:29 executing program 1: sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x40000000000009) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x800000000000002, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={"00000000000000000000000002000303", 0x5002}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x2007fff) syz_emit_ethernet(0x46, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd60f7166100100004000000000000000000000000000000010000000000000000000000000000000100000000046c9078009fbf2600baf400bbfe75cefcd3b44891a6224d5926de3b7ff64f6a45f7026804fac2aaec3e842f104a7c384030a06b9f48c2178b0d6c7226e8e42d752d1c9fd1be3bb727742b4eedde3171962aaab7b8bc7e2d38550f27e7f1a0dbc8ab21cb2eb801ff8113f5a5d83d837deefff571cce93505e7a265"], 0x0) write$P9_RXATTRCREATE(0xffffffffffffffff, 0x0, 0x0) sendfile(r1, r4, 0x0, 0x800000000024) r5 = fcntl$getown(r0, 0x9) prlimit64(r5, 0x0, &(0x7f0000000280)={0x0, 0xffff}, &(0x7f0000000340)) pause() r6 = creat(&(0x7f0000000200)='./bus\x00', 0x0) ioctl$RNDZAPENTCNT(0xffffffffffffffff, 0x5204, 0x0) write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCGSOFTCAR(r6, 0x5419, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) ioctl$TUNGETFILTER(r6, 0x801054db, &(0x7f00000000c0)=""/21) fsetxattr$trusted_overlay_origin(r3, &(0x7f0000000500)='trusted.overlay.origin\x00', &(0x7f00000005c0)='y\x00', 0x2, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) 18:18:29 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000001f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x210) 18:18:29 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x101000, 0x0) ioctl$TCSBRK(r1, 0x5409, 0x9) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000000)={'filter\x00', 0x4, [{}, {}, {}, {}]}, 0x68) 18:18:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:29 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_netdev_private(r0, 0x89f7, &(0x7f0000000080)="9125c54d66d154a5d062920f63a0fd1937bb784006dea1cfae05d5725e18f4cb045859dae58437da2610ce464908424939f9db3c510ff3fe0c682cc2d4b44ee64b9f7cd03c1ef3") ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000180)='./bus\x00', 0x0) mlockall(0x6) ftruncate(r1, 0x208200) r2 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r2, 0x0) read(r2, &(0x7f0000000200)=""/19, 0x93fa513f) 18:18:29 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_aout(r0, &(0x7f0000000480)=ANY=[@ANYBLOB="0b0100017d02000091010000ff03000098000000ff000000000000000000000077a5dd75bec6ef4e9ffc9f7c9d8da58d4731f709c8477fc934892081f85a09d751744545fe7b5a31d5d22a1aa154dcd7a3a4b94945c5fe6ba93189be9e8dd673a8bb957c1ae68f709826d1a33c3131abe5eda8b11b2174dd080175d0c12805683370abdbb7c47ab1c2a409b735a0e2a959ec0fd9cc96404ab0d10b4d51c505cd8beeac63cc9f386f498c378662be37c678ea01c7d44b3599db3e485d07a860e2f496efda1902b40bee93f4ffd32dba2f207fccca858a213089a49baf5eac48649a1b9ec3542a07f73fbf25d752dbb9dbc4a282455e0db642792ccb9f41a093bcfd7a242fb46b24f8262be20030082f74e0c7777e5e1ae784c970fd37ca3f36ecb074d6d4a80155f0f7698724e8207b5aced6d0a47b55ce0ec609218e01e3b4b274325781e528754ebca3b1666dc8d330285d3a6a14c533d60c23cf7e48ad2dc18e95bccba20fb53f6e7155a08896850abf7b62d24392a733eddb8e465d0c4ad2d7f5c5c7f3657b70e0aded80f7907743fc69fa6cbb0c43674c30c3126d14a3388db2d51fa15f835d97ba956b05f059905db05c362e215766983bb7e8d23df140d666efcb610e4e9e5434c218fbdc03c04c1e923411181e11f8420e86b6d4c1a839704e3c0d3c69629bc9e7361a1be559504d5487b98de0e3c710521c96066f55648729f43ab3f50682b9273ea2d1986172b0411332f18dc59e16b6fe6fd55be79322ee68de073d50799c6735485f0ad8b3c1bce7512a122a54b6b78b09cdc417f2873ca1d7735f0e6fe3736ecb509e61a53e60142202792ca2928cd4f3e549c929f4011cdbce991d001699373aa5cc11cbbfe1c8bda373eba3a758068e0c86fdaf9df1219933e0462f8c582bd3039a9104cfff8d0e732eaffa002ee6db0068c9b742aef8e7153d1839764b656649eb47dd46fc1ae4a0ca2d8f207933f8dc63014bf22c761cbd92ef8c69def31a03e9d62e7e170aecd6eb56a0ca05844101443631f8fa49f98cc9e1b502f94326997d1a9449491ad34d861a33a71738fc1fe87147fdb12126f2fc2a70ff96b5dbcecce840664efd406f4cd045ca162fe603b48df8628a5a16e7fc7c589316892c29047c675fec73f2ff38c7f4154cc5e291c4a4f352841112592251e97a8d0966c3a988b975cc9aaf8eb6d83a3a82b40f5e0c9bdbc96d147f47fba0578492bddd23592991a0735f37c253638efd4d647771917d85a29489ca12946a542bcb4126096654d380426c766742a750511a590f88b60ec45b5114b684c1eb53ab679baeaf309126f1acc2bd1beb4a3b09f59413940b7adc9a129e2a9ae0399ee4c101ca7ee6237caec57008c4f17fcb1baf3c0064d6c1cbf4450b706847cc048d4bfc15b844419f2b64b5563cf3151279146658c9d20bcd6a68eb7956ab1ed4c9121d2855af45219669a49aa4147da434df427d58946627e869f3cc0ea24f2f32b00b8e0ea10507e2110be9c301ab8a979b7235f8f5bf6619cd5dedd23eedb59cf9b05c61d491dc4b66e0c8eb14f148d93e9ef33ce9623c96240fd6180d10e369074da494389162792586a8c07f4c1cdd9f050d0c9ab70d830192390bed4c7f0851677413cd00f53396c3814a453e4289e6b4dc3de9210bb6d40eea2159dc0f2219e0d675b18ac3c0e5aaaee95c4d246f74e82fb0647ddf805a80f8785985270e88915739ec61d540303adfa5d73abd63cf429e8683e0f7ea4f0d507b96c06ecf5ea3e90b200b2346833f9af6da91cb81547f9f1741cc327327fd7d81fc844e234ccb94542d8c5ede7bb04310af51c9854d8b44843a3f4dfc0bf98c56fa384d1a509dd56de5fe451a026ddda23d20663a1e87f7e5ae6c0b8c24125020f4f9a6d490273c16adf8b9aa3f66da07668736d070473676957ba8144785c8393212a269ff309a1dade8f9f271f2dbbf59745fe0aa779a75d902a8925f283b35b9e1d777f486028a642ecd96af2b96b5724c38f2fb51a03b08e24cbb152787263d97c3539c40d62e2763ae151d98b873dbcea8aad1a796aeb0ec0c78cf43b74ac426bb38efbbe4cf08e9109d5d7eda2109faf887454be5bbc7e9af39b7a1cc5c2b79cf472de2d609daaeab38115974a54f1702db46c6e5905c72267d560bf6a8ba35e3b038d9408a6bec33ce22d62e0ea8ed3111e168b7de903681f3f10fbcbeed4a6467afe86c7d221f004fc689e0afd3a8fdbd23158e543800ae811a67439e6e316671aa86cec3e93cb708a1dc5792c01f5e5c2acd1b5229270d1f020938e5d4d1f0224ac7f3554a5e8ec53d9d350d5ad74682ac7d882f84d4d162e63e017e0e88a60fec38863c7be1e5b99e49eb3ce1447972ea297ff849cb479af39cfdd5a227e932a257b374cde42eb39bde129c18867001f18f7dc09063f9d224f4b1c583be38b0f8763ccf40136532ff77043796e1035b3efcc77e87156c122f9689c76d88034aefba5eb2bbbc1c46fd39eb119b6d03b5fb0a20bf2ae6658047fc7acd815f391cbc1c3c961b20320b2804f552f6dea557986789a5084b6c8e4e1a4f8893d0fcb9a238a1a3406577b12dd1b593f9aaad34a94e6eef5e1a094f5d1705776f41785c600d20af605c4632c1b45e1d2f3ab3bbf0499e0f901cafde051f5e53160e43ab27be2248de870588d0461ae8379e563eae8e4b2e94985b99bfc9f33046a8f1971f81eb6d2dc9eed4cfc3e03e9f75c3c596e31e34a8866e0accef6ae0368718099a263f2df002758700cea4645cd9f75a7ad9cd48f075f87639641745afbbef70318cac2aa989566bc500b30a3ae29fe22793eb16d2e8a6c45a3aadbd186d59f7e141862cac54ac1c3dc64bfb14a67bff9b90f666940877326e846029a95ec19ff6d2384722d9fc8218ff6f569c2a090bc452cbed822898014fe04eba78b11794127d37928e19e8ca0c293c58828c58410487f3688cef9f2f53f92ee00dc8f2db168057499e09531ba8d1bc558e711dbe22459e7d2186da9c3db75d185212eaeb9431d40afcc4ead2b4332d0741471f2413de9db37e607af7988c0407329b0605261a0c6e4d94e821239f78c7d9436615adaed6236ddb4b093c13624f6f05e76d4b65a708715f8e10e624812a0094e443d7b5796854fd22779138b478354dfb41216e2f18a77e3b36136e72721cf63d9beeb9bb31fe7aec3ca9c67ec293e0f28b1badcf66f8b7a2440d46768e0191e043216139d0f7f4efa0b83b9bee23fed91e564e05c34ac3bb1310802178af1a5fb32e7392c8ab1cab2176cac5f214d4da018101220c00e75a98795417e59b7c0c5691dafbbfa7fb2b176095f1aae186d648fb633aaf25a9369c693e0bc94e107eeee5363f8230038a9a17239f3eb4c78ed9da5edcb99d539202a1320a53f7f86a83531ed6dd55695239ed03bbc1d83d00c25cb582dd19f612a7c84e20fdb2e0cfb054950a6a8957e445392817e809519fc723cd5d3680b40d0dbe9a30928923c1d8b7ea743724203e932f45779739433f0b01fafd58f05986f2bdab20ec168b8baad06d9cc3b10218faff079eb81a0e8d5d1dd926e8fbed4ebc008a041d3856a5896f3ae277ed67c16f347727ac151a9b7b6a608e2ad26c7cf06e5ca0f7c81b5853f82497f5384339f47827c6d0339f8b903fdb9d3b52018770212ad4ffd4b3b701946d17f4f4a7abb5d226113053f474ee981806a813541769ddac9106505d8571d8f1c9cfb79ddba421c967b5280fb074c01e7e625b2c85a39a86793b68bdd2522ca64b5ee23655e2e3efec82050f8d7d008bb065f63e335f62295c3e4d317f054a501e0ecdb8256521f72e2dc6a5bce630acdea873dc728d16f67da5592610c10dc14a7fbd5a504bc51cb283a5740e550a8bf571fb0ef3f2c75c4db8de586753ea9fad7cb86a511f7fc1b353881d91b2c5dcdbe95899243b9a78ce78fc81243a0cf3fc94c446f68acf62d974231fc3f1ee164253d77b77a893b5a22741fa5d7330e3c9e228f4e30d2823d5d545c35d7ac2273d3f7473794c63eb9ae3c6713b794afb0c9cb53e3e3036a0ed67dfc73fd2af64d410ac97ecb9fb49b412c13338954fd1e8fe9d03f4d0a4799bb5042a7bdcc0deb4149273b1ec25424117cf87c3dfe753e6297f074dfc6d5f798e0f43bf54534eb24c453ccecf36fad588fe11651e57fc4a5860225694f554d33ec523797a68840043b803558ea3adc17d3e4493a11d702e0eacfe7789b0b534316ce7ffeb20e97be8d2505df27ecf70aa7b0ff86274e0694ada4e48e0f6831d25f6df1bc4086c7cc672ca121a6e9fbf653358cde547cf4664413cdf5e63b160d8ca9b484708692a7d48d254b42400f46397e4f77bdc634d6674160ea6ee0b4ddb6a81065e6d2e3cb93cafe7a1b9490fec61d06e2de85eebee428c6e795301a3b5f254cf585271e4088904fb3ebb3bbe25bd8550ae0c91dbc1776e07203122f6ca2d5daea2f6ddfcbb6a1af3632d457163d05d7e730057d4ed57cb672a14eb1375b65b1803ba858e392a06776e26415e4e42c64453c16b42a7f4f1f1a1f5482a287d73fffd375ea55eac788b3440865a249b4a94526c3253b7e194a876570b62e98deeb854bf9bd38a3a32a111102af19def3f3a2b916c475d1e283340e26b5175b9098cf9ed24465f890eadaa0953c16a5675e46514267b4a7e9830b3119dcd850af03efd912578ba41b3caf554e156bafeda5d550953e9e8d7991e19d1d78399d7a53a0106d1d449756708d5033cc32b34d1d4f0fd1babf4238dcf67626c9d9709f2823309c448438867c808f1227a9f36178fdb4c4f05a94f7f8ecaa094afe24581773fc44ee5b33cee179bd5d34938c58ad1df86bfbf24b04e271b87021ab6272dd8409b3e974861d018ca15aecfd9e6f1d462fec72144786837ae0f14a93e158199f4b7957bee3ee0aaedebaa5bec5cb5084ecf205c4261a14830addc3c5e4f162654302146e62a9380cdb89922327150cda0a7a6c55291872e0e7189b800e0ae938d7a43b98d9aedf76a3ab7f350861f27e4f5387ca781dfa2a3ffdd91878ed0f04dea146a344ed326d461d21a0bc99e915c6ec03324b8b83d7aab8813c3a1fec67e3f853cbb38348b9ce94182ffa8cf08aee2701caf98bd47ff582162ba0b4f95dc5d7ae11dbf36a73d0722d1d1efd6d8c9034f29898067c52cb951fa443b7f5f974577cc4d7ba334b3ca95f747c73dfc53a212b559c94b9506a622afb3b9cbe83e0dc379fcd498efe16596ef7b86955ac09e862dd9d5cf4a6cccb863c22eb54927d3e2d0aa4873a6f2eace3967c4652fa6859357f35c4600dc0fe275884a0a58fe2cccdbc75c540576751e3f0cbccd8a27ac040f9db292bd94b8cb0ed98d8954882635dfef5909f65550d0d7fbc7250255f8bceaad7e8c8fedb264e071c4851d5e429a96291f0d13e32a59022cd123225c7f3ecc4cc8f64a7edfc3bba8f982f251f8414a6e5759ca4ea59c260202dc2a57ea87e25ae46b756d073bb63b0835c9f5d329cfa5be466851521a8cb92ff0b5aa03d9c560b6f0eab8dad4a7dcc12ed46aef7b0a6a3c4a5d190d100bf91f99d568eb2e5fa4e799bd058b4e2ecfed013f0325775c2bc1d22198426a4ee4858dbce659b8b79c89a3ff524d032ef96e08c86484e6c9b5409dd83b8f475899d9bd909677d98b1f2ad73d47879ab07fe93ba5f4f56b4794e273e2d6b0591a3a121be9dfbeecf18b1684708c7890d4663a940d2565434d706eca5dd24388a5f4ca62ec52504779575891b80669f90eed7c6019b9eb74aa298e29797b980d513c26ccd4ec7e9fddf7ca683ec0c066b851430000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x1320) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:29 executing program 3: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x0) prctl$PR_SET_TSC(0x1a, 0x2) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000000)) r2 = accept(0xffffffffffffff9c, &(0x7f00000001c0)=@nfc, &(0x7f0000000080)=0x80) ioctl$sock_inet_tcp_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000100)) r3 = dup2(r0, r1) fremovexattr(r3, &(0x7f0000000040)=@known='trusted.overlay.opaque\x00') ppoll(&(0x7f0000000240)=[{r2, 0x1000}, {r3, 0x1090}, {r3}, {r2, 0x4000}, {r0, 0xa008}, {r1, 0x4000}, {r1, 0x1}, {r0, 0x400}], 0x8, &(0x7f0000000280), &(0x7f00000002c0)={0x1}, 0x8) 18:18:29 executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc) r1 = socket$inet6(0xa, 0x1a, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000240)={0xfffffffd, {{0xa, 0x0, 0xc33, @mcast1, 0x80000001}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @ipv4={[], [], @empty}}}]}, 0x210) [ 217.223244] binder_alloc: 9962: binder_alloc_buf, no vma [ 217.233948] binder: 9962:9966 transaction failed 29189/-3, size 0-0 line 3135 [ 217.259020] binder: undelivered TRANSACTION_ERROR: 29189 18:18:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000080)={{{@in, @in6=@ipv4={[], [], @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@remote}}, &(0x7f00000001c0)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'ipddp0\x00', 0x0}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000280)={@remote, 0x0}, &(0x7f00000002c0)=0x14) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f00000003c0)={@dev, @multicast2, 0x0}, &(0x7f0000000480)=0xc) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000004c0)={0x0, @multicast2}, &(0x7f0000000500)=0xc) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000540)={0x0, @local, @loopback}, &(0x7f0000000580)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000005c0)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}}}, &(0x7f00000006c0)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000a80)={'bond_slave_1\x00', 0x0}) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1b, &(0x7f0000000c40)={@ipv4={[], [], @multicast1}, 0x0}, &(0x7f0000000c80)=0x14) accept4$packet(0xffffffffffffffff, &(0x7f0000000d00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000d40)=0x14, 0x80800) getpeername$packet(0xffffffffffffffff, &(0x7f0000000e40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000e80)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f0000000ec0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000f00)=0x14) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x27, &(0x7f0000001040)={@rand_addr, @local, 0x0}, &(0x7f0000001080)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000010c0)={{{@in6, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@dev}}, &(0x7f00000011c0)=0xe8) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000001200)={0x0, @multicast2}, &(0x7f0000001240)=0xc) getpeername$packet(0xffffffffffffffff, &(0x7f0000001280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000012c0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000001300)={{{@in=@dev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f0000001400)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001440)={'nr0\x00', 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000001480)={{{@in6=@mcast2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@empty}}, &(0x7f0000001580)=0xe8) accept$packet(0xffffffffffffff9c, &(0x7f0000001b80)={0x11, 0x0, 0x0}, &(0x7f0000001bc0)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000006c80)={'ip_vti0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000006d80)={{{@in=@broadcast, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@empty}}, &(0x7f0000006e80)=0xe8) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000007540)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x45808620}, 0xc, &(0x7f0000007500)={&(0x7f0000006ec0)={0x640, r1, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [{{0x8, 0x1, r2}, {0x174, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r6}}, {0x8}}}]}}, {{0x8, 0x1, r7}, {0x84, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r8}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7fffffff}}, {0x8, 0x6, r9}}}]}}, {{0x8, 0x1, r10}, {0x1ac, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x4d7b496a}}, {0x8, 0x6, r11}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r13}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r14}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x6}}}]}}, {{0x8, 0x1, r15}, {0x16c, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x20}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r16}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r17}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r18}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r19}}}]}}, {{0x8, 0x1, r20}, {0xf4, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x200000}}, {0x8, 0x6, r21}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r22}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r23}}}]}}]}, 0x640}, 0x1, 0x0, 0x0, 0x890}, 0x4) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:29 executing program 0: r0 = socket$inet6(0xa, 0x5, 0x2) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/status\x00', 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0xb3002d84d51f1e75, &(0x7f0000000400)=0x8000, 0x4) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000efffffff000000000000000000000000000000000000000022746984a10a35898109000000000000000000000000000077ef6de279e8bf820ed675121f9b86310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ad0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000333973b3df261bfe802b3671657266e19b00737745527b42b066a83fc5235928ad2dac1f60538c824991bc69db6446547562eb659dfd883e429227d8d10bc1d837b780ec6b86afa2061cf45d9a45ba7bf9f02354fdf68d4bce77dae3584d06c65dd97fdf2c7987abe108dd5a4ae3b980488cf2403ea397e896ec3f0c0440840f86338b66714b564ad3ec4f9a3809cca0ebe18304c616a5ff820668b3d1f658e51a44825dd2e80cf1d12b089043995cde93ad368b86ffd5e120dd442facfb8babdf83d615f652bd97acc7f58361d114758f4d92ecb6861506ab0db6adc802b4a0f15dd339f4d281cd4a75216f09e4709501aeac"], 0x210) r2 = open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x20) unlinkat(r2, &(0x7f0000000040)='./file0\x00', 0x0) [ 217.320585] binder_alloc: 9983: binder_alloc_buf, no vma [ 217.346928] binder: 9983:9987 transaction failed 29189/-3, size 0-0 line 3135 18:18:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 217.380519] binder: undelivered TRANSACTION_ERROR: 29189 [ 217.474288] binder_alloc: 10001: binder_alloc_buf, no vma [ 217.484339] binder: 10001:10007 transaction failed 29189/-3, size 0-0 line 3135 [ 217.508345] binder: undelivered TRANSACTION_ERROR: 29189 [ 217.564215] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=9998 comm=syz-executor4 [ 217.631919] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=9998 comm=syz-executor4 18:18:30 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000a00)='./bus\x00', 0x0) keyctl$join(0x1, &(0x7f0000000040)={'syz', 0x0}) ioctl$PIO_SCRNMAP(r2, 0x4b41, &(0x7f0000000300)="1e676207476db568377f379d023b540a0c52a56d81378d5442330670d37e9632ffc3f8746e898c1e2aaf7bea29974b1365beca9d47f677c40822999bc15a937a8b22009fffe61aaa52d1ec457c844d5a2721ed6e6a2ea194f04cf98688cf363d468520ca5293e8c3e7c2e5a8dee5c45ea90e7e12d636fc5119c4db3614b4dc445e300d68d1dab895fb3a9d89b8a90734f7b85c487e9ab6ed5bebf1b4b4e91629d38e1942cc91b66dc0b98d668e2ed46db03f2ca3c413916bfb0b3297887a9da82d4a7efd691578e04e1c57e7d9284715") fcntl$setstatus(r2, 0x4, 0x8000000000044000) io_setup(0xb, &(0x7f0000000240)=0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000004c0)={&(0x7f0000000480)='./bus\x00', r2}, 0x10) lsetxattr$security_ima(&(0x7f0000000080)='./bus\x00', &(0x7f0000000200)='security.ima\x00', &(0x7f0000000740)=ANY=[@ANYBLOB="05010a000000000300bf42e17c6771d6820e682a3690ab8f249c12118088896cd302927e23d9a92266a52d8709ccfa16a0dc35ea830781eeead7b71066d8c428fc383fd98ba7bd92229a4d9f5d4190b4dfd64fce00ae0f80877ba6f0c42a741abbbd7ceb5be9baaa1d9c32afda5447128a2cef0cc4808f5f90fce1d11edf487b55e7ff6c666ee71b61fd9bec12142e3d835907e51dc15c71cc685d9ffe4813617f198f8c7bf0a91d5be593f4338a81748b11152d8bbab263fdd9f5609d87bbceecc667e2018c52f70e309907c0cb3cd251840d114b526dae8c9f17e054d03e6460e7adafe604688d9b3fe27f1155822ab1d9a4473fcf954b49adf3cc7cbf65e5af27a6c09c386d9ad8cca411874909f1f78aadf637a5e2054766f0bcd8180ff62a659e62d808f38c74bc75e6ec423fddc90515f8dd9ee61c7b8afdaf2b08669df726b4abdbfbc304f0ac5ec5a46dc7516464e1f4e02a84669c7fd234e98045dacade272a8a01203234b30cbfa471127b11aeb17df7d0b154ed15d4cc12d85fea804fd0fe966d3c5dd59739babf357305c77a28d5a9f2bf88bb359b632e9c7c28d235a7d13c167357531ec0884aa871e2635a75499afd43bbd0de03e379a125643b9f179d60ce308f3dfe1a8ac0eeb950231788b25d00000000000000000000"], 0x1, 0x3) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000005c0)={r2, r2, 0x1, 0x3}, 0x10) ioctl$ION_IOC_HEAP_QUERY(r2, 0xc0184908, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000400)}) fsetxattr$security_smack_transmute(r1, &(0x7f0000000500)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000580)='TRUE', 0x4, 0x0) lstat(&(0x7f0000000140)='./bus\x00', &(0x7f0000000280)) ioctl$EXT4_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000100)=0xfffffffffffffffe) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x10000, 0x407000}]) lseek(0xffffffffffffffff, 0x0, 0x4) ptrace$cont(0x1f, 0x0, 0x0, 0x51e) lsetxattr$security_capability(&(0x7f0000000000)='./bus\x00', &(0x7f0000000940)='security.capability\x00', &(0x7f0000000980)=@v1={0x1000000, [{0x800, 0x4}]}, 0xc, 0x2) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000600)={{{@in6=@remote, @in=@loopback}}, {{@in6=@mcast2}, 0x0, @in=@broadcast}}, &(0x7f0000000700)=0xe8) 18:18:30 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) r1 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0x0) r2 = add_key(&(0x7f0000000080)='id_legacy\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="9b13c148c51b0da943a8d459e98badcc320b0c9aada8049a08a836ce94863323b6f65c2f0b34404844f7a7b375c67c5344ff28c732afe673a0a0a9464c20690c34b8de7d89c528720a2651e412a8a91ee7e865095c6869239e69a784507a6a9946c36ea67cae757ab216c72336045c26af61a2c7ab4575495639f3f1ffab43909d8e57f9f18835cfe861c95910590f5308327c485b83310cd283ab92031648ed819fcff5136f0864b1900e", 0xab, 0xfffffffffffffffb) keyctl$reject(0x13, r1, 0x4, 0x3, r2) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) 18:18:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:30 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) write$selinux_context(r1, &(0x7f0000000140)='system_u:object_r:user_cron_spool_t:s0\x00', 0xffffffffffffff3c) prctl$PR_SET_KEEPCAPS(0x8, 0x1) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x30}}, 0x0) 18:18:30 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fremovexattr(r0, &(0x7f0000000000)=@known='user.syz\x00') r1 = socket$netlink(0x10, 0x3, 0xa) r2 = socket$netlink(0x10, 0x3, 0x8000000000000004) r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200800, 0x0) ioctl$BLKTRACETEARDOWN(r3, 0x1276, 0x0) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000000080)) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:30 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)="68756765746c04000000000000006167655f69725f5aa2f4657300", 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cgroup.events\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000140)={0x8}) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000001300)={0x0, r0}) openat$cgroup_subtree(r0, &(0x7f0000000000)='cgroup.subtree_control\x00', 0x2, 0x0) 18:18:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 218.093209] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 218.101540] binder: 10032:10037 transaction failed 29189/-22, size 0-0 line 3012 [ 218.101931] binder: undelivered TRANSACTION_ERROR: 29189 18:18:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:30 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x30, 0x0, &(0x7f0000000580)=0xfffffffffffffef0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x30000, 0x0) ioctl$PIO_FONTX(r1, 0x4b6c, &(0x7f0000000040)="6d2f9814bf62268c7de74af07124488074342303b4a8f378ea0c6ba56a3519e16b55bafae5c072458b249fdf2dba24f2b662281fed48102c9f9391811496656a1f7ab405d679368a5ef27b76cc17670fbc13cfc0b890c5f7c5de6f76360a887b9d336670b3c5ba4306798581eb3f078d60f6687b96a4b7cb4bc9f0fc967ef1c7ec0aeaafb80b707f8eb84612ddd11cc28a2566f6700b79d75a1ff7b8657013") [ 218.122397] audit: type=1400 audit(1544897910.619:78): avc: denied { ioctl } for pid=10030 comm="syz-executor4" path="socket:[24444]" dev="sockfs" ino=24444 ioctlcmd=0x4c05 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1 [ 218.140931] binder: 10043:10044 transaction failed 29189/-22, size 0-0 line 3012 [ 218.141205] binder: undelivered TRANSACTION_ERROR: 29189 [ 218.172513] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 18:18:30 executing program 0: r0 = memfd_create(&(0x7f0000000000)='vboxnet0wlan1\x00', 0x2) ioctl$TIOCEXCL(r0, 0x540c) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000080), 0x4) r1 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) 18:18:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = request_key(&(0x7f0000000080)='cifs.idmap\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000100)='system^\x00', 0xfffffffffffffff8) r1 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$unlink(0x9, r0, r1) r2 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000000)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x3f}], 0x1) 18:18:30 executing program 3: syz_genetlink_get_family_id$team(&(0x7f0000000000)='team\x00') syz_genetlink_get_family_id$nbd(0x0) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x5, &(0x7f0000000200)) seccomp(0x1, 0x0, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) ioctl$sock_SIOCGIFBR(0xffffffffffffffff, 0x8940, 0x0) [ 218.204998] binder: 10049:10053 transaction failed 29189/-22, size 0-0 line 3012 [ 218.219115] audit: type=1400 audit(1544897910.709:79): avc: denied { getopt } for pid=10035 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 18:18:30 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/checkreqprot\x00', 0x400003, 0x0) ioctl$KDGKBTYPE(r2, 0x4b33, &(0x7f0000000380)) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x10000000000, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000003c0)=0x33, 0x4) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000480)) connect$inet(r1, &(0x7f0000000440), 0xfd27) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000080)={0x750, {0x2, 0xfffffffffffffffe, @dev={0xac, 0x14, 0x14, 0x17}}, {0x2, 0x0, @remote}, {0x2, 0x4e24, @broadcast}, 0x282, 0x0, 0x2, 0x46a, 0x8, 0x0, 0x1000, 0x0, 0x3}) sendmmsg(r3, &(0x7f0000003740), 0x400031b, 0xfffffffffffffffd) ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000002c0)) ioctl$SNDRV_TIMER_IOCTL_STOP(r2, 0x54a1) ioctl$KDDELIO(r2, 0x4b35, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x3c7}}, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000048c0)={{{@in6=@remote, @in6=@ipv4={[], [], @remote}}}, {{@in6=@remote}}}, &(0x7f00000049c0)=0xe8) unshare(0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) recvmmsg(r4, &(0x7f0000000f00), 0x0, 0x0, &(0x7f0000000300)={0x0, 0x1c9c380}) sendmmsg(0xffffffffffffffff, &(0x7f0000007740)=[{{0x0, 0x0, &(0x7f0000007700)=[{&(0x7f0000007640)="e6009802b95827a0d242b77a65f6eae95efd768b7a8cf10c75bf0651005d487cdfaaafa64e800103865219011fa63f5eb5b66d5cc750deb26450f4955b072afa466c474eafd301a89cd3cbfd806f790079aab5da6deeadb9cb24ce20b507440af006b499466b800443b4c023c2ec14444ba7a1902b4d5e7630ae9b2acfc8c8cce23f492fc9ccaa9c23e18b52fa9287acae083ec956efe01d4a7d6c4bd4236f387f93b92e7ed6565ad77399871948234fb17127", 0xb3}], 0x1}, 0xff}], 0x1, 0x0) sched_setaffinity(0x0, 0xffffffffffffffbc, &(0x7f0000000500)=0x6) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000540), 0xc) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f0000000100)='threaded\x00', 0x9) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000280)) ioctl$BLKROGET(r5, 0x125e, &(0x7f0000000040)) getsockopt$inet_tcp_int(r5, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000340)=0x4) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000040)={'syz_tun\x00'}) 18:18:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00'}, 0x10) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:30 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:30 executing program 0: r0 = socket$inet6(0xa, 0x80000, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) write$P9_RLERROR(r1, &(0x7f0000000080)={0x34, 0x7, 0x1, {0x2b, "405c2f4076626f786e657431766d6e6574303a706f7369785f61636c5f6163636573736367726f7570cc40"}}, 0x34) keyctl$join(0x1, &(0x7f0000000000)={'syz', 0x1}) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x210) [ 218.258110] binder: undelivered TRANSACTION_ERROR: 29189 18:18:30 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') 18:18:30 executing program 2: r0 = memfd_create(&(0x7f000003affa)='posix_acl_access{Y\x00', 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x200000d, 0x11, r0, 0x0) getsockopt$inet_udp_int(r0, 0x11, 0x6f, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000040)={0x1, 0x6, 0x99, 0x8, 0xffff}) fchmod(r0, 0x2) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000340)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r1, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}]}, 0x1c}}, 0x4) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000080)) write$tun(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="68d5c58d9b1572444b7ff5b84d59258c0b6353220e49accbd3f37bb8b87232895aa4de66ab952ce50f4a0ad04fb3c685a45ce394dfb70e81fb212058b383b6332edbbd92c23a78b5cad0b868676c15b187cf1fcef1c0672510abe70513f3a32ec69480b912bd87a7b969d232676b2214f67bd33731bd68a7e3bf8fff7dbeae078103446ef84fc312491e044827bf9f880acc7d49d5f1d877c955697dd8cbf53790437391efae8e5f200c671ebf338848ee35e03b88ade42eb21140c08f8fa94dd431c0434a738a9b9043034c634ea1ae998d35c421909d44f8dc28653cd0050a0cd51608679e9fb2096010b84e97aa"], 0x1) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f00000002c0)=0x0) capset(&(0x7f0000000180)={0x20080522, r2}, &(0x7f0000000000)={0x0, 0xfffffffffffffffc}) ioctl$TCGETS(r0, 0x5401, &(0x7f00000000c0)) 18:18:30 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x12) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x2a) 18:18:30 executing program 0: r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x400000, 0x0) ioctl$TCXONC(r0, 0x540a, 0x9) r1 = socket$inet6(0xa, 0x80001, 0x0) ioctl$UI_GET_VERSION(r0, 0x8004552d, &(0x7f0000000040)) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) ioctl$TIOCSTI(r1, 0x5412, 0x20) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) 18:18:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xc, 0x3, &(0x7f00000004c0)=ANY=[@ANYBLOB="85000000290000009c0000000000000095000000000000004cf17ef8f48c1fbccd538a4370606da925dee7a9a973209351f2435e12b5021328979db0cdd276c33de0542010bde4399bdfbefe796114c7ce623fdec46ec5009cf2d7f15155d5bdd4ee43ac463b159451b43cce0e5277c4a31731d41995cb71a1c540536f4d9a268cef0eee4d1c62c205aca01b531495857a3c91f8caea0b14b63ec5ce2294ebc04941b01fce683851e5d0dc6d90cdf23cbf30a698d46ae8e8d5fae2104c26c8d6b3d4481a065f635d0eb1539c887c44d3c102d0a3"], &(0x7f00000002c0)='syzkaller\x00', 0x1, 0xcf, &(0x7f0000000340)=""/207}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000000)="6a48373dea8c0000000020000000", 0x0, 0xf000}, 0x28) 18:18:31 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/checkreqprot\x00', 0x400003, 0x0) ioctl$KDGKBTYPE(r2, 0x4b33, &(0x7f0000000380)) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x10000000000, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000003c0)=0x33, 0x4) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000480)) connect$inet(r1, &(0x7f0000000440), 0xfd27) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000080)={0x750, {0x2, 0xfffffffffffffffe, @dev={0xac, 0x14, 0x14, 0x17}}, {0x2, 0x0, @remote}, {0x2, 0x4e24, @broadcast}, 0x282, 0x0, 0x2, 0x46a, 0x8, 0x0, 0x1000, 0x0, 0x3}) sendmmsg(r3, &(0x7f0000003740), 0x400031b, 0xfffffffffffffffd) ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000002c0)) ioctl$SNDRV_TIMER_IOCTL_STOP(r2, 0x54a1) ioctl$KDDELIO(r2, 0x4b35, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x3c7}}, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000048c0)={{{@in6=@remote, @in6=@ipv4={[], [], @remote}}}, {{@in6=@remote}}}, &(0x7f00000049c0)=0xe8) unshare(0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) recvmmsg(r4, &(0x7f0000000f00), 0x0, 0x0, &(0x7f0000000300)={0x0, 0x1c9c380}) sendmmsg(0xffffffffffffffff, &(0x7f0000007740)=[{{0x0, 0x0, &(0x7f0000007700)=[{&(0x7f0000007640)="e6009802b95827a0d242b77a65f6eae95efd768b7a8cf10c75bf0651005d487cdfaaafa64e800103865219011fa63f5eb5b66d5cc750deb26450f4955b072afa466c474eafd301a89cd3cbfd806f790079aab5da6deeadb9cb24ce20b507440af006b499466b800443b4c023c2ec14444ba7a1902b4d5e7630ae9b2acfc8c8cce23f492fc9ccaa9c23e18b52fa9287acae083ec956efe01d4a7d6c4bd4236f387f93b92e7ed6565ad77399871948234fb17127", 0xb3}], 0x1}, 0xff}], 0x1, 0x0) sched_setaffinity(0x0, 0xffffffffffffffbc, &(0x7f0000000500)=0x6) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000540), 0xc) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f0000000100)='threaded\x00', 0x9) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000280)) ioctl$BLKROGET(r5, 0x125e, &(0x7f0000000040)) getsockopt$inet_tcp_int(r5, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000340)=0x4) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000040)={'syz_tun\x00'}) 18:18:31 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:31 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)={0x9, {{0xa, 0x0, 0x10000, @mcast1}}, 0x0, 0xb6ffab6f41dcd0d4, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x4e21, 0x0, @mcast1}}]}, 0x210) 18:18:31 executing program 4: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$TIOCGETD(r0, 0x5424, &(0x7f0000000080)) pipe2(&(0x7f0000000040), 0x80000) ioctl$BLKIOOPT(r0, 0x1279, &(0x7f0000000200)) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xd) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x10) writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0xb3}], 0x2cc) 18:18:31 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/checkreqprot\x00', 0x400003, 0x0) ioctl$KDGKBTYPE(r2, 0x4b33, &(0x7f0000000380)) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x10000000000, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000003c0)=0x33, 0x4) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000480)) connect$inet(r1, &(0x7f0000000440), 0xfd27) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000080)={0x750, {0x2, 0xfffffffffffffffe, @dev={0xac, 0x14, 0x14, 0x17}}, {0x2, 0x0, @remote}, {0x2, 0x4e24, @broadcast}, 0x282, 0x0, 0x2, 0x46a, 0x8, 0x0, 0x1000, 0x0, 0x3}) sendmmsg(r3, &(0x7f0000003740), 0x400031b, 0xfffffffffffffffd) ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000002c0)) ioctl$SNDRV_TIMER_IOCTL_STOP(r2, 0x54a1) ioctl$KDDELIO(r2, 0x4b35, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x3c7}}, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000048c0)={{{@in6=@remote, @in6=@ipv4={[], [], @remote}}}, {{@in6=@remote}}}, &(0x7f00000049c0)=0xe8) unshare(0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) recvmmsg(r4, &(0x7f0000000f00), 0x0, 0x0, &(0x7f0000000300)={0x0, 0x1c9c380}) sendmmsg(0xffffffffffffffff, &(0x7f0000007740)=[{{0x0, 0x0, &(0x7f0000007700)=[{&(0x7f0000007640)="e6009802b95827a0d242b77a65f6eae95efd768b7a8cf10c75bf0651005d487cdfaaafa64e800103865219011fa63f5eb5b66d5cc750deb26450f4955b072afa466c474eafd301a89cd3cbfd806f790079aab5da6deeadb9cb24ce20b507440af006b499466b800443b4c023c2ec14444ba7a1902b4d5e7630ae9b2acfc8c8cce23f492fc9ccaa9c23e18b52fa9287acae083ec956efe01d4a7d6c4bd4236f387f93b92e7ed6565ad77399871948234fb17127", 0xb3}], 0x1}, 0xff}], 0x1, 0x0) sched_setaffinity(0x0, 0xffffffffffffffbc, &(0x7f0000000500)=0x6) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000540), 0xc) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f0000000100)='threaded\x00', 0x9) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000280)) ioctl$BLKROGET(r5, 0x125e, &(0x7f0000000040)) getsockopt$inet_tcp_int(r5, 0x6, 0x1, &(0x7f0000000200), &(0x7f0000000340)=0x4) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000040)={'syz_tun\x00'}) 18:18:31 executing program 4: r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000040)={{0x2, 0x4e21, @empty}, {0x306, @local}, 0x3e, {0x2, 0x4e22, @remote}, 'bcsh0\x00'}) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1080040}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="10000000", @ANYRES16=r2, @ANYBLOB="00dc4c88c0c587ffd2b461ea414f78452abd7000fddbdf2512000000"], 0x14}, 0x1, 0x0, 0x0, 0x40011}, 0x24000000) 18:18:31 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c9e75bf3b0742ee90000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000026b03feab6810e7228318ed9eb5e64f96e2d08c5212dc7fc7cfa36dd989ee8e92d7e5de473d52ffab635fc585ac43124fb5607772d084d1c5e47bd8a11c23d84433111dbdec3ef77c6835fc8f130d8ee46cc2bfc0f87b1ddfe9cbfeb8151b9fc2823928a835d914b4c34eaf7ce1a543a75ae00773651f52c19e50e2ff59ba80ff7329d6e17902a3dcdf94f53fec1bfcd6a8f4b8d1956b5489ee60d81831ab3981b0933229ab2c571762a28e613992d7bdc0ce45f24d0482e3073fcbae804a92d3925c4a4fd55980dd833368c72ba620ceefe5d28e4d81210c13726524f4e82143e7a18046d69e8ea6d01db97038692edc17cfe8988c5205e4c640bf44da38293afe9a6f4b9c30b3a380e99a5f313e97895c79b365e3cd8cf92b5f1766c9edc3c772e10fe00cfa244"], 0x210) 18:18:31 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:31 executing program 2: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x1ffc00, 0x0, 0x0, 0x1, 0x120, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, r0, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000680)='/selinux/mls\x00', 0x0, 0x0) r3 = accept$inet(r2, &(0x7f0000000480)={0x2, 0x0, @broadcast}, &(0x7f00000004c0)=0x10) r4 = accept$inet(r3, &(0x7f0000000580)={0x2, 0x0, @loopback}, &(0x7f00000005c0)=0xfffffffffffffc78) getsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0), &(0x7f0000000900)=0x8) r5 = add_key(&(0x7f0000000380)='syzkaller\x00', &(0x7f0000000400)={'syz'}, 0x0, 0x0, 0xfffffffffffffffa) r6 = request_key(0x0, &(0x7f0000000700)={'syz', 0x0}, &(0x7f0000000740)='/proc/thread-self/attr/current\x00', 0xffffffffffffffff) connect(r4, &(0x7f0000000800)=@un=@file={0x1, '.\x00'}, 0x80) accept$inet(r0, &(0x7f0000000180)={0x2, 0x0, @dev}, &(0x7f00000001c0)=0x10) keyctl$search(0xa, r5, &(0x7f0000000440)='rxrpc\x00', &(0x7f0000000500)={'syz', 0x0}, r6) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) open(0x0, 0x200, 0x100) r7 = add_key(&(0x7f0000000780)='cifs.spnego\x00', &(0x7f00000007c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$negate(0xd, r7, 0x100, r5) timer_create(0x1, &(0x7f0000000200)={0x0, 0x1b, 0x4}, &(0x7f0000000240)) mmap(&(0x7f000094f000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r9, &(0x7f00000001c0), 0x100000073) read(r8, &(0x7f0000000200)=""/250, 0x50c7e3e3) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r9, 0x2405, r8) r10 = getpgid(0xffffffffffffffff) perf_event_open(&(0x7f0000000300)={0x4, 0x70, 0x45, 0xe68, 0x3f, 0x2, 0x0, 0x0, 0x30428, 0x9, 0x1, 0x7, 0x0, 0x1, 0xfffffffffffffffe, 0x52286ef9, 0x9, 0x5, 0x5, 0xb8d, 0xb1, 0x1, 0x7fea7b87, 0x4, 0xffffffffffffff00, 0x8, 0x0, 0x93, 0x9, 0x4, 0x3, 0x0, 0xffff, 0x2, 0x4, 0x80000001, 0x0, 0x40, 0x0, 0x73380336, 0x0, @perf_bp={0x0, 0x4}, 0x0, 0x0, 0x0, 0x8, 0x4, 0x0, 0x1}, r10, 0x6, r4, 0x0) ioctl$void(r1, 0x0) getsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000100)=""/54, &(0x7f0000000140)=0x36) 18:18:31 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)="73797a6b610000000500f3", 0x2, 0x1000, &(0x7f0000014000)=""/4096, 0x0, 0x0, [], 0x0, 0xfffffffffffffffc}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x0, 0xe, 0x0, &(0x7f00000000c0)="e46001923406080000000a9b05dd", 0x0, 0xea74}, 0x28) 18:18:31 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:31 executing program 3: r0 = dup(0xffffffffffffffff) fcntl$setpipe(r0, 0x407, 0xda) r1 = open(&(0x7f0000000040)='./file0\x00', 0x8040, 0x0) r2 = open$dir(&(0x7f0000000300)='./file0\x00', 0x0, 0x0) r3 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/load\x00', 0x2, 0x0) r4 = signalfd4(r3, &(0x7f00000000c0)={0x4}, 0x8, 0x80800) pwritev(r4, &(0x7f0000000400)=[{&(0x7f0000000240)="cec23215d219c1f9108ec973ca34c2ffe072ef3f5fd81d2eaa", 0x19}], 0x1, 0x0) ioctl$FS_IOC_FSGETXATTR(r2, 0x801c581f, &(0x7f0000000200)={0x4, 0x0, 0x400, 0x3, 0x5ca6c970}) r5 = socket$packet(0x11, 0x3, 0x300) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x2, 0x722, 0x9, 0x0, 0x0, 0x800, 0x2201, 0xd, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x9, 0x0, 0x0, 0x0, 0x833b, 0x0, 0x4, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x7, 0x40000000000000, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x2}, 0x0, 0x0, 0x2e, 0x0, 0x0, 0xfffffffffffffff7, 0x9}, 0x0, 0x1, 0xffffffffffffffff, 0x1) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) prctl$PR_SET_SECUREBITS(0x1c, 0xb) r7 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pread64(r6, &(0x7f0000000340)=""/39, 0x27, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) msync(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4) dup2(r5, r6) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000004c0)=@newqdisc={0x1ac, 0x24, 0x500, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, {0xe, 0xb}, {0xf, 0xffff}, {0xfffb, 0xf}}, [@qdisc_kind_options=@q_red={{0x8, 0x1, 'red\x00'}, {0x108, 0x2, [@TCA_RED_STAB={0x104, 0x2, "6bae36f2c3093d3655047831efd8f0ce569628ded5dd98ec0e5c7565eeb0e77093780f7295e8c5b48cca31da8c00991366f9a7ce0a52c29bb8611116d1693c3c258baa399ffb0dfa7569a7d02dde7154a5556b29a38fdcde814a182ca06ab11c5daae86653af6414d2f9ab9ae0b2c1816e10f49527c708372151a7273df22a9413c687e487181178b004258f113f17b59d1f9a62408643994f988eaab9a202462adb5ddb1f14ae74b48a181c4d8362676ed34153269deb6361091ca068dbb13a7d7bad4550851da61ea23c55c6f78632174cb3b83c708649d2d613b4ab9d3c264525cc56e6fefd25084ce2e86161da2a957e363085487754de81d4bc3eb766c5"}]}}, @TCA_RATE={0x8, 0x5, {0xfffffffffffffff6}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x6}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x2}, @TCA_STAB={0x58, 0x8, [@TCA_STAB_BASE={0x1c, 0x1, {0x1ff, 0x80000001, 0x80, 0x100000001, 0x1, 0x6518, 0x3, 0x1}}, @TCA_STAB_BASE={0x1c, 0x1, {0xfffffffffffffffe, 0x9, 0xcb, 0x1000, 0x0, 0x10001, 0x100000001, 0xa}}, @TCA_STAB_BASE={0x1c, 0x1, {0x2, 0xa2f, 0x0, 0x0, 0x1, 0xec, 0x40, 0x5}}]}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x5}]}, 0x1ac}}, 0x20008000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$selinux_load(r3, &(0x7f0000000380)=ANY=[@ANYBLOB="6b56ccb2364b36c15a0e9a59ce857c75595c49093d919ea6ad3701900f5ba8deadc520d29d7b67a713d74c5fceeba78684d20517231cecbf6d8dfc7ced2425a61124bb8b221280bf7da5a56232654b4aae358cbd300cb90b12ecc7adc13c1110"], 0x60) fcntl$setlease(r1, 0x400, 0x1) fcntl$setlease(r2, 0x400, 0x0) 18:18:31 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c2628e4e000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000b8d50000000000000000000000a38e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004621dcc76cfbf123f6ba42b000000000000000000800000000000000000000000000000000000000000000"], 0x210) 18:18:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180), 0x0) 18:18:31 executing program 1: geteuid() fstat(0xffffffffffffffff, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, 0x0) setxattr$trusted_overlay_opaque(0x0, 0x0, &(0x7f0000000240)='y\x00', 0x2, 0x0) r0 = creat(0x0, 0x100) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={&(0x7f0000000000), 0xc, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2000000021000101000000000000000002000000000100000000000000000000"], 0x1}}, 0x0) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, &(0x7f0000000040)={0x5}) getsockopt$inet_tcp_int(r0, 0x6, 0x3e, &(0x7f00000000c0), &(0x7f00000005c0)=0x4) dup2(r0, r1) ioctl$LOOP_SET_STATUS(r0, 0x4c02, 0x0) ioctl$int_in(r2, 0x5421, &(0x7f0000000080)=0x80) request_key(&(0x7f0000000300)='ceph\x00', &(0x7f00000003c0)={'syz', 0x0}, &(0x7f0000000400)='rootcontext', 0xfffffffffffffffa) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, &(0x7f0000000480)="60458ffd9cd0cd4f20e6de3b689a1e") mount$bpf(0x0, &(0x7f0000001740)='./file0\x00', &(0x7f0000001780)='bpf\x00', 0x0, &(0x7f00000017c0)={[], [{@rootcontext={'rootcontext', 0x3d, 'staff_u'}}]}) 18:18:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:31 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) sendmsg(r0, &(0x7f00000006c0)={&(0x7f0000000000)=@l2={0x1f, 0x1, {0x3, 0x10001, 0x100000001, 0x100000001, 0x3f, 0xb74}, 0xfffffffffffffffc, 0x8}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000080)="d34129f8e04422bd4fdba34ace9771909d749596915c63b4e42e6732439dedbeb3a74cb384229bcd50f6ffd0e639df38d9242e1cac9414501871b9c8cc29b9dc1ac6f0034e703b01a34810f19975f37453125226e4d84809fbd5fb0defaaf3a74af848450549826d3363af808d120019ce0c65b8e5a55ffb66df2c87dddfc13bdb590089d434c44094125dd4e804206fe960217f1933e2b16cf70223", 0x9c}, {&(0x7f0000000140)="3f9aa0c7cb69ff1bdb5b70038f1c59e9743c42fd17361a0f32ac6f521272f268c0eeb54fe48d8d28b92073b4788dc56c78bb51d92444d3b16378f41b2420a442ac1b865569e032fc1c1c50ecfa66120f482c0d95a2615d36967e072a505126033dd99ab83306da20fc02d2207cffc841eb98fb65bc8264a2b3099b0f8d429cb2c5cb1223960ec7ae59e0fe137561393995cdaadaea219cb3c60a1eef4f23e5fb9f0544b37aa9c6eaca98b658c64950446d7536d02326e9220073192347f573310e285b3c7a0cf7717585d7e1e06c137a3bd67a6b45ffee4e2b9a6c8974248b679927a7409c455860c20754dd8ab0c2b8", 0xf0}, {&(0x7f0000000240)="9127dc24824654d28c76d8566d09595662fc161cba749f2d7300acd7ae109ee704d2c0b6a29d6e0a59aa84d61cf5af755096bd2a2df8aa4136ee49d02f418f816a405afa2c04f697a1c5778e950fbdcb2eb923f0f1cb08bc008a146affb321d01f3ac851518d9f0898948049352b95055afa3085977db702a1315aac1c495eb561242ff8fe17b744824d4a8f9a65455f5bc498b6e2e0993163590cbd93", 0x9d}, {&(0x7f0000000300)="7c2889ddc7a0fe1dda14c26ce204fa5e30595dc8a3f56dfba7242288d04e8b0d4e7e13f3eabe4e55ca9fb67bec17", 0x2e}, {&(0x7f0000000340)="b16848a671dc1664f1df6604cf83bdf2ced770ab56a3ed09257e59d12ee3222df0689abb9e219a3c70ae04c441bd", 0x2e}, {&(0x7f0000000380)="305aa87834c01daab4699fd39a3ca1e0971725258e65c426ebcbcac11bab7c46d55e26b6499a3b63aba07ef809e62d0a1c4223d5011e8ae7bd84f0eb02152e363b1c2594d7d7c913cd0b0c0a9b8f0a3f741f3bc017536b8ac997fe7e70de4a47ed05a25ec20be04f7304aa9953e89c8839e32cacfea397b4ee69be716d921d90143fb843ec0a151323c36c0bffae9aefb257b11e8a6cbd0f13b70756b61e83a098491a5bd5b55584fe4f6aaec419975d5b85f9e3f1ea174027d2b40f12900191b6945f22fd984bf84b25c5aae94440555934efed906fd1c967f8668513145bb1150bfbb00deba4a68d912ccf", 0xec}, {&(0x7f0000000480)="019585ca8c54b7626b5eb7ef9fd9be0d4f8d1b61c5bc11ea6055a9a4ca8670d06cb21b24412f8c8767faf8d714096a60c7c9b918983fb2acb9991ddaf31d5726893d46d3ac8e2b7aa77626dc5473752c2cf86a6d", 0x54}, {&(0x7f0000000500)="92af73241e179242b1748f9cdf2de8b56279d686df59a82db6e763f7658f92a3ca44e037a057d5d2db6164a77a418c360c8d262115498158ba5c3edc819bb7574d1b8b0a5f6ee7be28daba4238638523f85ee45304fb8c69eef5e9de5ca7b62c31349ea9c7c421e4d8a79189152218d6406aeffe028c7fe35460aead1399eb8a7f988a5cfd49146c8a3117", 0x8b}, {&(0x7f00000005c0)="259ec9a6a5676f245f4a69704d584ca73212bd1b5802", 0x16}], 0x9}, 0x84) 18:18:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000400)="48000000140019d00c0ee10d10ee4d0a20ffff7fffffff5602113b850e1de0974881000000de213ee23ffbf510040041feff5aff2b0000000000", 0x3a}], 0x1) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='autogroup\x00') ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)) ioctl$TCSETS(r1, 0x5402, &(0x7f00000000c0)={0x20, 0x0, 0xdfb4, 0x503a6dac, 0x401, 0x7, 0x6, 0x1f, 0xd4be, 0x4, 0x6, 0x3604}) 18:18:31 executing program 1: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vga_arbiter\x00', 0x0, 0x0) clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x1b) ptrace$cont(0x18, r1, 0x0, 0x0) clock_adjtime(0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x12}) openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/relabel\x00', 0x2, 0x0) stat(0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) write$nbd(r0, &(0x7f0000000240)={0x67446698, 0x1, 0x3, 0x4, 0x1, "d74d76fa3dbcb551ee5cf7f2267844baefe26f419ce392f30649d00a75c72f7845417a6824887c373083fb099942fd6ddd825c3a0d0f597f88bcbffb03614d1555f56c0e0547c81c732884043f1bc43a051330a6c69daf0bb416ca2b90554a00d99ffd79c5607cc96c902a79926bc1623745f439a10a0f69591137cdc13aa4c791f2ef6b133dd1e9f6a22d2e68ec6aedcc2e075fadb147087b3aa9163af252e23b8a0d48749d13e0bfbb0f7ff49542a867eac7398a3e8eb9b4fbb7b887f32c3e1310dbe343b4"}, 0xd6) ptrace$cont(0x18, r1, 0x0, 0x0) 18:18:31 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff010400000000000000000000b4000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x210) [ 218.893598] binder_alloc: 10177: binder_alloc_buf, no vma [ 218.917114] binder: 10177:10181 transaction failed 29189/-3, size 0-0 line 3135 [ 218.954068] binder_alloc: 10177: binder_alloc_buf, no vma [ 218.980361] binder: 10177:10189 transaction failed 29189/-3, size 0-0 line 3135 [ 219.008915] binder: undelivered TRANSACTION_ERROR: 29189 [ 219.016087] binder: undelivered TRANSACTION_ERROR: 29189 18:18:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:32 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x3) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)="480000001400190a20ffff7fffffff5602113b850e1de0974881000006fe58a2bc4a03049164643e89720000de213ee23ffbf5101c0041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:32 executing program 0: r0 = socket$inet6(0xa, 0x80004, 0xfffffffffffffffe) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000000), &(0x7f0000000040)=0xc) sendmmsg(r0, &(0x7f0000001140)=[{{&(0x7f0000000080)=@pptp={0x18, 0x2, {0x2, @multicast1}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000100)="490d4dfe891cf4f556c9b610abf9bb035218b0bf8b5ec4dcc799b72da51a1e2fae62d79f62b183b9413f0aa07bf6618315f564f7e0d6103b4e37c66af15ea08b97a96314259e73fb22b7fbcc9c2837a36c2cc5ad33e7d82df825b36f999855751b6b8d43db59113c833e6d0248ce6bdc31fc9e71cf91ff203ab2ed6911726ed2fa3a1cc7ff76d713f022d1d35f5813ca6810713e8253", 0x96}, {&(0x7f00000001c0)="f44401cfd0940a95bc2b63d84118b4c16ef3f88c4fce7aff9bceff77530e660c5c8132add0e174182a4818508a6ae367c29236496b249a", 0x37}, {&(0x7f0000000200)="d40b2138e0544a311d4c6dce040511bb83c475f02efc03afb0f1e72d7e84f1f3b02879c5a142de50ea5802ed4b3dc2e2fd", 0x31}, {&(0x7f0000000240)="9f756e590fba8963e4f610d60717215ca6a21063d3ea9e16132adc56f69337ecef576f10de09fa8e935cdb5a410d20f40e4cf1b32fbe9288a434898400d60dbfc59dc8", 0x43}, {&(0x7f00000002c0)="4b06cd417e0c5a79b43117c66797336cf4fd097ecd916d2775730f3a854cd584e219ad3078aa69c57710698a9fca7861b6b52a050bb7e1aa331622199997406e0dffd8c1ef24fb24a6", 0x49}], 0x5}, 0x80}, {{&(0x7f00000003c0)=@nfc={0x27, 0x1, 0x1, 0x1}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000440)="2da23359f84ff6d6643a0431b21c128d78ac30b201e8a1d2302cde8877a065f7bd7da0831a9593f6509373025229c0a002a92606ae53ed3c6b2dd3e3f019a98d1f1ffa22dbf06cdbe43796ef0923c1f73a2ad74fc677e287dac23b21237fd7660f3dcab451401f403c9c00bf2047330cd1", 0x71}, {&(0x7f00000004c0)="3000c04850263928d640930ad1843f50705832c9722ff9f0a20d4a9c7972098ca5eb969a00ded41658bc15e9fbc5", 0x2e}], 0x2, &(0x7f0000000540)=[{0x38, 0x11f, 0x3, "f850222f8c1dcbeb513aa8f2b3f1efa312c81007170c1b483052a9953f456fc33acb1f6a0297b7ba"}, {0xb0, 0x117, 0x0, "98a250bb40f15da3d1c8e52568bcd5e22cd364bc3e107ddb59d06be3eb39463188aeb1e1a15b411e62b39536a3a282ad11aeb35f1d1c135b10a42a66fa5076173c0aad9f72577aeda7c0b8a4e441d47c81ea3a9e6b077e23814701e9fe47c85bc141e18eee1a67403a56e4d265ef8077cf5e468658817448c3fcf2ec833a730a414977ff5dea9bac44db4b8632942b686ced264a7b4c7c6d8f4c"}, {0xe0, 0x110, 0x8, "87ef01623f6047f721eca0cb86103ebc505a76fdee83e53da1b6134b35598871347fc3660c0aa7d860b19795b7d3134c99435062e2423b232c79262055b7dba8a9b9d0bcec7e376ea36a48242d0f577c445cc4fed8f8676e54a36bd9a476800c2d662c4cd4a4dcda158e7f7cfeccaf68b752735d52a1db46b3b6d5e44b553b0de90914955ff50700e38d55ffbd42f13950ab1abdf8d38cb8a0ee844db5c333c84cf65d8a215be9651a8af5741d45404fd161ecf19f669f63c846df9479e81875dc81ae0bd973f9a5f754d6be3a"}, {0x70, 0x10b, 0x7, "158482010eef7c8ef98840234678efda7b6324a06bc7bfeafb1af27e91fcd84e4ed85b54cb6b15142cf9ce3ab9d8bc1f39280e5428d5a334ef62df6e3e2498dee72a1062c3c13a150b17d25985c845205fc436eab14496532585bf"}], 0x238}, 0xa0}, {{&(0x7f0000000780)=@in={0x2, 0x4e24, @loopback}, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000800)="2a263b1bf81a1103855eae315f467893c1a7816109e9485a98d8d63c84ac6080c2a03ca5c0d9e9d310b5f4b66a9323f7eaa8548fe42e969f854bf1fe763fd3a0d09c90e4ff9cfa043872bd1708fb9a7047ee959ace90f18980329eab22a3853c0724288ca7507ffc99b9f26b8a1dd48f0cbf95fb8fc2bf90c3674cc4cc851bc1c04c4cd5b4edfe8a65aadedc91309b0846e93a441796c85b72f139abffb7062f12bda2dbac159c9c33eba355d5cbda3cdc75745f5c5294e025", 0xb9}, {&(0x7f00000008c0)="338fadd8d5b6a6b37f3477f2bb00d9a61e80f169166ab6312209ca20a894086a43d6aa87322107c16d8d8b1a1c81ba31a49a38412cfbbc96b110206c2782942dda2cab61368faf1ed9c745b29ff788a169f69d6f3d64f3c20afa7d5164cd55cf1e0011ffa3ff63d2bc80e636de7e1678f298f795da4b127025833ff5", 0x7c}, {&(0x7f0000000940)="54680128dacbfdf5edd3349078e1c06e1d779c602858ab453a9dcf59e78270e16082501fc7809f6bd9f7928ec981e8a0f34f8e7c2ab2883056f2d49d53a0769408f90a9ad35bbb274d4e022011319eaeff7aa1696717fb5a36dec8825e7f6dabc269e62f594a38228af03153c02fffaada9a8304bcf34585efd10aa0bdf71d51bde0ca40f7811cc546c0494334", 0x8d}], 0x3}}, {{&(0x7f0000000a40)=@ethernet, 0x80, &(0x7f0000000bc0)=[{&(0x7f0000000ac0)="fbf43e2bf279e0f1b8601a09c41df01defc5d8b977aeb0014aaeb0d2920b5c3595c93aa409ebe6b7b1a48eb169ffd1e305368077cd4ca3db17a801ff8a5b17c1ca774bc645e098e225ea68bb76fcab3cf92e62d4c0de146fe98ed96cfe239f763d2983a9da719f37f6e567e63e856025d561cbca639f5b70b717453bab4b35b92031558b4f93c63e55afd2df4530a140a6fae4e06f020075c23fed27a2582425a0b00e3fcbef2ef02fdca8ad08942dfe9b1c02847bb04b0c7ce4a1a65c229d243f4e423a03a7df59d3d9ccbbd13c85b3", 0xd0}], 0x1, &(0x7f0000000c00)=[{0xe0, 0x10f, 0x8001, "7e1fc00ce01cd22c3f51063a77e988dbdab55a4db6171754097fd9079b93888203ded4e5740dc4e17034b9a5fc4491370196fd84142dbef78780bc8dfafec9efd5f5f5ea761a8a5d16e64ae4bd366131016f0517197e4a43094584b3031e7c0473b30f562e73ff230f8f9abdff64023541bbe16130fb12bbecef0a10507e66ef13a4b694f6c7a082fc75a8f5eeb9554411766bafa59608514716518e69d2b23b5181c2025912bd3437fdc9e43233ec9eb0bda193ef4256d138d20136ac9b00bf41b8f988e0d3d4bcf5a975cca5"}, {0xf0, 0x115, 0x4, "6053746ed1866596e995ffc4f7cd81719e1f410c5d8366ca4014c09f779ae548e27d292cc04f2bb29d0704ddccd817b3b9ca83a9aa3cbc93c1fb5bfb4a73941072c501dca4a7b00cf281e67488b609de6465562a910aa6499303236d45ebe0ce43a2a9f2933812a806fb1e31f047bd37b7ae29db41eb8ca4d96373dab1e930fb095c67b7a442010ef342fc41668733dec50a8c4d7acb77b99d3e1797dad0445af535524fe10072a535fd2a80e6d4db11ecca1b06f8cf2e419c55b4eb5d2e43a7c9ea30ac483b014aeeea0d4c1a749b8b4db9f5d5c8ba8d3ab6b871d1f8"}, {0x68, 0x112, 0x7, "4049f5b616fc84e67388257bbba08e773358d8f9eea38db966f542be4bcf1674ef452f0e414142205a2a145638db550f0bc5bbbef6cb8e5a6cdce15537864808ce9c846046152bc62dac86372cfb0b067fcdf344"}, {0xe0, 0x0, 0x1000000, "4d95e1b962ab693a1562c201a1a1a98aad3cdd0a8d9ee8f9046754ebe14af7d0ed2d436dd35265a74993c027177c76ae6475975bc4ff76a938279028d290e4af34ba3771578333e79205022849ad6ef21b2c8aeacef7568e1d9f4b33ce8a6654155f003ba01deb7c4edd083b65690bf4dd4403dd37942705fb019a08744bd793f3cef830724baad6d448cd04dfd17b910571627bef59136334f2e5ce57ff7989ccd90a3f296b802727034f20fe6477f6fcb9427f3772f85eb5e18543116bc6b0dff59947eb9ea438838107773e34f3c5"}, {0xa0, 0x18e, 0x20, "6abfe2be000c40b9cee76d29111953016a7a3cbb3a351ee7a81a09847dbe092d32b8a1808c34fcfb709e0eafd41e25803d750666f878faf153c6f2c21676107230ef4326730a5195b67a7505742ceda77a37b86e572d72ca008c92753e50433dc6da17129e60a1cb4ec1ebe05bab7b3a216bc87b32cc53cea67ba278c829265216a2271e0bd1437f0d97"}, {0xe8, 0x11f, 0x7, "5d1c21abe558fc4306864bfefb69846fc233b949314f8cc31f98a75ca44cfd9306cf52296c9775bd921465a57731bf9a9713b7f05ba479450086764856c145516c81f884724e457768a2ef3fa9b758cd3ac6ce505e186496df2092effcd7fcd37b2a4af1a8eb7c2fc64e1b2f968d9f208c72051c71323545f8fa987672de39491ee45cfeed524f56abc431715131a3cd1ca32e00395f97a565107a797ad889b5d793506e20ed3bf42dba357439b93d12aef007194f5166823cb4fee56ad6e0ef2257565babb336af49d33dcf9d439e912e3819ac6a4c"}, {0x70, 0x118, 0x2, "0628d9145c651d4b87b64d82dedd368de3093ea41a69d3b0ff538032aba9ba3c8474ece7e5fb81c9089f3dccc557c5b4ac6a1e4438285c0761b99ee10ffe7113bc96525b8bd916ffc07d570affe0d7348f9909f79bd6da8991e91cff349cce"}], 0x510}, 0x9}], 0x4, 0x80) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000001240)='/selinux/mls\x00', 0x0, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f00000012c0)={'filter\x00', 0x7, 0x4, 0x4a0, 0x140, 0x140, 0x278, 0x3b8, 0x3b8, 0x3b8, 0x4, &(0x7f0000001280), {[{{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @loopback, @dev={0xac, 0x14, 0x14, 0x20}, 0x2, 0xffffffff}}}, {{@uncond, 0xf0, 0x138}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x8, 'syz0\x00', 0x2}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, @mac=@remote, @local, @rand_addr=0x6, 0x0, 0x1}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f0) 18:18:32 executing program 2: r0 = dup(0xffffffffffffffff) fcntl$setpipe(r0, 0x407, 0xda) r1 = open(&(0x7f0000000040)='./file0\x00', 0x8040, 0x0) r2 = open$dir(&(0x7f0000000300)='./file0\x00', 0x0, 0x0) r3 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/load\x00', 0x2, 0x0) r4 = signalfd4(r3, &(0x7f00000000c0)={0x4}, 0x8, 0x80800) pwritev(r4, &(0x7f0000000400)=[{&(0x7f0000000240)="cec23215d219c1f9108ec973ca34c2ffe072ef3f5fd81d2eaa", 0x19}], 0x1, 0x0) ioctl$FS_IOC_FSGETXATTR(r2, 0x801c581f, &(0x7f0000000200)={0x4, 0x0, 0x400, 0x3, 0x5ca6c970}) r5 = socket$packet(0x11, 0x3, 0x300) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x2, 0x722, 0x9, 0x0, 0x0, 0x800, 0x2201, 0xd, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x9, 0x0, 0x0, 0x0, 0x833b, 0x0, 0x4, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x7, 0x40000000000000, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x2}, 0x0, 0x0, 0x2e, 0x0, 0x0, 0xfffffffffffffff7, 0x9}, 0x0, 0x1, 0xffffffffffffffff, 0x1) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) prctl$PR_SET_SECUREBITS(0x1c, 0xb) r7 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pread64(r6, &(0x7f0000000340)=""/39, 0x27, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) msync(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4) dup2(r5, r6) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000004c0)=@newqdisc={0x1ac, 0x24, 0x500, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, {0xe, 0xb}, {0xf, 0xffff}, {0xfffb, 0xf}}, [@qdisc_kind_options=@q_red={{0x8, 0x1, 'red\x00'}, {0x108, 0x2, [@TCA_RED_STAB={0x104, 0x2, "6bae36f2c3093d3655047831efd8f0ce569628ded5dd98ec0e5c7565eeb0e77093780f7295e8c5b48cca31da8c00991366f9a7ce0a52c29bb8611116d1693c3c258baa399ffb0dfa7569a7d02dde7154a5556b29a38fdcde814a182ca06ab11c5daae86653af6414d2f9ab9ae0b2c1816e10f49527c708372151a7273df22a9413c687e487181178b004258f113f17b59d1f9a62408643994f988eaab9a202462adb5ddb1f14ae74b48a181c4d8362676ed34153269deb6361091ca068dbb13a7d7bad4550851da61ea23c55c6f78632174cb3b83c708649d2d613b4ab9d3c264525cc56e6fefd25084ce2e86161da2a957e363085487754de81d4bc3eb766c5"}]}}, @TCA_RATE={0x8, 0x5, {0xfffffffffffffff6}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x6}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x2}, @TCA_STAB={0x58, 0x8, [@TCA_STAB_BASE={0x1c, 0x1, {0x1ff, 0x80000001, 0x80, 0x100000001, 0x1, 0x6518, 0x3, 0x1}}, @TCA_STAB_BASE={0x1c, 0x1, {0xfffffffffffffffe, 0x9, 0xcb, 0x1000, 0x0, 0x10001, 0x100000001, 0xa}}, @TCA_STAB_BASE={0x1c, 0x1, {0x2, 0xa2f, 0x0, 0x0, 0x1, 0xec, 0x40, 0x5}}]}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x5}]}, 0x1ac}}, 0x20008000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$selinux_load(r3, &(0x7f0000000380)=ANY=[@ANYBLOB="6b56ccb2364b36c15a0e9a59ce857c75595c49093d919ea6ad3701900f5ba8deadc520d29d7b67a713d74c5fceeba78684d20517231cecbf6d8dfc7ced2425a61124bb8b221280bf7da5a56232654b4aae358cbd300cb90b12ecc7adc13c1110"], 0x60) fcntl$setlease(r1, 0x400, 0x1) fcntl$setlease(r2, 0x400, 0x0) 18:18:32 executing program 3: r0 = dup(0xffffffffffffffff) fcntl$setpipe(r0, 0x407, 0xda) r1 = open(&(0x7f0000000040)='./file0\x00', 0x8040, 0x0) r2 = open$dir(&(0x7f0000000300)='./file0\x00', 0x0, 0x0) r3 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/load\x00', 0x2, 0x0) r4 = signalfd4(r3, &(0x7f00000000c0)={0x4}, 0x8, 0x80800) pwritev(r4, &(0x7f0000000400)=[{&(0x7f0000000240)="cec23215d219c1f9108ec973ca34c2ffe072ef3f5fd81d2eaa", 0x19}], 0x1, 0x0) ioctl$FS_IOC_FSGETXATTR(r2, 0x801c581f, &(0x7f0000000200)={0x4, 0x0, 0x400, 0x3, 0x5ca6c970}) r5 = socket$packet(0x11, 0x3, 0x300) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x2, 0x722, 0x9, 0x0, 0x0, 0x800, 0x2201, 0xd, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x9, 0x0, 0x0, 0x0, 0x833b, 0x0, 0x4, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x7, 0x40000000000000, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x2}, 0x0, 0x0, 0x2e, 0x0, 0x0, 0xfffffffffffffff7, 0x9}, 0x0, 0x1, 0xffffffffffffffff, 0x1) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) prctl$PR_SET_SECUREBITS(0x1c, 0xb) r7 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pread64(r6, &(0x7f0000000340)=""/39, 0x27, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) msync(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4) dup2(r5, r6) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000004c0)=@newqdisc={0x1ac, 0x24, 0x500, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, {0xe, 0xb}, {0xf, 0xffff}, {0xfffb, 0xf}}, [@qdisc_kind_options=@q_red={{0x8, 0x1, 'red\x00'}, {0x108, 0x2, [@TCA_RED_STAB={0x104, 0x2, "6bae36f2c3093d3655047831efd8f0ce569628ded5dd98ec0e5c7565eeb0e77093780f7295e8c5b48cca31da8c00991366f9a7ce0a52c29bb8611116d1693c3c258baa399ffb0dfa7569a7d02dde7154a5556b29a38fdcde814a182ca06ab11c5daae86653af6414d2f9ab9ae0b2c1816e10f49527c708372151a7273df22a9413c687e487181178b004258f113f17b59d1f9a62408643994f988eaab9a202462adb5ddb1f14ae74b48a181c4d8362676ed34153269deb6361091ca068dbb13a7d7bad4550851da61ea23c55c6f78632174cb3b83c708649d2d613b4ab9d3c264525cc56e6fefd25084ce2e86161da2a957e363085487754de81d4bc3eb766c5"}]}}, @TCA_RATE={0x8, 0x5, {0xfffffffffffffff6}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x6}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x2}, @TCA_STAB={0x58, 0x8, [@TCA_STAB_BASE={0x1c, 0x1, {0x1ff, 0x80000001, 0x80, 0x100000001, 0x1, 0x6518, 0x3, 0x1}}, @TCA_STAB_BASE={0x1c, 0x1, {0xfffffffffffffffe, 0x9, 0xcb, 0x1000, 0x0, 0x10001, 0x100000001, 0xa}}, @TCA_STAB_BASE={0x1c, 0x1, {0x2, 0xa2f, 0x0, 0x0, 0x1, 0xec, 0x40, 0x5}}]}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x5}]}, 0x1ac}}, 0x20008000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$selinux_load(r3, &(0x7f0000000380)=ANY=[@ANYBLOB="6b56ccb2364b36c15a0e9a59ce857c75595c49093d919ea6ad3701900f5ba8deadc520d29d7b67a713d74c5fceeba78684d20517231cecbf6d8dfc7ced2425a61124bb8b221280bf7da5a56232654b4aae358cbd300cb90b12ecc7adc13c1110"], 0x60) fcntl$setlease(r1, 0x400, 0x1) fcntl$setlease(r2, 0x400, 0x0) 18:18:32 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) write$P9_RWALK(r0, &(0x7f0000000000)={0x30, 0x6f, 0x1, {0x3, [{0x40, 0x2, 0x6}, {0x4, 0x0, 0x8}, {0x40, 0x3, 0x7}]}}, 0x30) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x0, 0x0) r2 = getuid() fsetxattr$system_posix_acl(r1, &(0x7f0000001500)='system.posix_acl_default\x00', &(0x7f0000001540)={{}, {0x1, 0x3}, [{0x2, 0x7, r2}, {0x2, 0x5, r2}, {0x2, 0x0, r2}, {0x2, 0x2, r2}, {0x2, 0x2, r2}, {0x2, 0x2, r2}, {0x2, 0x2, r2}, {0x2, 0x7, r2}, {0x2, 0x1, r2}], {0x4, 0x1}, [], {0x10, 0x1}}, 0x6c, 0x1) fstat(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RAUTH(r1, &(0x7f00000014c0)={0x14, 0x67, 0x2, {0x44, 0x1, 0x4}}, 0x14) r4 = geteuid() ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000140)=0x0) sendmsg$nl_netfilter(r1, &(0x7f0000001480)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800002}, 0xc, &(0x7f0000001440)={&(0x7f0000000180)={0x129c, 0xb, 0x0, 0x300, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x8}, [@generic="0714376b89f989", @generic="7eb03211d221c128f12cb90728d0771cdb57d83d94cf809533f3ec96052124ca199bb05021a3b7eac149a9076a7a9058407f88881d009227f9ccf10b35f551393ab4a06e729bc139e00f9706cf413d494489e6ca629b019430bc87954b9083284472e145f176a9a9dcb1edff2ded203c17c91e7df34558d096ef972def543d14f28c3881d0b47b1f43798e3da2da0599063696cf2ddd97bb1eb41ffd7127ea5e6cc3acb94b56c2fd03c9741d765fa39152095cc9b2ef374d3de5185f3fae18dd5191916546ce20beda887cc3917fb416e13844dee5a46c915e4054415e5e13dd2e930e50d50cc6085145d4fedc333dd6b3f37a588bc7e2cca868898323de8b10d0e8adbdd31324539beeb80bd7670ee09288efd62c3cf5712844adecb3d28ab3a14f43c0228f51499ed231b95c5de6d97683b9f4894900bf4b7ae88b1668eca315d7d2e314f71791e87623fb0b15cd85c9d3be980949754bcbca2c963a6c10fd267e6c2d51dc5dfa22d4be49adb1d2c1bb73e89fa4dff3eccc981c6d2601bedd91e69eedbf8e7b0429fac8e8322bfaebe50ed567ab94d7f8a1e4a358492b84f66c19a8d72b48c853bc3eb659c0541af0beb930b114aebc0b4912b6b8855aa932e901ac430a1ef047c4d8e571c658ce29eb886f9df5e9e1d3fefcfac13b8b665e3aab49b1426b7d28b7c33b094d8382b8a58ce077c083b8e4b93d49e270cab82a8f4da53130415f61d48e2ebdc3777a440ee5c05bf055f97f15290bfe06b1369834685444f15718f9116bbda129b011fb6b9ac9a4d3f5314d4a5fdfc6b3947eac1bb662158a06af23a1c34625cdc732ab77be4e80eb1c0b4efc726facd35dc44b36fce591bacb72677784d15467b288eb54ffbb00fdd17290ee0f6bc46ad17bec5c6cc409435bcab436769f87e8b65afe5c196ebbee52b675d01a06fddd836434a0867d48026dcdb80739eb739a8674c98053e40a722ddcf81043d301e9437c5e63a0fe2228bd5798bc3712e4a5a697c1fc087e9f8962ee86365c06d4c5046dc0b6230940517108244d8c3a9c9c40246c95d17a768eda279cdcd7c1ad3137e2ee7c52452bce8381bcad2e5ac042145b0a34ec175820678f9d47eded6e6cdb54cbd5a04b07291014d40892ed9d7ebac718d078463ae85de8773965ac1c003c8e3f8e7aeb9eb09afe83921e5ebcfaf16b319f950eeedc6cd2588b2b476a0359d80294257c22940f6fa73db47e4713e13d56d425d211cdaf3c9aab24708526f166293b98bfde904e1b10631fc8c72151abf26f15614d53431b152f1e01b6f0d45a6fd52efd83b305e49fecf4151113aa092e085f1e869178b8988233cf25dfaa839a47ed8136e7d028ffcdce8c81b3bc0438d24b40a2011caa2430d9a538e6638328a79af53e2e05671781ff4438ffc0f052cf8c8ab5d42969aa09f1e583c8203791863ea8a6be572de3da933081014c28a0a8ac035ada8b8ecbce64e6e01aec47450ce12f217611ae54762c5eb4c73a053f53453d40f00be412d002532929e41802c31a2989a66585a03a756ffaa082f534cc6ef2ab21697fb8c1dc01cf86b21bfb7f45c63e303ccea6e6bae80ae17e9ee6e755806c778e8f84d148b384f84a7971be2969c368e5a84e0569c69a3637edd1c4043c93d4c29b657042e67c5ca0fdc6a9d22beb530366bcd97543cf7e2280d22e24aee89fbe54e0115ca0e86fd7f63f2aedf0d85103df301d548836d86796d89903ed7e075a60160e3892f7532fa961a4965583fecbd1e09ad0618def4062df421656e490e47a383187fc21bc64f590d84cd48d22a2e271e3f4647f0a3ceab7e56b491bd49b503d27ae941ac57dab8b41a6cf2c1831234a03e1488c86b1ad434d8a80b8846597e5b07d0123b834fbbc635d858fb1f930319e0a9fef694d51aed33e90b863cd026277fb22a13282717186119ac12ea3252de61b9c43e3e2bd50e7979ee7a6bfda1693d42955e635497486325ca97c8c629716bfe5313ec0634aea05645121505ce2b4b286c6d7c4777c4bafa2ed2dd3462e84cffee06dc8d19d5cb7c10758265bf2e720df4729562414f7aa4642f80f6692958fa3b4caac2dca64fdfebd888e9e8b548edaaf283e91d17058e17ecc226ac336d700b349fe22197605e4a9c619e100fe9c87516149b0380d3f9909ea7484662c47990fccc693fdf0f7d36605db3a65a5b31a432a8ed731a466a130ebfc9a1d0bb42f48d7c9b57dd78149d048c2565424a8192ef00ada54de43c9afbdec7d18e5f4b500e4a886cb48ed125ab91ba33923838e6810a0dfd7ec7be54f0f90b1dcf5a87d24ed5a23191e8a6c744cbd6ef492cdfcb7302b27c93117b914f855145042f188f08fec759db9c4734cb4619e339a6ae80f1557c22764148e0ab6a6f1975824ac2648ccf943eb3d5bc456ad8b070b859e859389c351e323f6f14327cc41add02bc1c5c73d0b697716bed0889437da49149cff431eebf4cdc166a331dda3f51a2810e7150f56d6adecb6406888db061d535c5446c5cbeba1f138ad2dd6ba76426c0573e11bde5cbb2839c83f5595c2cd3008e6c205bdebe0cf2569e50b58ba2de9f2abc067703492e4a98a4c13a8559eac8278802b5a132d04489c19a2f0258535096f53e91d6a34275a943825ae9fe1167265d9395f171c7a35fc9b8c872d870399a4fa58c4433697b9ea5fcdd88a8ac342a199e664c0edb684a66f0871d5da5a8368dd6f7454b2d03e79903bc4ce431540248aa8d8fa3f542546e5933c3d3a59515d67069565f5ccf1d8b80969937ac5dfa9b93e805585fe89677cda7223a8c9826751d9abe9810b9db11d3d5f15d62511f60f3bc43ec521934a331faaf6c07a525c628e08f0581ee2b7001391567be0ffd55f915b05789b198986970dab05fec02426e42283ada94a5e081fbddb5689955c98f51389a2fe20482ed1eb256682fab5148d6abbe99e58b4087060e794dd11303d92d7c91611b1cbf5104a805652f5819a99a160f8d7cb627e1aa18dacd696531f8bf75c043e12cf189f52f639f1e238f8d72956eb8280103701313a47cb2d277b2bfd2ae46682b5857dd98dbad29a0c5716bee609beff47fcc42c19ef094b8d42314db81d618e2af6a820b98344f9e8ab56f0c60d9a0d40ea1eb6c0cca269f23c3ff2114a45dc828a95fe11109fb339cdd35c0ac1fa4a47d5716c401f5ff9ae8f1b0ac3a29503f2c56e7f519dc7b5fe6cacf588b112d6f4e866ba15dfcf90aa1e89f31c7f62d589a9976cb503a129cccea37d99613cf1c7158da3924a8a9249e877c845799eed712a4acc8e06174f5c9aa45f8a9f60cfa8dc66ac343902813ed3ff81387c50418991ac657a10a4c42740936885b5cd511a54d11767d3b2a63b46668543513084f8383990e3f9b14a776ffde8b3853d065124ae611f2741d8a53eb6c20a2610ec651c8fbb5f243a76ee8eec60900f8df1cfc82ed377393c4a1b37b12aecea525b18e9ede9b14ef8799e775f9c81e077f5c64fa54802d0f6aad3210b6d0d404296a9cc714c3dc36547634b018228a804303c50631f88d553404c2032934ac146a1ba4f4646479aa2c7d71d036fbc93e00f932d8a3cc367deec40a644a734ddd758bb8725a3f56e302cf7b0b4eee9e9703b8e92122be77be24be30a4ef80397eaa36ea287b14b5ccdf2e32393604950164f0bae8a5fa3b3180e5e975ee224ab33ab02c8875d6daf8c5ee3ccdcf0d9575f08419d2202e05b0f7a24b99c99e120cf56d8b2617c1c6694d7cc2068e932ed9b8e8d18f614e66d8e0ee26d82878bb1a686352310d3c8a121f6ec32a971aba87ec4f4d67c76503c356bb48166b677a1c059e7df13ae29ca2ebde5b4d91223c3b6b4d9328b7a9588e54b982a6ebca0bff2460d65a19c81f4b22fa2aa4b61598fc153cdaafeac9409f18dc38f482b678f2bb9b5b929f0da5b6f5f9863de189d08c08d9e7e7c603651e5300a086abc8d1e210a063c4e44c00761c69796960ab4cfea1743d93ee57098d7236937a3c6392ec6f2c52391233c862e1b18b66759bafde23279df0fc8d0ab567b81fe2d5602df5409147a2edcfd6a69167a0b8ce7943781289368839c3c3c3f367d6dc0f86f3c2ce8b1d909d8058285dc48c73635fa1d12976c6655f4c6a7f8dec044e8ae63d0da0db9d7e5841afebdeaa886cc0c26ec804e629bd0440dca225fc9ecb4e1edfce90856a13bf786f5015dab47e9ec6c45f3dbaeb8f67a82db706a044b3a1d635348afed12c36f7447d25cba96122142dec6446bbbc7c1c3c3cc586d586c55886a7c26705d665dd0ce80df1caff0d93bf581fa82e38da12916a68b974a8eca03ef64d9778b682eaf2fca84a76aa5ec9c0413e85aab855014b7b134e8a204a34bf76594e4b4267ca9d6e03b6e6ab9cc6e3d5e034328431af88fc77b3b4a49b21b019e9d81c026566273732d98856eeaeae3eee8379fb6f243db56a9bcbeb3c1c46b903db0b80c790a6d6937e6325ca9e2e078bb7bc304f053e7ce68e797bf39cce5c18039f317a1519499dc0153a432fe7a20e5bc43368838320c1b820668f1b85a978217e9f83df39929062ca5dd8e384c052ba579a31c53966f251647e1cb0c3b9bcb8d0f3513e116b33d8a6d356c0affe2d5c8e326aadd0255b5c93d1d9dd2e864fb687b8f8f62e5b9b98a16ca18fd072f71fcecd4b69a063934608365687afb4f68d99591b66c58d48c40705cb18ebaa43e0c0306fdb6947b63ae152746ac8e4b214dfc480644c7e654de33045d330c4b333fe361ba859a63a3cab796205b99f714bd6d191d7668ef5fde1a63e6bbdb8f3d1bfe205ca848a47e360341fb080ceef52485e377faa5a2ee3f53c96890ae83d316ee9e7c11e290d26e89f895d8a8d33ddf0ce741778203e71e4ff17a37af173a6048bbe84ca70f1bdb2faaa7115283345fea2034f3a14886270fedfd283a822aeb9b86347a33d0a773ed9e4cca6535b604ae51a99fd873b8ec4c7cdce81ed30832e304fcbadaf57381731b983de40c9bacad6841a89aedfd3b954944895337c79638c09d5a854483a63ff8b715e70f851238e45bab9b63e57c4a6fd2ad6dd6fd21d0101492dcc2d9d87a8dc004d7699150d0727b4489f036f9c0376a2472d3b7dd15be0bca111f53ad4b898dc7b033bb90a5403188057a8052ba90d116dd947af74a0e42341cf486aa6de566d61fb506c9842ccf8c73cd4be8dcefdd001cf449a0a9d6f72eabd98b9043f7145ff64367883d6a4752f11dff3d285567d337ab16662226e0d03efd3f3267010c7cd64c99fa869f1e5bbfd5a8a0491a958a003bbbd316dd64104a4b0545dad0b168b97732e3f71491a1e46ab6d9cf96812c4320b07a099fa5916d405a4fac8649c1aa9f0cfb4984559054b6f6c725a51a125dcac8dfe336a174b5b56f03a487029e20d64eb18e75b437848c712983cd30041a13b4feb55537f21ac0792c5d157b0e4939640d57e3f12a45194d470de798bfe6ac3175777a4f7d993eba73175e0952896d3b326ca421f083cbaa6a77648694f62130a8645bdb37c239db03b8230bcc65466e0f89007b9a09a934f7071e73207a5dc209cf81e26307d67b6110229b6c4c3d4245e9b01abf1500b8bf95a12a21aa29824ae9f7f0e2b694e8b7d349b101cb4b68837f409c49c09edc5a954ebce80b1368971be34767ff3d0cabe24522a179f55f40b78ed709b3388a580e436160eb8d8e208174257332b7d93fd2656e29ff81ffbc614a162794555ea94027bdf9d9e50054b731d1fda070922672cdb6", @nested={0xc, 0x8, [@typed={0x8, 0x85, @uid=r2}]}, @generic="005ec8d0989639d01863505ff40f65d3adc6a93afe9ae1516b4712549ecb20b99ac062a6247ccc8259dfdd", @nested={0xb4, 0x8e, [@typed={0x8, 0xd, @uid=r3}, @generic="8cbf07769ba7b625728ad078a363683e1f9d92575de381ae84c7234a8a0bae927c4ac66c543dd03c987a470d40031a5703f47a2cdf69ad03482269db5566b9278b1b80f55c36e7a347a45f8e954542b292c275b93d4648493ffc24dc9d11dcecc3eb6fba344b26e89a", @generic="95c2960916afbd82e23ec9ce4f23a258a35316cb8bc9c7179132f401953939a6d516e722e3421b5425d487c6ab4da3934573e087f4d68d91d34811db400758"]}, @typed={0xc, 0x64, @u64=0xffffffffffff1749}, @typed={0x8, 0x3f, @uid=r4}, @generic="4b2102f5f06250bf22594df3fca83aed4db4cb67e4f3821680c0667db9824795613c167f2dd89fd99a1ed7bef90833d80193e9a7418333a730f5b693339381587aeabec3b1223715d4143bee9919b20770bf2211c8d871aa2a8f951c8709f7bc80260ccbc860ab0eb0e79aa2cdd17b7c3687fc24e4fef789d32567cfb75ffc850e1e836753432f373aa0c65371c4d40354cbb30d5d7e62713d5068b31d9f395f1bab6ea64f7691b0ac370b362d917cd7087fb9316ed2839bfe5f6f7a454d81259effc37bac7dac79e9c74a463a04f13e996763808bdbf3022e1c156735aea6ae0bfb6a3b3e8ccfdff3f3", @nested={0xc, 0xb, [@typed={0x8, 0x20, @pid=r5}]}, @generic="2bfdd7356473fc5cb7a6ad6c191c85b7af6963810bedd68e3b4205e69c658463143cf38e1deb4f157249605440c2ea157c588cbf87fb1a54f5c23956da8f49ae3306f8c54e296d6499bcca49b3d317f5e5db7e4e39897a6a1d4e8214c1dde8910c6b8d35ba99548b509b5edf30b533f7255f6d42820056217ff02991fbcb1a0569733654e13d5bdc30ef9a"]}, 0x129c}}, 0x8010) 18:18:32 executing program 4: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040), &(0x7f0000000080)=0x8) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x80200, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) fchmodat(r0, &(0x7f00000000c0)='./file0\x00', 0x84) 18:18:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 219.654675] binder_alloc: 10206: binder_alloc_buf, no vma [ 219.660844] binder: 10206:10211 transaction failed 29189/-3, size 0-0 line 3135 [ 219.672359] binder: undelivered TRANSACTION_ERROR: 29189 18:18:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 219.741273] binder_alloc: 10226: binder_alloc_buf, no vma [ 219.747820] binder: 10226:10230 transaction failed 29189/-3, size 0-0 line 3135 [ 219.756761] binder: undelivered TRANSACTION_ERROR: 29189 18:18:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 219.790377] binder_alloc: 10234: binder_alloc_buf, no vma [ 219.803855] binder: 10234:10235 transaction failed 29189/-3, size 0-0 line 3135 [ 219.817394] binder: undelivered TRANSACTION_ERROR: 29189 [ 219.833105] IPv6: ADDRCONF(NETDEV_UP): vet: link is not ready [ 219.857054] binder_alloc: 10238: binder_alloc_buf, no vma [ 219.862693] binder: 10238:10239 transaction failed 29189/-3, size 0-0 line 3135 [ 219.880588] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 219.887562] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 219.906349] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 219.912229] binder: undelivered TRANSACTION_ERROR: 29189 [ 219.920160] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 219.929027] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 219.936023] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 220.250165] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 220.570168] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 220.640189] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 220.960155] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! 18:18:34 executing program 1: statx(0xffffffffffffffff, 0x0, 0x2400, 0x0, 0x0) readlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/203, 0xcb) 18:18:34 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) poll(&(0x7f0000000000)=[{r1, 0x8}, {r0, 0x40}, {r1, 0x1020}], 0x3, 0x7fffffff) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) signalfd(r0, &(0x7f0000000040)={0x81}, 0x8) memfd_create(&(0x7f0000000080)='\x00', 0x4) 18:18:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:34 executing program 2: r0 = dup(0xffffffffffffffff) fcntl$setpipe(r0, 0x407, 0xda) r1 = open(&(0x7f0000000040)='./file0\x00', 0x8040, 0x0) r2 = open$dir(&(0x7f0000000300)='./file0\x00', 0x0, 0x0) r3 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/load\x00', 0x2, 0x0) r4 = signalfd4(r3, &(0x7f00000000c0)={0x4}, 0x8, 0x80800) pwritev(r4, &(0x7f0000000400)=[{&(0x7f0000000240)="cec23215d219c1f9108ec973ca34c2ffe072ef3f5fd81d2eaa", 0x19}], 0x1, 0x0) ioctl$FS_IOC_FSGETXATTR(r2, 0x801c581f, &(0x7f0000000200)={0x4, 0x0, 0x400, 0x3, 0x5ca6c970}) r5 = socket$packet(0x11, 0x3, 0x300) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x2, 0x722, 0x9, 0x0, 0x0, 0x800, 0x2201, 0xd, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x9, 0x0, 0x0, 0x0, 0x833b, 0x0, 0x4, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x7, 0x40000000000000, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x2}, 0x0, 0x0, 0x2e, 0x0, 0x0, 0xfffffffffffffff7, 0x9}, 0x0, 0x1, 0xffffffffffffffff, 0x1) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) prctl$PR_SET_SECUREBITS(0x1c, 0xb) r7 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pread64(r6, &(0x7f0000000340)=""/39, 0x27, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) msync(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4) dup2(r5, r6) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000004c0)=@newqdisc={0x1ac, 0x24, 0x500, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, {0xe, 0xb}, {0xf, 0xffff}, {0xfffb, 0xf}}, [@qdisc_kind_options=@q_red={{0x8, 0x1, 'red\x00'}, {0x108, 0x2, [@TCA_RED_STAB={0x104, 0x2, "6bae36f2c3093d3655047831efd8f0ce569628ded5dd98ec0e5c7565eeb0e77093780f7295e8c5b48cca31da8c00991366f9a7ce0a52c29bb8611116d1693c3c258baa399ffb0dfa7569a7d02dde7154a5556b29a38fdcde814a182ca06ab11c5daae86653af6414d2f9ab9ae0b2c1816e10f49527c708372151a7273df22a9413c687e487181178b004258f113f17b59d1f9a62408643994f988eaab9a202462adb5ddb1f14ae74b48a181c4d8362676ed34153269deb6361091ca068dbb13a7d7bad4550851da61ea23c55c6f78632174cb3b83c708649d2d613b4ab9d3c264525cc56e6fefd25084ce2e86161da2a957e363085487754de81d4bc3eb766c5"}]}}, @TCA_RATE={0x8, 0x5, {0xfffffffffffffff6}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x6}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x2}, @TCA_STAB={0x58, 0x8, [@TCA_STAB_BASE={0x1c, 0x1, {0x1ff, 0x80000001, 0x80, 0x100000001, 0x1, 0x6518, 0x3, 0x1}}, @TCA_STAB_BASE={0x1c, 0x1, {0xfffffffffffffffe, 0x9, 0xcb, 0x1000, 0x0, 0x10001, 0x100000001, 0xa}}, @TCA_STAB_BASE={0x1c, 0x1, {0x2, 0xa2f, 0x0, 0x0, 0x1, 0xec, 0x40, 0x5}}]}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x5}]}, 0x1ac}}, 0x20008000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$selinux_load(r3, &(0x7f0000000380)=ANY=[@ANYBLOB="6b56ccb2364b36c15a0e9a59ce857c75595c49093d919ea6ad3701900f5ba8deadc520d29d7b67a713d74c5fceeba78684d20517231cecbf6d8dfc7ced2425a61124bb8b221280bf7da5a56232654b4aae358cbd300cb90b12ecc7adc13c1110"], 0x60) fcntl$setlease(r1, 0x400, 0x1) fcntl$setlease(r2, 0x400, 0x0) 18:18:34 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000f0000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x210) 18:18:34 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x8) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000000000)=0x3, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000100), 0x0, 0xfffffefffffffffe, &(0x7f0000000100)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) 18:18:34 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x1000800000080f) socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="580000001200d511bd869c5f0000a30007000000", @ANYRES32=0x0, @ANYBLOB="0024000e0000000000000000000000000000000000000000000000000000000000000000000c000100aaaaaaaaaa00000004a750046ba9150ff0dbc17da522efd72c530a8578b5ddd0c0c88e815420087bf08d8f91e7edd897e2b2839c2536bd54666ea3521e2e8df32cf06a45b26e7fde8e38f23fea53"], 0x58}}, 0x0) 18:18:34 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)={0x104000001, {{0xa, 0x0, 0x5, @mcast1, 0x40000000000000}}, 0x0, 0x3, [{{0xa, 0x4e24, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x2, @dev={0xfe, 0x80, [], 0xa}, 0xfffffffffffffffc}}]}, 0x241) [ 221.971165] binder_alloc: 10244: binder_alloc_buf, no vma [ 221.987563] binder: 10244:10250 transaction failed 29189/-3, size 0-0 line 3135 [ 222.006634] binder: undelivered TRANSACTION_ERROR: 29189 18:18:34 executing program 1: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) r1 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x400000, 0x0) r2 = openat$random(0xffffffffffffff9c, &(0x7f0000001640)='/dev/urandom\x00', 0x210000, 0x0) r3 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) pipe(&(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_open_dev$loop(&(0x7f00000016c0)='/dev/loop#\x00', 0x7, 0x0) r6 = openat$urandom(0xffffffffffffff9c, &(0x7f0000001700)='/dev/urandom\x00', 0x400102, 0x0) r7 = syz_open_dev$binder(&(0x7f0000001740)='/dev/binder#\x00', 0x0, 0x800) sendmsg$unix(r1, &(0x7f00000017c0)={&(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f00000015c0)=[{&(0x7f0000000240)="be36dee2c2da5775a7fefae3960776fe0e438655e76476f8539a337f77918f571da56dd78fcb4baae3c42e6b65f56c6b", 0x30}, {&(0x7f0000000280)="c6eb32427bf3f0f8f9100ee9250422aa078d0f053c73", 0x16}, {&(0x7f00000002c0)}, {&(0x7f0000000300)="3a546ebfeaafcbd8971fc030d9f4b7936e701223e427019b88ff2fdbe691bbd29f8969873d6950d394eb8cbe3664600d9ed4d673982a789faffe04646a0031664cbd1f2049196d87898ae406da69262d27fa035cdcd5815f6a84a4420fda62af19a5ab50e54d4c2de78f138aa017dc305bb1fd29bbb932039745e72a369635a43bb02687cec542c32bbe384265a5af255e22ee3db1bb6d5b146089951c8a921c73bf277f904985b5b548d460cc6a0d3cf2132a7f268537d86023ec", 0xbb}, {&(0x7f00000003c0)="aa4aee3f2790f01a8f9b92196e90edd2021ab4d0f839298216cc636341666287d73e419e2620a780a5053dfdc5ffb878ae69097fa44dd1d56b27d8bd9c58e2c0499828b4bdd6a5be4597f869b2e8f5830a976f8fdb8314df04fc5043832972dcbfca33709a5f698611a84579b7713af16994ef6486ccc753a7971e4c09a2c7110cf5f88665dc9b16daf6229c5555e0e30ce6a4e4278ed74bd5e819308982d51bc24c2477d46b61842686ca1399b333eb9bdf553b95827c3858d2a69d6ce44b68a55d8424ba78194949c3ea851e7f0de91ad1c9726e7bed3c6995e15a4c2b6e5610f4d7cda2cccce9aead46688ef4b52fbfa6d4be", 0xf4}, {&(0x7f00000004c0)="4969e551faa670d4d83d4201eb4be8a890db8052add727dae22001f0ee512ed7b0e400bd7e8aa7300dea5bec7e592fa3457bb21bf26c9a52b85ee75b0d18a57bcce1a3d9c42a3293300a44ca1d14000b16caccb180c49cc98aa579565f939f988016ba3ef763957efdf909a6b216306b7855fd50ea7703a1046c16e8d9de71ef34d1bc8b0aa722d7305ed4587d7b4db8f996238b0f4402b2d5fa32fa1b316d69aa1b176af781fc7d349e463a12a3123da2246c08d96162768dae31bc379ab893621faf86f9ef8045eebd3b68bec2d2eccd0becbe325ba249ac7643325b9752a391e9f9c1efe988803e4f668ee892b7955bc4f320c6612695948338efdb297ea24e481831eaab9ecf17dfd84b800e41f30f77517464854687b00899f3ff1406a2da9373c53ad80ebd10865cb217751ff419740fbff6c0f04ce032497edabc0aeb11a19013a5878825e5d5d1a7838da9ef008197ebad24f79ca06cfc58f59d3b8642ee2bf09e60109074d593b97eef84b9271ba8d4ad8750688117add99eec3fb38145b8609151da8b7842aeb50efa85f2953a0eb95009609a85996854fdca4c2323216ee0276727c3fb6d23e7b7f1d72caf4113801ce0767f87cb0ed61696b8f1429f74b08b03d33f3557e2a15796043fa40b65283d6b2971ae83ad9fef8b892594642938c7d422b355a26eca983832687d880b951744ca6c8c25f34bb67769036a44dd23a949374258e1a8afc3478b02c9d4132ccb9ddf896bf63414e1038b794be11deee049d0af2d0e8dbdad772d50eb9d7ef8e4b9e5f8d7e14fce2092635b5eae566a0b212e465dd40a1620a789f499bee7f9a19a3cb8e48baa8f03284ff359e5d291911ef8cfd9e26ee8a3de45cb61c241d9c8c53bf2b176c5810aadc6359d28d9265f55b85d53dc042c32ce8f852f3460abcc2ca492e9609ebbcdb47551d33813d3e4829d90a4ca648568fdd663edf0d2efa5c330b26875c4837b578a57426a800ae4b25f74799072c0ec460131473fef5f278fa5d7ac4c40bb80c986381060966fd05f425acf83db2b1b3c4483bcb7f0387dca86f8ae889c89fb05a2dd8494f2031614c2ff0ad36006efc8b40c27d74cb7840cbfc4f0899ddf4a7cdaed22785a0c1b4be2ce47a65ff3d6b3ef5985379f504983927c257040e955001abf39e45f6de26c3a24473e703861d727bf1f51ce1dcc32b6c3c995c4e6409f4ad73db2f0d1a53f695497bdd72a9e451b5e6aaa5a3716d8a6a9d772d66dfcaa801f5ed4887bb1d6834b790d28ddf72aa2e0a9ade7cfe74fa298909c5bdfe93dbaa026bf47063255518968bb08224877a476d36b23c1f8db1e3dfda1225a22a383185119e0704fb554a587fc2f43720011b273ea3f2e92351be08b276a11ac2bfa8376ffa080b0011a1e1a5a014eb505bc1b731f1ae77930fac7f437d7d9f6675f68a42b9817a0a48e8266d270547bd231511e98150fe48d9349cb18a9769ca7baf6ab9c87d8bb584bf51cd32bf5764ebb7ff987a1977745bc9051f5464f7e60d984beaf7067246c37e71e943ad82188689748457976b2add9c64a3b8a26afcadb9204fd74786603740fa47245872dcba213ab50debb6f84c9d54bcbd1b82d2abe674088983a80e787d3b7643083e52afa6cbcdccd6d3497ce5b2cc9dc48705b85008e0018f2f11695ff6d9ab27c867332545f0eb9e8a06f0d3515124a0c4a986afd5ca5fcb5dff0aaf8206b89c538676fe5db92f2a8368aa8051b4c7e3af03935afda4c109e834a926ebd8f549ddf3cb029b8d7ab6cac5494037fb916cf032b57905387f2ff6a16c19e9158bd3fd6ccca4d58761a3ddbd156f7f82a56ebab052a73bc9fa2f9c143010dda3dd995bd9ed901369bfbae676130f7415c8eabbefc87cbe08ff671f7b99f8c132d20618cc2e3963caee8ee32ab65e570bb1d36dec365ed2c3b48908a74ace49aaa4279ef64d7026950b5f98425c7659842528f0307b9c48c065cfa065252107cabbea86c1d83449ee0d8e2bd1264ac44f84d8583ffe933501b4aafd96fbc16999c023d20981aa5525d1de424a8da5f953181f21bd14a6f064fe05e280ac4a4f3ed3ce95166f7d5a8b6dc138d859a826bf6d9866fb886cdb9640da37fb9d52212432a75649319df5dc21cf7ed25e3230b186f3dda9addd7e9ffddddc2fddefcbe88db5f47a7a12bfb7748eadb8953be40b3b2dfe35ae41c6639e769f32f76def3286dc9ecbdb89d5dfbcd352edd238d34444e86c1b7224f01d61babb0817f4a5243ab44b17b18faebfb776fa1f18193c4ea0616c9ec2a87c1d4c58893c02ecbb8e00f99090f158485414a2c1d1ebd77fd4321de21aa5a839ef0297051cf1ae438c438c8ddbf87b24b2d9dd43fc3e2a306c2fa3d0845a141f30f48fc4ff4f983407fd06f0dec973178ca92fc5cb336065223c3b208fb2a1fa2c6d583e899b77ed1dab8aebebde5f6c0e50b50e2f1df0f70c4a66a1310cd385e41f05cfb155951e79b7abeb06a2543aa86d1423b4e1402ebee8b9ad0ea93a8df75b40d0e822550bebd95f5b10cee3ce6a2e87e4dcf33f40e099426f7b2a5fdd0f82c28db8681732aca79eb47533fc0af58e21ef49c34912a71635e02226c92ea6e99507fc14be11d89e12ec271e0da27ac43c8004485fe046813ae6f090b6b81defae185629013ec812adce2943983fedb12a059eab727f50ecbbb9f3383d123283a0c701f2b98b5d6d9de7dfaab911e999f90d181c75c40c76ff7c5658b6742419e958edf50f6d126248700ebdbddefdbfd7aa8b4da6a3e5eb5af3272d9c36dc15a1d700997d0b1949db316dffd947058bf59a9b0fe50c12369bcb6778271fc1ddf11a235025bba2f6d128797546c183624ae6e5fc29d493521febe9a9d755ff436abb2f765ae9eee2bab32eb8fe506fd5ad9b6e8e1ba823fb0b0c7fb7cf58cc6001188117427e14bf3e68cee874eb3ad0bbaae7608ed6a0350e9a3ce20f824bdfc61d8c9be46d455e7c8f11c01c9540766877663e456f98cc6bcc8a049c9da048a05c6df414387dfc85a55113406e2cac9d56ad921d1c69f610e36c7b0a0bce64405cfd0c8ab4f63d7b77857d0e1ccf15d69e994ac60dc035d9a969f4aac673945501251cc1a9fec0c2172dd5f7662b9b140860f7214e1d73dee732b739db2b563913ad680934a4df8bebe48f75f04b7ee783b2e809414d273be5d71629c8499c81129c3943714faec477b3d2acd9e9af11fd585d9081eb56d755829d9487c603374a268e2021d1aa42eea55cc1540f1f0925ee8feb7d262a033a65d0a32acdc8042736d67b2943aed6f6eacf23cda9716e2036721e5ec87b507f75a26e68fa40a07cf07c7ef88e4c20153c911cb7ff6ff37b0ecccaa3560efb8b285c5e13f091474099bb3a2148e8277c8b7dc2f6bc382d8d5fad3504d1b05bf0dfb0e05fe0ff2a45bec4d4b9b408aa86176885ff99e0438a20461f31db2c2dad9e4eabb4f6642dd2b3575cae9be32200c777a7158aa024694974fd083b39a7c2a7d49e1545c9b37a217225f960cb42082acae7178c456bd7bf2fd75a2160897f241191a873fc45e9867c6366beeb1f0b908028136242a9a92f11fd5fe84f1b1ac06a46c0f3d2f7ffe257baa2f423c6d613407c9237adadc297dd32061d3c9d7a1c41839d69b0f619cf5b8af4c6f15b613a4f17a8a6c3529f371bd28d6fef7a3e7f01def59baa9b91705c3dc1459993d9e4cc73f1cb452796691a51125a9e2809bf03e71c0b5a1b22f159b6a98610b22a3426bcbde99e3ca5ceb5635e1c53f497344ac69f66cd40be94921b49b400292ae9549c1b20ac9a11b64dab74fec292e76826ead1cf500dc02604b3648047ab4f6dbae3ec2b6edb8400f8c6f56b07afbc055415576e3b0c925d6dbd6b04b0df08d5f832cab1d320610c4e8e9fef71bebe8324c6b57bcca268d449d4dd979ce80eec322e60be4a9aef244c8a339c888489003b469ba7c743deb5e0bbfc10aa5638f0c7d0726c07db68f71395d816d30af99d4d1b97e870b15b2a9101d6e5991881f98241df1c5144a8f1d89cd82bf2e722876417614537d5fed87a8d223c24673e111bebc894ad97e3ef10ee19282cef266779443a05029f5e24994c22cc9d8cdd567067f63b148009a2dcd6dcc3995b27fae7518a75fdc5638c49eeb70cf34aef6668186000d4fd7730b2e0d3c5147faedd57bd966bc1198a8e354629c11ed7cf7884eeea31c2db0c9ce0b809638bc2d39bcbded48d72bf754f4b2a0fed82843b29c85ad18f8bb85c3f92628f2b50a1bec9b64823b9ec28df25e0f842988a07d617092450a5cf56c2aef37ba009c54a865d97e724d4dc2d4e4680eb1616ce895bf0b740d14bdc309d53b2f8e725c86d0e1d8edd263c1f720cdb1d0d06a368db35c4846497ed5448707b01fb33377f184ca39b3ab5cb523acb25653f4bb34b0e77a2af7779a3eed10500d5da7561473f37a867ecdf9b9cad8a3ba9b3e24cef030266d40b7bd7b2c5272b56af595f5a17a92eea0dd1a7212e4f552dc1adde1f0a8577129ff84dd89cfc8f6ed74ea68731b9f1355da40aac667dd36e74366d68ee547b415988eb83678294ef4790c7f92886c36fa0ea345ce5cc66439a4e2a25b6070a4879c862ca288e2aa2a94663d229c875e067b19ed04a5cfe5adc169f548b9b0355d178d053fddf2cc155e7052b617ffd01dae3b0b38f8cd762680bf7b504b83131741293b0602e470d76562dc67a8eb0060eaf0c486e9dfb012dfd9804c132f650498ef96c708e4b59acec7852176e5a9b49e0648fbd2cba5fdf92c01f7e047ed20be90056416f07afa8dbd447c41eb2f94b2f40e7bd96f5ccc1eb1fc7803fff78da48e766f5949dd171dac557e8904f826bf3ec990dffb83d2d94f277ec112b60b91a22fbda2017f205fda0b54181e98e73d53023d765771c8103630db542d5dd0de251a280458ec1879c635c8f45ddbf8b5e8b7ad18c2be112043e54c68f072b55dbfeb45688a94d206dd7754da0fe5bc2ffc6282da4c80959a639aec180209e4068968c577b0fef2ea12b0f0358f2b0fc3d49f9de8c0462fb26f5ecfae9f4dbec1cb69bc01c6d8f6bcb87ba889074100601854325af79611d53e8a1f194571ad79e3ac494ae206d90595e49b38af94e74037b224ba66f33ac457670283e677efbefafcb526c2025ffd9581a95db9c65f6e0c52d9487fff2c5bf9a5d93c4c5f3da86fb71850149eea3f7b38cc59dbedc9f06686963c0b1aad82533a08dbd14b42a4948350988f1b36065040ac48fbc5616847c6db6ff95474db938af3ce431610817c41138e84b4181f24aa2456daab2bc997f0f2cbbff32b3d48b665ef629e93b630150a20cd2db4a716e45fdf569050d0cfd1d03abb67aeafe8cd20ab4b38e5410c85324bd139f48003d7b68b2c57e425b04fcfa2ae984159c0a09637eaa4c39d7c0a17c736b5bf3c3102e63be4995c62069ac68265ff7cd95f13dc182e8edd878cbadc1405212b77136027a6774becc666e851182f90c742fbdd9e4b6e0dac7445769016877c51aa170e7e025304262aca33f4829ce8821e78e5cc2d71d00788a91255bdb956658e37604dc53cad4a2e6df6a0f701277ec4bfc74cfcbee086b9872e8e7af2a6e9740775b0ee8485ea48ed90551b3d8c1463084820f3351c84f26eacdccce9f3e1311f10ccdefed7c80490f71a82ea51d3ca1b9cad244e6750b93f07493ca9d610d793c73f6ae7885dd27fc1f406a4a00603cf94a571956222f2008d74d1badbc688ba3ce53f44337638", 0x1000}, {&(0x7f00000014c0)="89bc99492bb0de2be3e8fc360a3fd954278fc611088f8895f312e359ac552923da8548d603217e6ad7ae9af71b4e4b03501638065a50b3eeebfdebbdd9ea0f9528949abc8e12007829b05c52762f2b5f0116227adaf3eb132d767dd18113e35e515cb72ec108e6bc1e5012c5f1938634bb5b93a53b9a206fd36e72311fdcdb6c4c54ca2ca319567a9236ea262edab64082fddb2c13a95b00fc91a520bd6cabe9f56e2c6a40dc0af896667344e544a2b6181d9d89a9e4b2a5d9b9948a904447f45bcc164fdbd6f94c183e3b8037bca9482f21d5904e02e8f689111858b63fd6445557565964119ca211b6292df255cf598321daa756447bdda137f7ca", 0xfc}], 0x7, &(0x7f0000001780)=[@rights={0x28, 0x1, 0x1, [r2, r3, r4, r5, r6, r7]}], 0x28, 0x4000}, 0xc044) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x5, 0x0, 0xca}) r8 = accept$unix(0xffffffffffffff9c, &(0x7f0000000000), &(0x7f0000000080)=0x6e) ioctl$sock_SIOCSPGRP(r8, 0x8902, &(0x7f0000000140)=r0) ptrace$cont(0x1f, r0, 0x20, 0x7) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:18:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:34 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000182000)={&(0x7f0000000200)={0x2, 0x4000000000000d, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x4, 0x0, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in=@multicast1}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}}]}, 0x80}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) finit_module(r1, &(0x7f0000000000)='eth0\x00', 0x3) 18:18:34 executing program 2: r0 = dup(0xffffffffffffffff) fcntl$setpipe(r0, 0x407, 0xda) r1 = open(&(0x7f0000000040)='./file0\x00', 0x8040, 0x0) r2 = open$dir(&(0x7f0000000300)='./file0\x00', 0x0, 0x0) r3 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/load\x00', 0x2, 0x0) r4 = signalfd4(r3, &(0x7f00000000c0)={0x4}, 0x8, 0x80800) pwritev(r4, &(0x7f0000000400)=[{&(0x7f0000000240)="cec23215d219c1f9108ec973ca34c2ffe072ef3f5fd81d2eaa", 0x19}], 0x1, 0x0) ioctl$FS_IOC_FSGETXATTR(r2, 0x801c581f, &(0x7f0000000200)={0x4, 0x0, 0x400, 0x3, 0x5ca6c970}) r5 = socket$packet(0x11, 0x3, 0x300) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x2, 0x722, 0x9, 0x0, 0x0, 0x800, 0x2201, 0xd, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x9, 0x0, 0x0, 0x0, 0x833b, 0x0, 0x4, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x7, 0x40000000000000, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x2}, 0x0, 0x0, 0x2e, 0x0, 0x0, 0xfffffffffffffff7, 0x9}, 0x0, 0x1, 0xffffffffffffffff, 0x1) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) prctl$PR_SET_SECUREBITS(0x1c, 0xb) r7 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pread64(r6, &(0x7f0000000340)=""/39, 0x27, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) msync(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4) dup2(r5, r6) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000004c0)=@newqdisc={0x1ac, 0x24, 0x500, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, {0xe, 0xb}, {0xf, 0xffff}, {0xfffb, 0xf}}, [@qdisc_kind_options=@q_red={{0x8, 0x1, 'red\x00'}, {0x108, 0x2, [@TCA_RED_STAB={0x104, 0x2, "6bae36f2c3093d3655047831efd8f0ce569628ded5dd98ec0e5c7565eeb0e77093780f7295e8c5b48cca31da8c00991366f9a7ce0a52c29bb8611116d1693c3c258baa399ffb0dfa7569a7d02dde7154a5556b29a38fdcde814a182ca06ab11c5daae86653af6414d2f9ab9ae0b2c1816e10f49527c708372151a7273df22a9413c687e487181178b004258f113f17b59d1f9a62408643994f988eaab9a202462adb5ddb1f14ae74b48a181c4d8362676ed34153269deb6361091ca068dbb13a7d7bad4550851da61ea23c55c6f78632174cb3b83c708649d2d613b4ab9d3c264525cc56e6fefd25084ce2e86161da2a957e363085487754de81d4bc3eb766c5"}]}}, @TCA_RATE={0x8, 0x5, {0xfffffffffffffff6}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x6}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x2}, @TCA_STAB={0x58, 0x8, [@TCA_STAB_BASE={0x1c, 0x1, {0x1ff, 0x80000001, 0x80, 0x100000001, 0x1, 0x6518, 0x3, 0x1}}, @TCA_STAB_BASE={0x1c, 0x1, {0xfffffffffffffffe, 0x9, 0xcb, 0x1000, 0x0, 0x10001, 0x100000001, 0xa}}, @TCA_STAB_BASE={0x1c, 0x1, {0x2, 0xa2f, 0x0, 0x0, 0x1, 0xec, 0x40, 0x5}}]}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x5}]}, 0x1ac}}, 0x20008000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$selinux_load(r3, &(0x7f0000000380)=ANY=[@ANYBLOB="6b56ccb2364b36c15a0e9a59ce857c75595c49093d919ea6ad3701900f5ba8deadc520d29d7b67a713d74c5fceeba78684d20517231cecbf6d8dfc7ced2425a61124bb8b221280bf7da5a56232654b4aae358cbd300cb90b12ecc7adc13c1110"], 0x60) fcntl$setlease(r1, 0x400, 0x1) fcntl$setlease(r2, 0x400, 0x0) [ 222.030150] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 222.037126] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! 18:18:34 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x100, 0x0) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f0000000040)=""/176) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) [ 222.101179] binder: 10280:10282 transaction failed 29189/-22, size 0-0 line 3012 [ 222.121869] binder: undelivered TRANSACTION_ERROR: 29189 [ 222.150202] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 222.157118] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 222.550133] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! 18:18:35 executing program 4: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000000)='{\x00'}, 0x30) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x400000000, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xffffffffffffff99, 0x0, 0x0, 0xe8f, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff4b}, 0x0, 0x2, r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:35 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e21, 0xf0, @local, 0x1000}, 0x1c) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000400000ff010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff010000000000000000e87f23bfe9cb1e2b300000000000010000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000"], 0x210) 18:18:35 executing program 1: ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)) mknod(&(0x7f0000000080)='./file0\x00', 0x8000, 0x10000) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000040)=0x0) setpriority(0x2, r0, 0x4) 18:18:35 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/icmp\x00') r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r1, r0, 0x0, 0x20100000001) 18:18:35 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={&(0x7f0000000080), 0xc, &(0x7f0000000300)={&(0x7f0000000500)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@loopback, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@tmpl={0x44, 0x5, [{{@in=@loopback, 0x0, 0x32}, 0x0, @in6=@mcast2, 0x0, 0x3}]}]}, 0xfc}}, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) ptrace$peek(0xffffffffffffffff, r1, &(0x7f0000000040)) 18:18:35 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$RTC_WKALM_RD(r1, 0x80287010, &(0x7f0000000000)) socket$netlink(0x10, 0x3, 0xe) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:35 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x3, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0xffffffffffffffff, @loopback}, 0x10) sendto$inet(r0, &(0x7f0000001040)="c3", 0x1, 0x1, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000040)="0e", 0x1, 0x24040001, 0x0, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x61, &(0x7f0000000080)={'filter\x00', 0x4}, 0x68) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x4, 0x20010, r0, 0x0) 18:18:35 executing program 2: lstat(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)) ioctl$ASHMEM_SET_SIZE(0xffffffffffffffff, 0x40087703, 0x10fffc) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x11, 0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x0, 0x0) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000380)) setsockopt(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000001000), 0xc5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r1 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendto$packet(0xffffffffffffffff, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x0) sendfile(r0, r0, &(0x7f0000000000), 0x2000005) listxattr(&(0x7f0000001380)='./file0\x00', &(0x7f00000013c0)=""/21, 0x15) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) socket$inet6_tcp(0xa, 0x1, 0x0) removexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="73656375726974792e2f6465762f66756c6c00df8ea4a00d794b1ca05daaa106484f1f8a2cee2946d4761e7d0a462f339530063d9f17f482e6b872927dd3228e67043b3a1477671ab8"]) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)={0x2, 0xd, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_x_policy={0x8, 0x12, 0x2, 0x2, 0x0, 0x0, 0x0, {0x30, 0x0, 0xffffff03, 0x3, 0x0, 0x0, 0x0, @in6=@loopback, @in=@remote}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x80}}, 0x0) close(0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000080)={0x0, 0x100000001, 0x55, 0x4, 0x7, 0x8}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) dup(0xffffffffffffffff) ioctl$EXT4_IOC_RESIZE_FS(r0, 0x40086610, &(0x7f0000000180)=0x5859) 18:18:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:35 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x2, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x4, @mcast1, 0xfffffffffffffffe}}, 0x0, 0x3, [{{0xa, 0x4e23, 0x66, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) [ 222.841568] binder: 10298:10301 transaction failed 29189/-22, size 0-0 line 3012 [ 222.874483] binder: undelivered TRANSACTION_ERROR: 29189 18:18:35 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='/exe\x00\x00\x00\x00\x00\x00') ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)={0x1, 0x0, 0x81, 0xe4, 0x100000000, 0x8, 0x1, 0x6, 0x400, 0x4}) ioctl$IOC_PR_CLEAR(r0, 0x401070cd, &(0x7f0000000080)={0x1c}) fcntl$setstatus(r0, 0x4, 0x4000) io_setup(0x8000000002, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f0000000100)=[&(0x7f0000000000)={0xd00, 0x0, 0x7, 0x0, 0x0, r0, &(0x7f0000000200), 0xfffffdcc}]) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') 18:18:35 executing program 4: r0 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB='\t\x00\x00\x00\x00\x00\x00\x00'], 0x8) getsockopt$inet6_buf(r0, 0x29, 0x3b, &(0x7f0000000040)=""/164, &(0x7f0000000100)=0xa0) r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000140)='./file0\x00', 0x800, 0x0) ioctl$RTC_PIE_OFF(r2, 0x7006) r3 = socket$netlink(0x10, 0x3, 0x8000000000000004) r4 = getpid() fcntl$lock(r2, 0x25, &(0x7f00000001c0)={0x0, 0x3, 0x7, 0x8, r4}) writev(r3, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) fcntl$dupfd(r1, 0x406, r3) 18:18:35 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff0100000000000000000000000000010000000000fbffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x210) 18:18:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 222.922916] binder: 10320:10323 transaction failed 29189/-22, size 0-0 line 3012 [ 222.955474] binder: undelivered TRANSACTION_ERROR: 29189 18:18:35 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x9) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x20}}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000033e2e000000000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x210) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000003c0)=0x14) setsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f0000000400)={@dev={0xfe, 0x80, [], 0x1a}, r1}, 0x14) 18:18:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:35 executing program 2: lstat(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)) ioctl$ASHMEM_SET_SIZE(0xffffffffffffffff, 0x40087703, 0x10fffc) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x11, 0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x0, 0x0) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000380)) setsockopt(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000001000), 0xc5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r1 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendto$packet(0xffffffffffffffff, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x0) sendfile(r0, r0, &(0x7f0000000000), 0x2000005) listxattr(&(0x7f0000001380)='./file0\x00', &(0x7f00000013c0)=""/21, 0x15) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) socket$inet6_tcp(0xa, 0x1, 0x0) removexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="73656375726974792e2f6465762f66756c6c00df8ea4a00d794b1ca05daaa106484f1f8a2cee2946d4761e7d0a462f339530063d9f17f482e6b872927dd3228e67043b3a1477671ab8"]) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)={0x2, 0xd, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_x_policy={0x8, 0x12, 0x2, 0x2, 0x0, 0x0, 0x0, {0x30, 0x0, 0xffffff03, 0x3, 0x0, 0x0, 0x0, @in6=@loopback, @in=@remote}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x80}}, 0x0) close(0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000080)={0x0, 0x100000001, 0x55, 0x4, 0x7, 0x8}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) dup(0xffffffffffffffff) ioctl$EXT4_IOC_RESIZE_FS(r0, 0x40086610, &(0x7f0000000180)=0x5859) 18:18:35 executing program 1: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x445, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/rt6_stats\x00') r1 = socket$key(0xf, 0x3, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = perf_event_open$cgroup(&(0x7f00000003c0)={0x4, 0x70, 0x5, 0x3, 0x7ff, 0x3, 0x0, 0x6, 0x80, 0x8, 0xffffffffffff0000, 0x7, 0x5, 0x1, 0x3, 0x0, 0x1f, 0x9, 0x2, 0x8000, 0x400, 0x20, 0x0, 0x8001, 0xa5, 0x7, 0x5, 0x1f, 0x9, 0xb53, 0x8, 0x4, 0x7fff, 0x2, 0x8000, 0x8, 0x5, 0x7, 0x0, 0xfffffffffffffffc, 0x4, @perf_bp={&(0x7f0000000380), 0x3}, 0x20000, 0xb0d, 0xe6a9, 0x8, 0xfd, 0xa7b6, 0x3}, r0, 0xd, r2, 0x1) r4 = fcntl$dupfd(r3, 0x406, r2) ioctl$RTC_IRQP_READ(r4, 0x8008700b, &(0x7f0000000180)) socket$inet6(0xa, 0x80806, 0x7ffffffa) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r5, 0x2, 0x81) r6 = socket$inet6(0xa, 0x400000000001, 0x20000000000) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f0000000240)={'sit0\x00'}) clock_gettime(0x0, &(0x7f0000001380)={0x0, 0x0}) setsockopt$sock_timeval(r6, 0x1, 0x15, &(0x7f00000013c0)={r8, r9/1000+30000}, 0x10) r10 = socket$inet6(0xa, 0x1000000000002, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'sit0\x00'}) getsockopt$inet_pktinfo(r5, 0x0, 0x8, &(0x7f0000000280)={0x0, @empty, @broadcast}, &(0x7f00000002c0)=0xc) ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f00000001c0)) sendmsg$nl_route(r11, &(0x7f0000000080)={&(0x7f0000000140), 0xc, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB="14000100fe8000000005000000000000000000aa"], 0x1}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={&(0x7f00000000c0), 0xc, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x807fe) ioctl$EVIOCGMTSLOTS(r12, 0x8040450a, &(0x7f0000000400)=""/241) r13 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r13, &(0x7f0000000340)={&(0x7f0000000080), 0xc, &(0x7f0000000300)={&(0x7f00000003c0)={0x14, 0x42, 0x105}, 0x14}}, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000100), 0x10) ioctl$sock_SIOCBRDELBR(r13, 0x89a1, &(0x7f00000000c0)) [ 223.025001] binder: release 10340:10344 transaction 59 out, still active [ 223.057980] binder: undelivered TRANSACTION_COMPLETE 18:18:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180), 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000080)={{{@in=@multicast1, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@multicast1}}, &(0x7f0000000180)=0xe8) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = geteuid() lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='system.posix_acl_access\x00', &(0x7f0000000400)={{}, {0x1, 0x4}, [{0x2, 0x7, r1}, {0x2, 0x4, r2}, {0x2, 0x4, r3}], {0x4, 0x6}, [{0x8, 0x7, r4}, {0x8, 0x0, r5}], {0x10, 0x1}, {0x20, 0x3}}, 0x4c, 0x2) [ 223.082673] binder: send failed reply for transaction 59, target dead 18:18:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:35 executing program 2: open(&(0x7f00000000c0)='./file1\x00', 0x40140, 0x81) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) write$UHID_INPUT(r0, &(0x7f00000007c0)={0x8, "f5a68ff5b721a5de4ec10d79fbec0b4901c1211903adc48c79a88a78caa6b1ce317171b16fe550b3a3d21c1910284101fca086b01bbfe0526f8d36a43cfe4d60930c8b93bd1c92b7ce9f7d02c98b19ad4607a1159c7f24da24159bd691ff5bf53775a5059d63b6435190efe0a7c84bf22a27abe385c169c0b4b8618f8f444aa225a2bd3adb3c0b45a2152b0db3c0f563a5963d469844868784990f211817606e63b5e2a183762b7668287bcbe6ba640719e26be55240442564737bc8e0b6a395585acb0532134e879bffa6b7a3efa93fb2e5e82998eaa69223dda2bf27015ab80416b215eb1ca4dfde6d3a38675db4755521b43ea238c3eb321f168e53f7cdba28c6249cb8508d49a775e6c63cd82249f77eb73153d23712c1f421622c25b00873cf6d39dfb714c0a27e23a08d3cb95a3baa481cd5f59b385147119eb27c1c797b654efde3c0b84fc1021217377ab7cab850a8eac61d84a8f96587d0e014d2db6b3feebdddc522d8b6e4944cf855fb5f15c738f899500560aca02e0cf029e3b3e4facf16d2757ae178020bf972784421c6a5f09d377a774ba1d0150921dde8590b2ece70b0ac9376d19fe91cb610090d755b9a0220977ea9df341909a179c0e85f63718f66bc9ca38c0c31740820a8be259a6d7f5c0008ac67026840845fc103f73c29fc4fba6de98273e7c1feaf47dc3d952420370bd127c5a8f1a795a8e5420a071a8973fb82391e9f684c36c9c0a0c645c4ff1233c5fb6b67a442365af09fbb0e8cfc9440f4554e024f9ccb3161ce8f0ea301762bb591c92b8e785b10e8a266fcbcc262a49c57103a56f7b42db76eefc4f17a6b7b19cc158761f939b544ac704845600c6cfbd36906df82bdeb5dd39c8c59f16ba1529b80405d5ef2aa232cd18779a7ddea04a833c9b93f34312bdf536baaead5b3c8ea6fafa747f8bfd9d72d5138adb9ca3246eb1fd3df953a8a2f60ac436af0d587b78b6d767b1c110540831a603766d6dacf39cf14c0d1ec6bea100a47f651cf7d515cee9bc0b952c2cd61e2d448bc6745abc192101b0179c366993482c140d642f282919500d85e1daa921f37a79662823a4f4174d762f9affe2475ed6dc9b820e6ac99684903da5f19fb914bf71260ba60fb111f4732df99a284a33825e73ad21832f1c1769d26e966e542248f1e1a0a93fe0464f6d610853ec41a3b5efa2590ce7726c8aaef82e8e0341360aacaf8c4c142fc4d9dd15cff3c2a287a9832447ebcc78a690ca86df3d1a209c538a97f61f419a3e1ea9aac045ed619a34e9d792255f044676bbb51aba745a2688eaa8e0389ec82c7dfc1af899227d63cfecb3e722cac73efb3f36715f66f4f6a203012ad3d9c20b96fd017711b08bb13fa876c37866f68db04eab49f4fe5df21196ccbb1f65367e70e39fd74897251800cc334b3e67bd79c32f9e9d2ce9468a5336ed34c13926bae4b10e26c93062c21573f140b626e694a155022e10e629605532a665badf3dd0e706aab9885b46811a7f71b0d21636352a3a7f3e291dfad9f88df5524548c1ab2c025e50327fb09625b9af041cf3cf0abf99ebb529046dea4ae5a7c5eae6edf73ff73af23ae25f91373dd90f42f29e63e84f8c1fbba4ab7240ed92799cdbf1627353d0a3b83e0460b3b635f112b1fa81c3dfa834f6a5b93dc06f239d0338f463b1b9973bf9a6b371dd409c45a18114e7b0194065bf9db6d36496bc612db328bf5ac9e513ab282c841d6c282ad2e7ef97eac19f34442a28163f1e58b156a4f29a70f361694f3ba90caf6cd35b521a6fbafdfcd13d4a2dbabff3ad6f67b9f054eb7316d8418337bd8d29508f68bd88108e6ca5d1622efae6663882d19e44431832a1c01bb0df119a98c5623a7b7b79b8f9ec7c32c79f96888b1ce0f3cc6cfb4747f531c6a5a7cc6616fe05e2147a6e6211a8b1f4390954632b0f9bd1d2a9110b0c70ef24dba7706334c6e667b630a48d62977d9d3c91e4071f026d398f0ef41482d71649264805e83dc0b49ac40ccbe808dc45b277020c504d529566ef2102f839ef34e80c2138596f2d62b8208475a58f12a9e8253f4aecce1e7cdcd869c145eec4d5d944285225505698dea82da669c979e1a9223ddbb4701ea552477c6d260e419591e521a5c46cf016a07e005aeb7956360e2bdd996231e7584d0bea1a36dda708e57a6fc7817aaca7948222712f501ab99837a8882e6f903a7b53327f83b78b7e1cf312aabc161ebf464a053ac0c8714d1a10bf3d13ac3f821d49d0b1f839dd8c437b6ec4ae8957402c22341a651a6783dee38efe46b94deb3aa35da12946d2b6d8bd696c2688aef0ec97f98fb5bc61831d45c1c0d0b8776d4c22857e85647932371587d865218e741e0ba545393ebd4644623432dfe0bbc606d01cce67041b2aa5e4e6c2a275f7019983e2e00db7d3daea01008f22a454c538a317727cd5765dac13178edc13fbf78c1fdaf8253e3e40e594e8d3c4664df9127b742f18ed1d5a955150323c68365496750966eee9ede9da889adae384cc23b3b3b704ce9d32fd61f7c2810b3f7273adfe9d0ef1f6e6f77ea518169ae6115908c2455b208a1a0fcd435fc50c4bcbc8655e4b22177e791aa2611d4ab0eb3467609cff07d541bbe2b6595c6839c31902ed7f54307ce636beb99d9919849236b6a7d61298f5d8314fc5522b4c8b7019dd43f83b7e3f95fcb418f7b84fc26f0b709f20eb01b2577c7d43ec576c69961aa1d8c7ac4e6871d0ac09c6ac0063720282407af6ec9d2e6073fbfc3e9a59dde69dda814e7ee01fb60f53af4959fda201d8d442a4edfc8e96f8b6917173c3e98abc7b794794e51453138a4df71eadde7125769b13ef7b0c4477673d9ad101952ad8bd1f375c27e532cfc1a76db07f8f0dad43c777f1a0de1ec5f5fbb0f43a00f7844438395c93d1471b129132af4f29bc4f5c07bfe2edb6ccb03ba7073d66f18efff13668bf149a7bc3220b1f14452ae12e0fd1bb612059040affc406d1a7b0f1e4d570e7da813b87ba0e83f2be9a212b661ec7899b1e13ff2c2929651a942139db48ca4741f90081c9776dea49ac1baa85308667bf25bb0419a73ba26465d11e41ca946babca3394869e03297b08992837ebb979a47845fe2427689b5a99bac23ea484856c06f4a23f678afa7553a7b92141383277c5b2c69ecccd0b7fd29ca2fe60cdd25a9a5e01a44e8862422c3b46d6eef0e7dd095e468a2912266c402c529f312bd04d2e385298e9ab707ab1cd5b31b8c9ddae60330fd8b4b86a10267680a73126b775b984a908c7067ad3988ec620276bbab6320a2ef33e2a201ec34b11386f370fe5211c07b255247acb93b4ea916b6555719c21f50114823d5b7c8b8f87931948aa4b0e42de939aaeea5663d4a5989c85a677b428e9b1d1150dfe1ca4c954bbc68b81f50b7dc1313ff000b57a429d8e2577dc13105f0cc732f69577d40fe37ba87f2daec5b67ab476634f9a388eeeb9ac30fd86265aefea6b533e21ac05a74ff9e68abf04a7c1b0821ffcd0716a04c71d8b443844779182c775e56d750d197ca6621db276ef96750ccddede1d321f4bcf84b216db559095e4cbe836dd2f9e9b4f504ed9fa4040d51289ee52aea30a38086d6b9eac4e951835ca48985b35c30738cdbe264263780e0267b2384f54e9e604a404408d6faa487a3ebd234b31a97f009fca852da9312548cded347097c373267af175936eefeff58c60ce8d97b0a2c18d56cef1c6a88232bcda8a38c35f1b0af97869d438da448ee8fb4de828edd1e91987bedf4b8af4806437ba6bf0d114aeb4425eb54714c87ea6f18fa56b78f64d3a1247d6425a1bdb88118695e3e19edcd8d831b9c58a81961e24417f1e0fc6942d7c753034ded2a905745987badd20eb080a89db3dd126db163126abba345c19069bd5f1bbe58bdc73919ff2a583713bcc1d11dc1e1b38e972aeed2fe7d68af799c8469d6958ca10fd55007ec8e9183fc7a63d0e11b8ec3fbc44a08153279f941f621dde03d98f8d997201c9ac7df57f0e7084b50f20737dd5046536b022bc40af0215f4cbe80c8a967a03fa3a32814c09ee110f46bb579198fa4fc3a1b3a3c044b3441e7d0a605ab749bbf046619e5121c06697b67f129269236b3169ea0680b47e21729b4f55282777b17e1f9498982b23a6a20d75bb0343af48e2cb37d109cfd04a010a6b9f94025bdc2110d0ce77d96c0748fac497675813910e38fd2a4927d71b104d50297bfc81f8f717aa857d0be1956ef205f3e0a7222922ec76a3bc7d0d15f7ac7f1126ebcbbb69494869c3e519ac250e83287261eb65afd6112bf0697ad2d846d291ac390ce76c0e9182cbf51ffea17d53c41d4f1f01161608d30eca76aae4cfd24afc2c8cb61a962a351ae847a6957f9691057306e70ed32914578cc0e7644b843d415cb311a7460be240f2b5dd6b9561ccd862dd473398d571e19ad3d861502bdde17feba8e2dde9cc113be35f92a385403a935fa4f1b34d9a5c1f5802ca1fc4817a54a162c01b4ffeba9504fb911cd3b983e54ab2f3178e952852a0415fe332ce78f0881fe0b64e5e5bfb4563b8f0fa612bf4d0e973d1c3925bcea86dcdf17d074441e24c646d440813b181ab53ea91ef02673a7a21d4f993aef4bab0e0e9f6865818518e2a03f11567fecbc25d1c64edc8187b7116e23f8593d62cefee8f1a6ea083e881598174fdf4c89b24a862d878bfc07a8c056bd535a0387a5023705ffcd991a896bbe346e3eb094451e8b5e6ad513d5338705ef2334bb6be49627afb63149702f99c825454e064ae9d058f847dafe039d2f98dc0f37c19495346c45f72ba2d734c101ca1054987c7e1fa1a4c5b9a26106d0c0a6d8ddb7359b1636c3302e9aca519516fb8bca8cc940d11fa8332667ec9d822e2d790adccaaf9b779296e5ffdf944fd25a8da9f1663bf980b3ac45773404bc1945a1ea30f3f53d0c351451875b0c12fd57014c41c2540144d041f7077bd13b64e73d4cc81e30446933fba067a18b889b67d81bec29b6cce569509da0761445951e4fae53848ccdcb8ac08f013e49c91f7b0a76f0fed75dab32681c6b424f6ba56abbe15dbe3bb61f88c446531c97193bff1423181cdd94239743093fbbacb833296f360f82f4bfe57d70d992ce8bc71b8b8b6186552d347f5936dc4fffca2dfbdbe44ce5b4786e3e81120a6bcd7a5e19b008cf88c07eac09a887cc1d93e996218efbfcfb032bca1cc55488826ec3b03264f88662329ef30fa0d3875e093a3ec7a84004969b40858a637d48f2990612e2ed52883539a068f1945f1d12d452cddc2a78a6572eed51fc3e91c34331c2329bb506b4a866ed20756139be8681aa2847d7fcc242c1eff5fd8de8e7411ea8d3f063d3e69c18d74112a4cc3af413d0bc0184ba5d46f13fb4001151e0a522741faa7a030e63aabf1cdc729d7fdc10d687e559a0c76176dab6757ba6ad3b9008953fe6ecf7f978747a5f3d79ebbafbbeb468d439046ec42aec348cfdc48e589e4df7457fef22cca7c5863459f1604ae0faeb14e4c9c45554162626433f1bd71562454aba31d697fefe9bc50c0f12138dd11b6c0a0b562dc3b5b1097520e6a6fea8ca90cdac914121b729879b675db5f5c89f5599b3f146c9c5a2c6d11cf88ea302630df7474e806c997dd13e7b4c90c99feff125131ccb6e0cade9c002f547955398ed7e1123d54d8ef5c2f734254a0183d97393beea447d24e3a68fd388d716c124d2a1898c83930f9e31b350d3dfa0d601696dafb04cb34fd4a98acc19", 0xfffffffffffffff2}, 0x1006) r1 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) r2 = dup2(r1, r0) recvfrom$inet(r1, &(0x7f0000000240)=""/245, 0xf5, 0x2021, &(0x7f0000000140)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x3, &(0x7f0000000000)=0x0) sync_file_range(r2, 0x0, 0x4, 0x7) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x2000}]) r4 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) unshare(0x2060400) execveat(r4, &(0x7f0000000200)='./file1\x00', 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x4) [ 223.134565] binder: release 10358:10361 transaction 61 out, still active [ 223.159150] binder: undelivered TRANSACTION_COMPLETE [ 223.187272] binder: send failed reply for transaction 61, target dead [ 223.200145] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 223.221254] binder: release 10370:10371 transaction 63 out, still active 18:18:35 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='/exe\x00\x00\x00\x00\x00\x00') ioctl$TCSETAW(r0, 0x5407, &(0x7f00000000c0)={0x1, 0x0, 0x81, 0xe4, 0x100000000, 0x8, 0x1, 0x6, 0x400, 0x4}) ioctl$IOC_PR_CLEAR(r0, 0x401070cd, &(0x7f0000000080)={0x1c}) fcntl$setstatus(r0, 0x4, 0x4000) io_setup(0x8000000002, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f0000000100)=[&(0x7f0000000000)={0xd00, 0x0, 0x7, 0x0, 0x0, r0, &(0x7f0000000200), 0xfffffdcc}]) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') 18:18:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000000)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a04741f0e03049164643e89720000de213ee23ffbf510040041feff5aff2b0000000000000700", 0x48}], 0x1) 18:18:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:35 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000002e18f28ce311d18b09e8d500000000000001000000000000000000000000000000000000000000000000000000000000000000000010256319aee2d019a97079f3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x210) 18:18:35 executing program 2: open(&(0x7f00000000c0)='./file1\x00', 0x40140, 0x81) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) write$UHID_INPUT(r0, &(0x7f00000007c0)={0x8, "f5a68ff5b721a5de4ec10d79fbec0b4901c1211903adc48c79a88a78caa6b1ce317171b16fe550b3a3d21c1910284101fca086b01bbfe0526f8d36a43cfe4d60930c8b93bd1c92b7ce9f7d02c98b19ad4607a1159c7f24da24159bd691ff5bf53775a5059d63b6435190efe0a7c84bf22a27abe385c169c0b4b8618f8f444aa225a2bd3adb3c0b45a2152b0db3c0f563a5963d469844868784990f211817606e63b5e2a183762b7668287bcbe6ba640719e26be55240442564737bc8e0b6a395585acb0532134e879bffa6b7a3efa93fb2e5e82998eaa69223dda2bf27015ab80416b215eb1ca4dfde6d3a38675db4755521b43ea238c3eb321f168e53f7cdba28c6249cb8508d49a775e6c63cd82249f77eb73153d23712c1f421622c25b00873cf6d39dfb714c0a27e23a08d3cb95a3baa481cd5f59b385147119eb27c1c797b654efde3c0b84fc1021217377ab7cab850a8eac61d84a8f96587d0e014d2db6b3feebdddc522d8b6e4944cf855fb5f15c738f899500560aca02e0cf029e3b3e4facf16d2757ae178020bf972784421c6a5f09d377a774ba1d0150921dde8590b2ece70b0ac9376d19fe91cb610090d755b9a0220977ea9df341909a179c0e85f63718f66bc9ca38c0c31740820a8be259a6d7f5c0008ac67026840845fc103f73c29fc4fba6de98273e7c1feaf47dc3d952420370bd127c5a8f1a795a8e5420a071a8973fb82391e9f684c36c9c0a0c645c4ff1233c5fb6b67a442365af09fbb0e8cfc9440f4554e024f9ccb3161ce8f0ea301762bb591c92b8e785b10e8a266fcbcc262a49c57103a56f7b42db76eefc4f17a6b7b19cc158761f939b544ac704845600c6cfbd36906df82bdeb5dd39c8c59f16ba1529b80405d5ef2aa232cd18779a7ddea04a833c9b93f34312bdf536baaead5b3c8ea6fafa747f8bfd9d72d5138adb9ca3246eb1fd3df953a8a2f60ac436af0d587b78b6d767b1c110540831a603766d6dacf39cf14c0d1ec6bea100a47f651cf7d515cee9bc0b952c2cd61e2d448bc6745abc192101b0179c366993482c140d642f282919500d85e1daa921f37a79662823a4f4174d762f9affe2475ed6dc9b820e6ac99684903da5f19fb914bf71260ba60fb111f4732df99a284a33825e73ad21832f1c1769d26e966e542248f1e1a0a93fe0464f6d610853ec41a3b5efa2590ce7726c8aaef82e8e0341360aacaf8c4c142fc4d9dd15cff3c2a287a9832447ebcc78a690ca86df3d1a209c538a97f61f419a3e1ea9aac045ed619a34e9d792255f044676bbb51aba745a2688eaa8e0389ec82c7dfc1af899227d63cfecb3e722cac73efb3f36715f66f4f6a203012ad3d9c20b96fd017711b08bb13fa876c37866f68db04eab49f4fe5df21196ccbb1f65367e70e39fd74897251800cc334b3e67bd79c32f9e9d2ce9468a5336ed34c13926bae4b10e26c93062c21573f140b626e694a155022e10e629605532a665badf3dd0e706aab9885b46811a7f71b0d21636352a3a7f3e291dfad9f88df5524548c1ab2c025e50327fb09625b9af041cf3cf0abf99ebb529046dea4ae5a7c5eae6edf73ff73af23ae25f91373dd90f42f29e63e84f8c1fbba4ab7240ed92799cdbf1627353d0a3b83e0460b3b635f112b1fa81c3dfa834f6a5b93dc06f239d0338f463b1b9973bf9a6b371dd409c45a18114e7b0194065bf9db6d36496bc612db328bf5ac9e513ab282c841d6c282ad2e7ef97eac19f34442a28163f1e58b156a4f29a70f361694f3ba90caf6cd35b521a6fbafdfcd13d4a2dbabff3ad6f67b9f054eb7316d8418337bd8d29508f68bd88108e6ca5d1622efae6663882d19e44431832a1c01bb0df119a98c5623a7b7b79b8f9ec7c32c79f96888b1ce0f3cc6cfb4747f531c6a5a7cc6616fe05e2147a6e6211a8b1f4390954632b0f9bd1d2a9110b0c70ef24dba7706334c6e667b630a48d62977d9d3c91e4071f026d398f0ef41482d71649264805e83dc0b49ac40ccbe808dc45b277020c504d529566ef2102f839ef34e80c2138596f2d62b8208475a58f12a9e8253f4aecce1e7cdcd869c145eec4d5d944285225505698dea82da669c979e1a9223ddbb4701ea552477c6d260e419591e521a5c46cf016a07e005aeb7956360e2bdd996231e7584d0bea1a36dda708e57a6fc7817aaca7948222712f501ab99837a8882e6f903a7b53327f83b78b7e1cf312aabc161ebf464a053ac0c8714d1a10bf3d13ac3f821d49d0b1f839dd8c437b6ec4ae8957402c22341a651a6783dee38efe46b94deb3aa35da12946d2b6d8bd696c2688aef0ec97f98fb5bc61831d45c1c0d0b8776d4c22857e85647932371587d865218e741e0ba545393ebd4644623432dfe0bbc606d01cce67041b2aa5e4e6c2a275f7019983e2e00db7d3daea01008f22a454c538a317727cd5765dac13178edc13fbf78c1fdaf8253e3e40e594e8d3c4664df9127b742f18ed1d5a955150323c68365496750966eee9ede9da889adae384cc23b3b3b704ce9d32fd61f7c2810b3f7273adfe9d0ef1f6e6f77ea518169ae6115908c2455b208a1a0fcd435fc50c4bcbc8655e4b22177e791aa2611d4ab0eb3467609cff07d541bbe2b6595c6839c31902ed7f54307ce636beb99d9919849236b6a7d61298f5d8314fc5522b4c8b7019dd43f83b7e3f95fcb418f7b84fc26f0b709f20eb01b2577c7d43ec576c69961aa1d8c7ac4e6871d0ac09c6ac0063720282407af6ec9d2e6073fbfc3e9a59dde69dda814e7ee01fb60f53af4959fda201d8d442a4edfc8e96f8b6917173c3e98abc7b794794e51453138a4df71eadde7125769b13ef7b0c4477673d9ad101952ad8bd1f375c27e532cfc1a76db07f8f0dad43c777f1a0de1ec5f5fbb0f43a00f7844438395c93d1471b129132af4f29bc4f5c07bfe2edb6ccb03ba7073d66f18efff13668bf149a7bc3220b1f14452ae12e0fd1bb612059040affc406d1a7b0f1e4d570e7da813b87ba0e83f2be9a212b661ec7899b1e13ff2c2929651a942139db48ca4741f90081c9776dea49ac1baa85308667bf25bb0419a73ba26465d11e41ca946babca3394869e03297b08992837ebb979a47845fe2427689b5a99bac23ea484856c06f4a23f678afa7553a7b92141383277c5b2c69ecccd0b7fd29ca2fe60cdd25a9a5e01a44e8862422c3b46d6eef0e7dd095e468a2912266c402c529f312bd04d2e385298e9ab707ab1cd5b31b8c9ddae60330fd8b4b86a10267680a73126b775b984a908c7067ad3988ec620276bbab6320a2ef33e2a201ec34b11386f370fe5211c07b255247acb93b4ea916b6555719c21f50114823d5b7c8b8f87931948aa4b0e42de939aaeea5663d4a5989c85a677b428e9b1d1150dfe1ca4c954bbc68b81f50b7dc1313ff000b57a429d8e2577dc13105f0cc732f69577d40fe37ba87f2daec5b67ab476634f9a388eeeb9ac30fd86265aefea6b533e21ac05a74ff9e68abf04a7c1b0821ffcd0716a04c71d8b443844779182c775e56d750d197ca6621db276ef96750ccddede1d321f4bcf84b216db559095e4cbe836dd2f9e9b4f504ed9fa4040d51289ee52aea30a38086d6b9eac4e951835ca48985b35c30738cdbe264263780e0267b2384f54e9e604a404408d6faa487a3ebd234b31a97f009fca852da9312548cded347097c373267af175936eefeff58c60ce8d97b0a2c18d56cef1c6a88232bcda8a38c35f1b0af97869d438da448ee8fb4de828edd1e91987bedf4b8af4806437ba6bf0d114aeb4425eb54714c87ea6f18fa56b78f64d3a1247d6425a1bdb88118695e3e19edcd8d831b9c58a81961e24417f1e0fc6942d7c753034ded2a905745987badd20eb080a89db3dd126db163126abba345c19069bd5f1bbe58bdc73919ff2a583713bcc1d11dc1e1b38e972aeed2fe7d68af799c8469d6958ca10fd55007ec8e9183fc7a63d0e11b8ec3fbc44a08153279f941f621dde03d98f8d997201c9ac7df57f0e7084b50f20737dd5046536b022bc40af0215f4cbe80c8a967a03fa3a32814c09ee110f46bb579198fa4fc3a1b3a3c044b3441e7d0a605ab749bbf046619e5121c06697b67f129269236b3169ea0680b47e21729b4f55282777b17e1f9498982b23a6a20d75bb0343af48e2cb37d109cfd04a010a6b9f94025bdc2110d0ce77d96c0748fac497675813910e38fd2a4927d71b104d50297bfc81f8f717aa857d0be1956ef205f3e0a7222922ec76a3bc7d0d15f7ac7f1126ebcbbb69494869c3e519ac250e83287261eb65afd6112bf0697ad2d846d291ac390ce76c0e9182cbf51ffea17d53c41d4f1f01161608d30eca76aae4cfd24afc2c8cb61a962a351ae847a6957f9691057306e70ed32914578cc0e7644b843d415cb311a7460be240f2b5dd6b9561ccd862dd473398d571e19ad3d861502bdde17feba8e2dde9cc113be35f92a385403a935fa4f1b34d9a5c1f5802ca1fc4817a54a162c01b4ffeba9504fb911cd3b983e54ab2f3178e952852a0415fe332ce78f0881fe0b64e5e5bfb4563b8f0fa612bf4d0e973d1c3925bcea86dcdf17d074441e24c646d440813b181ab53ea91ef02673a7a21d4f993aef4bab0e0e9f6865818518e2a03f11567fecbc25d1c64edc8187b7116e23f8593d62cefee8f1a6ea083e881598174fdf4c89b24a862d878bfc07a8c056bd535a0387a5023705ffcd991a896bbe346e3eb094451e8b5e6ad513d5338705ef2334bb6be49627afb63149702f99c825454e064ae9d058f847dafe039d2f98dc0f37c19495346c45f72ba2d734c101ca1054987c7e1fa1a4c5b9a26106d0c0a6d8ddb7359b1636c3302e9aca519516fb8bca8cc940d11fa8332667ec9d822e2d790adccaaf9b779296e5ffdf944fd25a8da9f1663bf980b3ac45773404bc1945a1ea30f3f53d0c351451875b0c12fd57014c41c2540144d041f7077bd13b64e73d4cc81e30446933fba067a18b889b67d81bec29b6cce569509da0761445951e4fae53848ccdcb8ac08f013e49c91f7b0a76f0fed75dab32681c6b424f6ba56abbe15dbe3bb61f88c446531c97193bff1423181cdd94239743093fbbacb833296f360f82f4bfe57d70d992ce8bc71b8b8b6186552d347f5936dc4fffca2dfbdbe44ce5b4786e3e81120a6bcd7a5e19b008cf88c07eac09a887cc1d93e996218efbfcfb032bca1cc55488826ec3b03264f88662329ef30fa0d3875e093a3ec7a84004969b40858a637d48f2990612e2ed52883539a068f1945f1d12d452cddc2a78a6572eed51fc3e91c34331c2329bb506b4a866ed20756139be8681aa2847d7fcc242c1eff5fd8de8e7411ea8d3f063d3e69c18d74112a4cc3af413d0bc0184ba5d46f13fb4001151e0a522741faa7a030e63aabf1cdc729d7fdc10d687e559a0c76176dab6757ba6ad3b9008953fe6ecf7f978747a5f3d79ebbafbbeb468d439046ec42aec348cfdc48e589e4df7457fef22cca7c5863459f1604ae0faeb14e4c9c45554162626433f1bd71562454aba31d697fefe9bc50c0f12138dd11b6c0a0b562dc3b5b1097520e6a6fea8ca90cdac914121b729879b675db5f5c89f5599b3f146c9c5a2c6d11cf88ea302630df7474e806c997dd13e7b4c90c99feff125131ccb6e0cade9c002f547955398ed7e1123d54d8ef5c2f734254a0183d97393beea447d24e3a68fd388d716c124d2a1898c83930f9e31b350d3dfa0d601696dafb04cb34fd4a98acc19", 0xfffffffffffffff2}, 0x1006) r1 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) r2 = dup2(r1, r0) recvfrom$inet(r1, &(0x7f0000000240)=""/245, 0xf5, 0x2021, &(0x7f0000000140)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x3, &(0x7f0000000000)=0x0) sync_file_range(r2, 0x0, 0x4, 0x7) io_submit(r3, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x2000}]) r4 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) unshare(0x2060400) execveat(r4, &(0x7f0000000200)='./file1\x00', 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x4) [ 223.254439] binder: undelivered TRANSACTION_COMPLETE [ 223.265052] binder: send failed reply for transaction 63, target dead 18:18:35 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x800, @mcast1, 0x6fe}, 0x1c) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) 18:18:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 223.322688] binder: 10389:10395 ioctl c0306201 0 returned -14 [ 223.350325] binder: release 10389:10395 transaction 65 out, still active [ 223.362642] binder: undelivered TRANSACTION_COMPLETE [ 223.390835] binder: send failed reply for transaction 65, target dead [ 223.424402] binder: 10409:10410 ioctl c0306201 0 returned -14 [ 223.445000] binder: release 10409:10410 transaction 67 out, still active [ 223.456986] binder: undelivered TRANSACTION_COMPLETE [ 223.469217] binder: send failed reply for transaction 67, target dead 18:18:36 executing program 2: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) exit(0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000180)) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000040)) socket$nl_route(0x10, 0x3, 0x0) writev(r1, 0x0, 0xffffffffffffff1a) 18:18:36 executing program 4: perf_event_open(&(0x7f000001d000)={0xfffffffffffffffd, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x10000, 0x0) ioctl$KDGETKEYCODE(r1, 0x4b4c, &(0x7f0000000040)={0x100000001, 0x8}) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:36 executing program 0: setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000d4b000)={0x9, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) 18:18:36 executing program 1: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x445, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/rt6_stats\x00') r1 = socket$key(0xf, 0x3, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = perf_event_open$cgroup(&(0x7f00000003c0)={0x4, 0x70, 0x5, 0x3, 0x7ff, 0x3, 0x0, 0x6, 0x80, 0x8, 0xffffffffffff0000, 0x7, 0x5, 0x1, 0x3, 0x0, 0x1f, 0x9, 0x2, 0x8000, 0x400, 0x20, 0x0, 0x8001, 0xa5, 0x7, 0x5, 0x1f, 0x9, 0xb53, 0x8, 0x4, 0x7fff, 0x2, 0x8000, 0x8, 0x5, 0x7, 0x0, 0xfffffffffffffffc, 0x4, @perf_bp={&(0x7f0000000380), 0x3}, 0x20000, 0xb0d, 0xe6a9, 0x8, 0xfd, 0xa7b6, 0x3}, r0, 0xd, r2, 0x1) r4 = fcntl$dupfd(r3, 0x406, r2) ioctl$RTC_IRQP_READ(r4, 0x8008700b, &(0x7f0000000180)) socket$inet6(0xa, 0x80806, 0x7ffffffa) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r5, 0x2, 0x81) r6 = socket$inet6(0xa, 0x400000000001, 0x20000000000) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f0000000240)={'sit0\x00'}) clock_gettime(0x0, &(0x7f0000001380)={0x0, 0x0}) setsockopt$sock_timeval(r6, 0x1, 0x15, &(0x7f00000013c0)={r8, r9/1000+30000}, 0x10) r10 = socket$inet6(0xa, 0x1000000000002, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'sit0\x00'}) getsockopt$inet_pktinfo(r5, 0x0, 0x8, &(0x7f0000000280)={0x0, @empty, @broadcast}, &(0x7f00000002c0)=0xc) ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f00000001c0)) sendmsg$nl_route(r11, &(0x7f0000000080)={&(0x7f0000000140), 0xc, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB="14000100fe8000000005000000000000000000aa"], 0x1}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={&(0x7f00000000c0), 0xc, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x807fe) ioctl$EVIOCGMTSLOTS(r12, 0x8040450a, &(0x7f0000000400)=""/241) r13 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r13, &(0x7f0000000340)={&(0x7f0000000080), 0xc, &(0x7f0000000300)={&(0x7f00000003c0)={0x14, 0x42, 0x105}, 0x14}}, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000100), 0x10) ioctl$sock_SIOCBRDELBR(r13, 0x89a1, &(0x7f00000000c0)) 18:18:36 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet6_buf(r0, 0x29, 0xdf, &(0x7f0000000000)=""/6, &(0x7f0000000040)=0x6) r1 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r1, 0x29, 0x16, &(0x7f0000fcb000), 0x4) r2 = socket$inet6(0xa, 0x80003, 0xff) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000180)) setsockopt$inet6_int(r2, 0x29, 0x16, &(0x7f0000fcb000), 0x4) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) fsetxattr$trusted_overlay_origin(r3, &(0x7f0000000100)='trusted.overlay.origin\x00', &(0x7f0000000140)='y\x00', 0x2, 0x3) ioctl$TCSETS(r3, 0x5402, &(0x7f00000000c0)={0x7, 0xfdb, 0x7, 0x9, 0x6, 0xb34, 0x40, 0x5, 0x6, 0x100, 0xffffffffffffff34, 0xfffffffffffffe01}) 18:18:36 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a000092edb6f75ee7341000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x210) r1 = getpgrp(0x0) getpgid(r1) [ 223.555352] binder: 10418:10422 ioctl c0306201 0 returned -14 [ 223.569825] binder: release 10418:10422 transaction 69 out, still active 18:18:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:36 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="d0d9ee26c5b6915a7bd1ffadb3e552085b39cccfd2fc664e02caac398a10288024e3647b4b3d29fe7f4b6c8a72293e7edce3f1c088144846a97fbc484a1ab76af6046aeed9f1fb3358625866b848cf7859e18b7c4ac99bfa0cdc1812099d096ab3a44bb63ff65072f7f1888020ed46725c6909e1dab5ff61ec72b62356a9b7229ae48ff2f88e161277cb766c3a73501374b44847cd9be36a791c88a96dc335d8033aef81c810ffb71d35b3b6e8f7e0d607b686aaf6aaccae15ac35453e5d", 0xbe}, {&(0x7f00000001c0)="b505fb5a589cd5446ece66acf112446a06d7c55940a1d3a594457dfa8765a14693555938d2695edfa2a9980f909bf7dc38b6662fe9b4d44de66f306f7f38d452f4499c025af9bc68a6ad8018f6e82265acde42343decfb33f70810380407de8a7c93c3b838f40e0a3e9e0b60b0684c41b0e40fa8ecda591f027f6e13c7e2eec305fc58f2e802cd6de30bd094ccd930fe1ff02074ebcee1a93a89a32d10360f372a679c1693e6cb9413e9ef2bd20955f37877c6fe8227ae17e3d65fa1672785f11cf5a2fbd27011980956f2575cec3e94c25a903040c177c09b7bf6d0ee23d7cec73192229c45b249090268a0b544d7b48117c4858569bec17982b01b7e", 0xfd}, {&(0x7f00000000c0)="17810fa05817e90fd06889f107e1bc861d1e516883484f52494a51bd31270c9be3c66bf1417fdcb90dd48b2a3f62f2df0a5d4fff3581b385f555890f3a63bd8220aaafdedbed5cb51c1e4b70ca28022c9f5f5dbe07ce19cbd1d8db906be2b1952714164fea26ce39c9a1282e876f85ad4fdb492440262b95e3db", 0x7a}, {&(0x7f0000000140)="888e3d89d176603525c14826bb219eaea13d9753f41b80c1965c0d06b45a5cdd8aaa0aed46b6d606464ab2a9e73d898018914804f9", 0x35}], 0x4) 18:18:36 executing program 0: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) sendto$inet(r0, &(0x7f0000000280)="1bd6b9eca4f201cf5cd7450651d301b372e71d67847f76ae93c813a764a068d5d012b71874bf49ee54b32ce3a00bf67699a3fa45261167895044b708596edd37657f8d96c6a498b5949c7a9c4f286d712426a6296b4ae53c08be5b442abe36fb3c0fb324e65290263d5687f33855c60a911ad5ffae105cb6a409f2553f643d2b06241d7445f6c5bc68269fd42ffd9d42ec0228356bbb8d021dec70ab81426fc9095a65436979", 0xa6, 0x40080, &(0x7f0000000240)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) r1 = socket$inet(0x2, 0xf, 0x100) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/current\x00', 0x2, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=@delsa={0x234, 0x11, 0x400, 0x70bd26, 0x25dfdbff, {@in6=@remote, 0x4d3, 0xa, 0xff}, [@tfcpad={0x8, 0x16, 0x10001}, @tmpl={0x204, 0x5, [{{@in6=@local, 0x4d4, 0xff}, 0x2, @in6=@ipv4={[], [], @local}, 0x3500, 0x3, 0x0, 0x80000000, 0x2, 0xffffffffffffffe0, 0xffffffff}, {{@in6=@ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x19}}, 0x4d3, 0xff}, 0x2, @in=@empty, 0x3500, 0x4, 0x0, 0x100000000, 0x1f, 0x8, 0x1}, {{@in=@rand_addr=0x3f, 0x4d3, 0x33}, 0x2, @in6, 0x0, 0x1, 0x0, 0xfff, 0xecf, 0x8000, 0x1}, {{@in6=@mcast1, 0x4d2, 0xff}, 0xa, @in=@broadcast, 0x3501, 0x1, 0x0, 0x10000, 0x3, 0x1, 0x6}, {{@in6=@loopback, 0x4d2, 0x33}, 0x2, @in6=@dev={0xfe, 0x80, [], 0x17}, 0x3503, 0x4, 0x0, 0x3ff, 0x8, 0x0, 0x6}, {{@in=@rand_addr=0x3f, 0x2, 0x2b}, 0x2, @in6=@mcast2, 0x34ff, 0x2, 0x3, 0x5, 0x1, 0x7fff, 0x8}, {{@in6, 0x4d4, 0x2b}, 0x0, @in=@loopback, 0x3505, 0x2, 0x0, 0x7ff, 0x101, 0x80000001, 0x2}, {{@in6=@loopback, 0x4d5, 0xff}, 0xa, @in6=@loopback, 0x34ff, 0x0, 0x1, 0x4, 0x3f, 0x1, 0x10001}]}]}, 0x234}, 0x1, 0x0, 0x0, 0x40}, 0x8001) ioctl$FICLONE(r1, 0x40049409, r2) r3 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) ioctl(r3, 0x3, &(0x7f0000000000)="75c6bfb892c87c245108698dd7f3df4e1d7782e14cc4aedb660f2d8172d74f34dcce61d809f4fee0afd21e0b1eb93b989ca96bfdd2ca71884caf461f180c49542ce4d2926adec1e1992ce5884a8d65b90041c38adece060d125fa6f0a5b5070c4dcdafd5c363d8b05e26624223e237c371e6a2d34c881430e19d76567eba3a08b093b4e7a7d36d860609dac319c1afa22497ad5bdd0ed3b269fa376dff1e2748fdc7941c046952b4c683a6fc356e1e740f335c124a6c9ebcbac8098562318137362528ce0e2fe4799a9a0774a646f4110243d51442b07322d7e5d3488c6a3295b25e49c83958d56fd88f338e60aaf6907590698fb460") setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) 18:18:36 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet6_buf(r0, 0x29, 0xdf, &(0x7f0000000000)=""/6, &(0x7f0000000040)=0x6) r1 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r1, 0x29, 0x16, &(0x7f0000fcb000), 0x4) r2 = socket$inet6(0xa, 0x80003, 0xff) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000180)) setsockopt$inet6_int(r2, 0x29, 0x16, &(0x7f0000fcb000), 0x4) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) fsetxattr$trusted_overlay_origin(r3, &(0x7f0000000100)='trusted.overlay.origin\x00', &(0x7f0000000140)='y\x00', 0x2, 0x3) ioctl$TCSETS(r3, 0x5402, &(0x7f00000000c0)={0x7, 0xfdb, 0x7, 0x9, 0x6, 0xb34, 0x40, 0x5, 0x6, 0x100, 0xffffffffffffff34, 0xfffffffffffffe01}) [ 223.599746] binder: undelivered TRANSACTION_COMPLETE [ 223.605064] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 223.638539] binder: BINDER_SET_CONTEXT_MGR already set [ 223.667194] binder: 10434:10440 ioctl 40046207 0 returned -16 [ 223.667290] binder: send failed reply for transaction 69, target dead [ 223.689712] binder: 10434:10449 transaction failed 29189/-22, size 0-0 line 3012 18:18:36 executing program 3: mkdir(&(0x7f0000000a40)='./file0\x00', 0x4) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='Zamfs\x00', 0x1, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000b80)='/dev/uinput\x00', 0x802, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000b40)) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) setsockopt$netlink_NETLINK_RX_RING(r2, 0x10e, 0x6, &(0x7f0000000500)={0x7fffffff, 0xfffffffffffeffff, 0x7, 0x80000000}, 0x10) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000380)) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000100)) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xd) renameat2(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000340)='./file0\x00', 0x0) setxattr$security_smack_entry(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000880)='security.SMACK64EXEC\x00', &(0x7f00000008c0)='syz1\x00', 0x5, 0x2) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f0000000200), 0x18a) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000900)={{{@in6=@remote, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@empty}}, &(0x7f0000000a00)=0xe8) stat(&(0x7f0000000a80)='./file0\x00', &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, r5) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000480)=@req3={0x0, 0x6, 0x14cbddd4, 0x0, 0x0, 0x0, 0x3}, 0x1c) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000240)={&(0x7f0000000dc0)=ANY=[]}, 0x1, 0x0, 0x0, 0x80}, 0x40000) pivot_root(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000000)='./file0\x00') ftruncate(r2, 0x208200) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r6 = getpid() sched_setscheduler(r6, 0x5, &(0x7f0000000000)) futex(&(0x7f0000000080)=0x2000000000000002, 0x6, 0x0, &(0x7f0000000140)={0x0, 0x989680}, &(0x7f0000000280)=0x1, 0x0) write$uinput_user_dev(r1, &(0x7f0000000400)={'syz1\x00', {0x0, 0x2ad}, 0x25, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000]}, 0x45c) ioctl$UI_DEV_SETUP(r1, 0x5501, &(0x7f0000000300)={{}, "73797a30000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000020000000000000000000000000000006e9b3f5200"}) syz_open_dev$evdev(&(0x7f0000000280)='/dev/input/event#\x00', 0x3, 0x0) ioctl$UI_DEV_DESTROY(r1, 0x5502) fchdir(r0) mknod$loop(&(0x7f00000003c0)='./file0\x00', 0x2400, 0xffffffffffffffff) [ 223.713068] binder: undelivered TRANSACTION_ERROR: 29189 18:18:36 executing program 1: r0 = creat(&(0x7f0000000180)='./file1/file0\x00', 0x0) fadvise64(r0, 0x0, 0x4, 0x1) pwritev(r0, &(0x7f0000003440)=[{&(0x7f0000002400)='I', 0x1}], 0x1, 0x40000) fadvise64(r0, 0x0, 0xffff, 0x4) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f00000001c0)={'tunl0\x00', {0x2, 0x4e20, @multicast2}}) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x301, 0x70bd2c, 0x25dfdbff, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x80}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x4840) open(&(0x7f0000000080)='./file1/file0\x00', 0x140, 0x10) [ 223.800788] input: syz1 as /devices/virtual/input/input10 [ 223.862106] input: syz1 as /devices/virtual/input/input11 [ 224.240161] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! 18:18:36 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)=0x101) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000000c0)=ANY=[@ANYBLOB="000000000000000009000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003f00000000040000ffff000000000000134e00000000000000001900000000000400000000000000000000000000000000000000000000000000000000000000080000000900000006000000000000000400000000000000070000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e3ffffff"]) recvmmsg(r1, &(0x7f0000000040), 0x4000000000000a8, 0x0, 0x0) shutdown(r2, 0x1) 18:18:36 executing program 0: r0 = socket$inet6(0xa, 0x7ffff, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f30000000000000000000000000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000aa31a1b0be9c37bbcccf36d884752a610117681a9dbf9988c05cc"], 0x210) 18:18:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:36 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x1f) prctl$PR_SVE_GET_VL(0x33, 0x771b) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:36 executing program 1: openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00', 0x37}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r2 = dup2(r1, 0xffffffffffffffff) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000180)={0x9, &(0x7f00000000c0)=[{0x100, 0x40, 0x3f, 0x6}, {0x7, 0x8, 0x7, 0x101}, {0x5, 0x4, 0x3, 0x5}, {0x3f, 0x1, 0xfff, 0x7}, {0x7, 0x2, 0x8, 0xfffffffffffffffc}, {0x7, 0x2, 0x5, 0x8}, {0x800, 0x2a, 0xfffffffffffffff9, 0x4}, {0x5, 0xfff, 0x8221, 0xffffffff}, {0x7ff, 0xffff, 0xfffffffffffffffb, 0x8001}]}, 0x10) 18:18:36 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, &(0x7f0000000140)) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@ipv4={[], [], @local}, @in=@dev={0xac, 0x14, 0x14, 0x15}, 0x4e21, 0xfffffffffffffffd, 0x4e20, 0x0, 0xa, 0xa0, 0x0, 0x87}, {0x6, 0xf2, 0x0, 0x0, 0x2e, 0x3, 0x0, 0x8000}, {0x40, 0x8000, 0x9, 0x6}, 0x80000000, 0x6e6bb5, 0x1, 0x1, 0x1}, {{@in6=@ipv4={[], [], @rand_addr=0x25a4}, 0x4d2, 0xff}, 0xa, @in=@remote, 0x3506, 0x3, 0x2, 0x75e, 0x20, 0x0, 0x10001}}, 0xe8) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000180)='trusted.overlay.nlink\x00', &(0x7f00000001c0)={'U-', 0x77}, 0x28, 0x3) set_tid_address(0x0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000100)='/dev/keychord\x00', 0x121800, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)="7374617409c0d2febcf9df2deac8c177ff171248e91193513049f831550d6f7de66cf637bdbf1311920c8a26eda4dcc3783f9db5116b34d31b0512a5608aaff01e7952340cd6fd00000000", 0x275a, 0x0) listen(r1, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000000)) write$binfmt_script(r2, &(0x7f0000000040)=ANY=[], 0x7c774aac) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x800003, 0x8012, r2, 0x0) getdents64(r2, &(0x7f00000003c0)=""/196, 0xc4) 18:18:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:37 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r1, &(0x7f0000000180), 0x0) splice(r1, &(0x7f0000000040), r0, &(0x7f0000000080), 0x3f7, 0x2) flistxattr(r1, &(0x7f0000000000)=""/16, 0x10) clock_adjtime(0x1, &(0x7f00000000c0)={0x7, 0x1, 0x2, 0x100000001, 0x0, 0x9, 0x3c49, 0x2, 0x401, 0x775, 0x72, 0xd181, 0x3, 0x8, 0x2, 0x0, 0xa8, 0xfffffffffffffa40, 0xb2, 0x39e, 0x44, 0x800, 0x7, 0xfffffffffffffffd, 0x6b6, 0x4}) 18:18:37 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x80000000000) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) [ 224.457719] binder: release 10477:10485 transaction 72 out, still active [ 224.466128] binder: undelivered TRANSACTION_COMPLETE [ 224.477919] input: syz0 as /devices/virtual/input/input12 18:18:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:37 executing program 2: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) openat$cgroup(r0, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000003840)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f00000020c0)=""/4096) [ 224.510227] binder: send failed reply for transaction 72, target dead [ 224.542669] binder: release 10493:10495 transaction 74 out, still active 18:18:37 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="01000000000000000a00000000010000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d238643a77f903a1bf6ea84953000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000fcff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000058beb85c80f59319ac715b1f2343f59be37f3e09"], 0x210) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='memory.events\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r1, 0x7709, 0x0) get_thread_area(&(0x7f0000000340)={0x7f8, 0x20101800, 0x5000, 0x9, 0x3, 0x7, 0x52c1, 0x1883, 0x5, 0x7}) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$TIOCGSOFTCAR(r2, 0x5419, &(0x7f0000000740)) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000080)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000000c0)={{{@in6=@mcast2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@mcast2}}, &(0x7f00000001c0)=0xe8) r5 = getpgrp(0xffffffffffffffff) waitid(0x2, r5, &(0x7f00000005c0), 0x40000000, &(0x7f0000000640)) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000200)={{{@in=@remote, @in6=@mcast2, 0x4e22, 0x0, 0x4e21, 0x0, 0xa, 0x20, 0xa0, 0x2e, r3, r4}, {0xfffffffffffffffb, 0x100000000, 0x9, 0xf643, 0xfffffffffffffffb, 0x6, 0x4d, 0xff}, {0x3f, 0x6000000000, 0xfff, 0x800}, 0x2, 0x0, 0x0, 0x1, 0x1, 0x2}, {{@in=@multicast1, 0x4d3, 0xff}, 0xa, @in6=@mcast2, 0x34ff, 0x0, 0x3, 0x9, 0x7, 0x1, 0x6}}, 0xe8) 18:18:37 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0xfffffffffffffffc) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) r2 = dup3(r1, r0, 0x0) prctl$PR_GET_TIMERSLACK(0x1e) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x8001, 0x3, 0x0, 0x3, 0x5, 0x10, "3b43e3e4e8a7b1160cf2ea26ecf299b920cf04152fe3acf7de1eaf94c8d2d5a0cac7649b912fb2a865feff80bc90fc151e8db1f682c3f7914ab347e9f52c669b", "a144b05d06f9a3a05b8fd7f02b1f6db3ec529c303e386b65b7ca5e5a887e93b1cf337af1ca4ec6219adb38474e42a75e53c55be2012abdf030296ccabbd06e5e", "db659e6da76dd10bc79f16571d06b001168bb2cb1f994ee7a22c6cf8110f8728", [0xc84, 0x79]}) syz_execute_func(&(0x7f0000000080)="66410f72d7f6c4831122b50c0000000b66440f3840dbc401796f7c2b000f0141ea6426f2ae6476004656c4c3dd0ef0fbc421fc5af4") getsockopt$IPT_SO_GET_REVISION_MATCH(r2, 0x0, 0x42, &(0x7f00000000c0)={'IDLETIMER\x00'}, &(0x7f0000000100)=0x1e) timerfd_settime(r2, 0x1, &(0x7f0000000000)={{}, {0x77359400}}, &(0x7f0000000040)) 18:18:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:37 executing program 0: mlock2(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) r1 = dup(r0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, r2, 0x0, 0x70bd29, 0x25dfdbfb, {{}, 0x0, 0x410c, 0x0, {0xc, 0x14, 'syz0\x00'}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0xc000}, 0x4000010) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) [ 224.579721] binder: undelivered TRANSACTION_COMPLETE [ 224.594397] binder: send failed reply for transaction 74, target dead 18:18:37 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x20000, 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f00000001c0)={@remote}, &(0x7f0000000200)=0x14) ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000000)=0x10, 0x4) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@remote, 0x0}, &(0x7f0000000100)=0x14) setsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f0000000140)={@remote, @local, r3}, 0xc) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000280)) write(r0, &(0x7f0000000080)="2400000024007f01000000000000ffffffff010002000000000000000000000000000000", 0x24) ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f0000000240)={0x4d0, 0x937, 0x9}) 18:18:37 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0x0, 0x0}) symlink(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000380)='./file0\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) creat(&(0x7f0000000040)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x100) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmmsg(r0, &(0x7f0000008600)=[{{0x0, 0x0, &(0x7f0000003140)}}, {{&(0x7f00000072c0)=@un=@file={0x1, './file0\x00'}, 0xa, &(0x7f0000007380), 0x0, &(0x7f0000000600)}}], 0x2, 0x0) [ 224.646897] binder: send failed reply for transaction 76 to 10506:10509 [ 224.668010] binder: undelivered TRANSACTION_COMPLETE [ 224.686424] binder: undelivered TRANSACTION_ERROR: 29189 [ 224.720114] binder: release 10520:10525 transaction 78 out, still active [ 224.732944] binder: undelivered TRANSACTION_COMPLETE [ 224.743949] binder: send failed reply for transaction 78, target dead 18:18:37 executing program 3: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42c00) write(r1, &(0x7f0000000100)="0800000073adb4d7de5d79a337c355b2599a6d0098ec5614f2e2efa4cad07c97cbd9829b73ff83bb10b1c11d165f7c4ceaa624b61d55ed35606066437a26a27b9b8fc295115205d1be2ff1c73f670f0e928455131424c784ae40f25850391924d1a4fe9b43760f3a6593993f6f850b0b2e646332cdb799a3b601c6f56e70abd731ca89d859419a247891258c2b17d8ba7121d8d7dd7cbb692c0805c863bf74ab8f5bdb98bcedf9dd3a6cd41c032b6f9da1c134b072", 0xfffffef0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 18:18:37 executing program 4: ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000000)=0x0) ptrace$setregs(0xd, r0, 0x80, &(0x7f0000000040)="fe7966507aaaf224ac8c5cef91e02e4af40a") perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:37 executing program 0: r0 = socket$inet6(0xa, 0x6, 0xffffffff) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b9450000000000000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4ce2afd655b94f3629010bd6ce762a5a3e14956205d0553dd3a75ab7be424611aca5a638cfd8ac481f063c01d97edd9f04afb75fc"], 0x210) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffc000/0x3000)=nil) 18:18:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:37 executing program 2: close(0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='\x00\x00\x00\x00\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000000)="6d656d00017937737761532e63757289c942abe3fa72656e7400", 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(&(0x7f00000001c0)=ANY=[], &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) chdir(0x0) write$nbd(r0, &(0x7f00000001c0)={0x67446698, 0x0, 0x1, 0x1, 0x3, "4e5e13b84129f075e0a461e390c1b4f6a2e8de13838fef025ff2c8c65d6ac159b40b3d89868a07cfe241c5e7ae"}, 0x3d) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) ftruncate(r2, 0x208200) r3 = open(&(0x7f0000000200)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r3, 0x0) mknod$loop(&(0x7f0000000400)='./file0\x00', 0x8800, 0xffffffffffffffff) preadv(r1, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/81, 0x20000111}], 0x1, 0x2000107c) r4 = open(&(0x7f00009e1000)='./file0\x00', 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) rt_sigtimedwait(&(0x7f00005a1000), 0x0, 0x0, 0x8) openat$tun(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/net/tun\x00', 0x100000000003, 0x0) epoll_pwait(r4, &(0x7f0000000280)=[{}], 0x1, 0x2, &(0x7f0000000300)={0x9}, 0x8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={0x0}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) 18:18:37 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000040), &(0x7f0000000140)=0x30) syz_open_procfs(0x0, &(0x7f0000000340)='pagemap\x00') openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x40000000) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') geteuid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000b80)={{{@in=@loopback}}, {{@in6=@remote}, 0x0, @in=@remote}}, &(0x7f0000000200)=0xe8) chown(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x200000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x0) 18:18:37 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) r2 = dup2(r0, r1) sendmsg$unix(r2, &(0x7f00000001c0)={&(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000140)=[{&(0x7f0000000080)="875e4bef86ad1112bed20fb0f4dddb4848821e8f3c67b1a7da46eef6f5350efc18d9147e46c8c3e8e832e3c2deb82ee0dd7b805ce3d50f0014d66a52ce1c62dc5454b96110bb3cc51c55d20267a8dffb31f78632e09e489cd5b302f000934ace4cdecd45c0ac9ba7035ddc16517a79e71035298e0f72d87a0dbf63017c1395f3058fa964e4c00029fca6915673306cb170f3a2ac1a4c0e90b9f133718013bd", 0x9f}], 0x1, 0x0, 0x0, 0x4}, 0x80) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:37 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) fstat(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000008b92000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x210) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000002480)=ANY=[@ANYPTR=&(0x7f0000002500)=ANY=[@ANYBLOB="761ec71db78b8ec90d0bc6b4ab8a015461d4513974d89bfd61b8fcd78dd9adba7639e8866519f45c7cf5a62514c8d22bedefd1791e8957a231a12ee0f41e01dd2aee848d35118e5c32db23", @ANYRESDEC=0x0, @ANYRES16=r1, @ANYPTR=&(0x7f00000024c0)=ANY=[@ANYRES32=r2, @ANYRES16=r0, @ANYPTR64, @ANYRESDEC, @ANYRESOCT], @ANYRES32=r2]], 0x1) [ 225.027068] binder: release 10539:10543 transaction 80 out, still active [ 225.037488] binder: undelivered TRANSACTION_COMPLETE [ 225.055286] binder: send failed reply for transaction 80, target dead 18:18:37 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0xffffffffffffffb7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x2, @perf_bp={&(0x7f0000000080), 0x4}, 0x0, 0x0, 0x6}, 0x0, 0x2, 0xffffffffffffffff, 0x8) r1 = accept4$packet(0xffffffffffffff9c, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000100)=0x14, 0x80000) ioctl$sock_inet_SIOCGIFBRDADDR(r1, 0x8919, &(0x7f0000000140)={'sit0\x00', {0x2, 0x4e23, @rand_addr=0x4}}) socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000040)="9329c2c3a4d3bc0b700dff23eb1e4589360e4a3268633187f2b50cb4"}, {&(0x7f0000000300)="17556735ae2edae2872c3e99c12bc5fb59a803d927a6624149ddbcb39aaa25d7155ae8c1972f75de8c414e9bd80f85e5840540603b6a849df53ac857cdf36f2bb778c0570053316327f9496a23c15f690495eb1bf2fefc564468d683ac5869e845bdb21be4cce99bd43d48a9c3969217619347ad9ad433bf80fda8695bfed55009b73de55b4b47d242b71539ae4dd66e3f6c78d11ead1af2d86d3fb560b87cfb0015fe3894615e5bb4cdb9ea4522c3d6260b175d57da8c0faac762fface2f5dd702dc70e0a344ed3010fc048977927b5c1a7fe897c99ce77b40bcb50a8edc913e98679bb8a8090b945e9aacfdf63a6cd97ca08fed13ff6b1c7bee6fd5feb"}, {&(0x7f00000001c0)="183c314d8655c6b35ab17b04c7427d0312e4d7650941b995e2fa055252a41fcd4c22b6b1734315e78018e710420a6d524d9b977be8417358f291c845ca343171e1f5"}, {&(0x7f0000000240)="b478a7d191e139d554d1e5a1f77059052b87d449e03d24ad3ff4e6d5fc1b2b8cfd3dd1d4085de1f847ef9656cf71edf47cde78af86912be225cf7f133a21f388ca29f48ff9c1426f7d1c19cc9f25183e0d258a7098f3b42fa9ba444e6d8da888ffe90f3b4a930a1a1a"}], 0x9a) pipe(&(0x7f0000000000)) 18:18:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 18:18:37 executing program 0: r0 = accept4(0xffffffffffffff9c, &(0x7f0000000080)=@in={0x2, 0x0, @local}, &(0x7f0000000100)=0x80, 0x80000) connect$netlink(r0, &(0x7f0000000140)=@proc={0x10, 0x0, 0x25dfdbfc, 0x30000}, 0xc) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000840)='/selinux/policy\x00', 0x0, 0x0) getsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f0000000880)=""/245, &(0x7f0000000980)=0xf5) r2 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x4e23, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000180)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000042434f3be29836f69db0000000000000000000000000000000030000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d9028473eaf00fcdce1272bf98f3a4031797348b5a7ce23d370ba2fe945668a579b992d5ad731bb94cab5533dfbfb68886d7bb1d16954fdda87338e6aca63a7383977fda6e1ddd512258783a83bdc29d43093f3c2b5ecd5a803a5c000000000000000000"], 0x210) getsockname$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) [ 225.110416] binder: release 10554:10557 transaction 82 out, still active [ 225.136056] binder: undelivered TRANSACTION_COMPLETE [ 225.151755] binder: send failed reply for transaction 82, target dead [ 225.327239] binder: 10566:10573 ioctl c0306201 0 returned -14 [ 225.342748] binder: release 10566:10573 transaction 84 out, still active [ 225.363716] binder: undelivered TRANSACTION_COMPLETE 18:18:37 executing program 3: eventfd(0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x2100, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r1, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100080}, 0xc, &(0x7f0000000100)={&(0x7f0000000980)=ANY=[@ANYBLOB="020027030008200800740000000800030004000000080005007f00000148000100080006006e71000008000900fdffffff0800050069e950430e45457301000000080004004e22000008000500000000000c00070010000000e4ffffff080001000a0000002c0002000800090000020000080002004e24000008000500040000000800060001000080080002004e0a000028000300080007004e2300000800030004000000147b9f93c9fa1bbfdf00060000000000000000000000000000000000080005000000000048000100080006006e71000008000100020000070000000000000077ff58dcd1b5fc3b9d566e736970000c0006006e6f6e650000000014000300e000000200006f6e6500000078635d886f4c1a7b06498fb79f5a45df92e8a3259e1ab0a131bf12c9279dcf3a304c9d5df5190fbedb51fa3fbcc7440fab93a3da2b77d4"], 0x1}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) mkdir(&(0x7f00000001c0)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) write$P9_RCLUNK(r1, &(0x7f0000000200)={0x7, 0x79, 0x4}, 0x7) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getresgid(&(0x7f00000003c0), 0x0, 0x0) fstat(r1, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) stat(&(0x7f0000000440)='./file0//ile0\x00', &(0x7f0000000700)) setregid(0x0, 0x0) dup(r0) rmdir(&(0x7f0000000540)='./file1\x00') chdir(&(0x7f0000000340)='./file1\x00') clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) inotify_rm_watch(0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000400)='./bus\x00', 0x141042, 0xb4) r4 = eventfd2(0x600, 0x803) fallocate(r3, 0x1, 0x0, 0x10000101) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r5 = fcntl$dupfd(r4, 0x2000406, r2) pwrite64(0xffffffffffffffff, &(0x7f0000000280)="8fa222b1bffe12d977baec052cd71c40e0f14c7e49a8412c0f82e0ac09c020ca1e08524cb543c7671c8fe1353eea72d751f76df13758e4c68101c00d48fc89c17bceefd13d46812a08bc6e7999d54b7b788a558c204ef93faf389002be7a4697fed3ba1c8cc415e9d73e73c20afa21c8f55aa1", 0x73, 0x0) perf_event_open$cgroup(&(0x7f00000005c0)={0x7, 0x70, 0x9, 0x8, 0xec, 0x8b2, 0x0, 0x8001, 0x0, 0x2, 0x200, 0x2, 0x6, 0x0, 0x1, 0x321499e7, 0x3, 0x4, 0x1, 0x5621, 0x800, 0x6, 0x3c9, 0x1, 0x8001, 0x9, 0x0, 0x200, 0x3, 0x7, 0xfffffffffffffbff, 0x4, 0x7396, 0x0, 0x2, 0x80, 0x8001, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x93, 0x0, 0x3}, r5, 0x0, 0xffffffffffffffff, 0x0) 18:18:37 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x40, 0x8000000000100) 18:18:37 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='squashfs\x00', 0x0, &(0x7f00000000c0)='trusted*-^wlan0\x00') r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 225.387679] binder: send failed reply for transaction 84, target dead 18:18:37 executing program 2: r0 = socket$inet6(0xa, 0x3, 0xffff) flistxattr(r0, &(0x7f00000000c0)=""/19, 0x13) [ 225.446718] binder: release 10581:10585 transaction 86 out, still active [ 225.458236] binder: undelivered TRANSACTION_COMPLETE [ 225.479143] binder: send failed reply for transaction 86, target dead 18:18:38 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000040), &(0x7f0000000140)=0x30) syz_open_procfs(0x0, &(0x7f0000000340)='pagemap\x00') openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x40000000) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') geteuid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000b80)={{{@in=@loopback}}, {{@in6=@remote}, 0x0, @in=@remote}}, &(0x7f0000000200)=0xe8) chown(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x200000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x0) 18:18:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 18:18:38 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) read(r0, &(0x7f0000000000)=""/116, 0x74) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1, 0xfffffffffffffffe}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @loopback}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x6b, @remote}}]}, 0x210) 18:18:38 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') 18:18:38 executing program 2: r0 = memfd_create(&(0x7f0000000040)="00000600000000000000", 0x0) write$binfmt_elf64(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f454c4600000000000000000000000003003e000039a594349c1fd83d000000000000000000000000000000000000000000050000003800"], 0x38) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r1, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x20, 0x4, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf1d}]}]}]}, 0x34}}, 0x4000) 18:18:38 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xb, &(0x7f00000000c0)=0x3ff, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup(r1) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0xffffffffffffbff7, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(0xffffffffffffffff, 0xc0505405, &(0x7f00000003c0)={{0x0, 0x0, 0xfff, 0x1, 0x1}, 0x8, 0xe049}) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCDELRT(r4, 0x890c, &(0x7f0000000500)={@local, @empty, @mcast1, 0x0, 0x78}) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0) ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000380)={0x1, &(0x7f0000000340)=[{0x0, 0x8ae}]}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000280)='/dev/null\x00', 0x545000, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000140)) ioctl$sock_inet_udp_SIOCINQ(r6, 0x541b, &(0x7f00000001c0)) arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x100000001) ioctl$VT_OPENQRY(r6, 0x5600, &(0x7f00000004c0)) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$RTC_WIE_OFF(r0, 0x7010) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$LOOP_CTL_ADD(r5, 0x4c80, 0x0) ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f0000000180)) vmsplice(r1, &(0x7f0000002640)=[{&(0x7f00000025c0)="d5", 0x1}], 0x1, 0x0) 18:18:38 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:38 executing program 2: mmap(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x0, 0x1b071, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f0000008000/0x3000)=nil) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x10000, 0x0) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x2, &(0x7f0000002000/0x3000)=nil) remap_file_pages(&(0x7f0000006000/0x4000)=nil, 0x7fffdfff9000, 0x0, 0x0, 0x0) 18:18:38 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000000)) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000e200000000000000000000000000000000000000000000000000000000000000000000000000000000004c83000000000000000000000000000000000095f60000001b0000000000000000000000000000000000000000000000030000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000432078ac7e31e32a44292ca5f6a49d317919c8b9fb95cc9f8915dfd2c5194ecf406682e6c19db85e33abc191b962f3a78b00000000000000000000000000"], 0x210) 18:18:38 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x2000, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8}, 0x0, 0xffffffffffffffff, r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:38 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x800000000000012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x4000, 0x0) setsockopt$packet_buf(r2, 0x107, 0x1f, &(0x7f00000000c0)="b4dff2717db7d9686c81460a8f1f76da65b4b9946022531fe9ae04317f8bf6f637739b552c07c9785f8e4143a7953d836179d1e476e2aca2845ce54538f42eb0f477758908f3d55cd1e8fbf2c90f4bb23ef7fa318a2fb6f330700c09e9d9e8ede76c3da899054b6c72fbf64a9a9e3e20126848f0e30ad2c99a9a244aa1c44be7cdb0bf9c6d0b06601f25fe428c5fc497cce2d4c262b0bae13c87a3c211858e62bfd1431179b5e33a408f14c7f89ed65d05ce", 0xb2) fcntl$setflags(r0, 0x2, 0x0) [ 226.099344] binder: release 10604:10617 transaction 88 out, still active [ 226.131031] binder: undelivered TRANSACTION_COMPLETE 18:18:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 226.178631] binder: send failed reply for transaction 88, target dead [ 226.214447] binder: release 10637:10639 transaction 90 out, still active [ 226.223939] binder: undelivered TRANSACTION_COMPLETE [ 226.235358] binder: send failed reply for transaction 90, target dead 18:18:39 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000040), &(0x7f0000000140)=0x30) syz_open_procfs(0x0, &(0x7f0000000340)='pagemap\x00') openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x40000000) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') geteuid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000b80)={{{@in=@loopback}}, {{@in6=@remote}, 0x0, @in=@remote}}, &(0x7f0000000200)=0xe8) chown(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x200000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x0) 18:18:39 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) prctl$PR_GET_SECCOMP(0x15) socket$netlink(0x10, 0x3, 0xf) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:39 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d40a00000600000040000000000000000900000000000000fd733e30000000000000000000000000000000000000000000000000000000000100000004000000080000000000000000000000000000000200000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"]) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000540)='/proc/self/net/pfkey\x00', 0x4000, 0x0) getpeername$netlink(r1, &(0x7f0000000580), &(0x7f00000005c0)=0xc) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x4, [{{0xa, 0x4e24, 0x100000001, @remote, 0x4}}, {{0xa, 0x4e22, 0x10000, @mcast1, 0x2}}, {{0xa, 0x4e21, 0x0, @remote, 0x10001}}, {{0xa, 0x4e22, 0x36d, @dev={0xfe, 0x80, [], 0xd}, 0x1ff}}]}, 0x290) 18:18:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000600), 0x0, 0x0, 0x0}) 18:18:39 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = fcntl$dupfd(r0, 0x406, r0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000003080)={{{@in=@empty, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@dev}}, &(0x7f0000003180)=0xe8) r4 = getuid() sendmsg$nl_xfrm(r2, &(0x7f0000003300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000040}, 0xc, &(0x7f00000032c0)={&(0x7f00000031c0)=@updpolicy={0xf0, 0x19, 0x8, 0x70bd27, 0x25dfdbfb, {{@in=@empty, @in=@loopback, 0x4e23, 0x0, 0x4e22, 0x8, 0xa, 0x80, 0x20, 0x9d, r3, r4}, {0x1f, 0x1, 0x7c4a, 0x2, 0x3, 0x8, 0x80000001, 0xd79}, {0x1, 0x2, 0x10000, 0x401}, 0x5, 0x6e6bc0, 0x3, 0x1, 0x3, 0x3}, [@tfcpad={0x8, 0x16, 0x6}, @address_filter={0x28, 0x1a, {@in6=@remote, @in=@dev={0xac, 0x14, 0x14, 0x18}, 0xa, 0x5, 0x1000}}, @replay_thresh={0x8, 0xb, 0x8}]}, 0xf0}, 0x1, 0x0, 0x0, 0x4}, 0x4000005) r5 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000240)='/dev/keychord\x00', 0x0, 0x0) read$eventfd(r5, &(0x7f0000000200), 0x8) 18:18:39 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xb, &(0x7f00000000c0)=0x3ff, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup(r1) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0xffffffffffffbff7, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(0xffffffffffffffff, 0xc0505405, &(0x7f00000003c0)={{0x0, 0x0, 0xfff, 0x1, 0x1}, 0x8, 0xe049}) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCDELRT(r4, 0x890c, &(0x7f0000000500)={@local, @empty, @mcast1, 0x0, 0x78}) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0) ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000380)={0x1, &(0x7f0000000340)=[{0x0, 0x8ae}]}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000280)='/dev/null\x00', 0x545000, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000140)) ioctl$sock_inet_udp_SIOCINQ(r6, 0x541b, &(0x7f00000001c0)) arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x100000001) ioctl$VT_OPENQRY(r6, 0x5600, &(0x7f00000004c0)) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$RTC_WIE_OFF(r0, 0x7010) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$LOOP_CTL_ADD(r5, 0x4c80, 0x0) ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f0000000180)) vmsplice(r1, &(0x7f0000002640)=[{&(0x7f00000025c0)="d5", 0x1}], 0x1, 0x0) 18:18:39 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ffff0300000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x210) 18:18:39 executing program 2: r0 = socket$inet6(0xa, 0x80001, 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d40a00000600000040000000000000000900000000000000fd733e30000000000000000000000000000000000000000000000000000000000100000004000000080000000000000000000000000000000200000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"]) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000540)='/proc/self/net/pfkey\x00', 0x4000, 0x0) getpeername$netlink(r1, &(0x7f0000000580), &(0x7f00000005c0)=0xc) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x4, [{{0xa, 0x4e24, 0x100000001, @remote, 0x4}}, {{0xa, 0x4e22, 0x10000, @mcast1, 0x2}}, {{0xa, 0x4e21, 0x0, @remote, 0x10001}}, {{0xa, 0x4e22, 0x36d, @dev={0xfe, 0x80, [], 0xd}, 0x1ff}}]}, 0x290) 18:18:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000600), 0x0, 0x0, 0x0}) 18:18:39 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) syz_genetlink_get_family_id$tipc(&(0x7f0000000000)='TIPC\x00') [ 226.975763] binder: release 10651:10655 transaction 92 out, still active [ 226.986367] binder: undelivered TRANSACTION_COMPLETE [ 227.014328] binder: send failed reply for transaction 92, target dead 18:18:39 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) r1 = open(&(0x7f0000000000)='./file0\x00', 0x200002, 0x44) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000040)={0x8}) getsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000080), &(0x7f00000000c0)=0x4) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) 18:18:39 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f0000000280)) r1 = memfd_create(&(0x7f0000000240)='\x00o\x00', 0x1) getsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x8) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000600)=ANY=[@ANYBLOB="8f0030c900f1fa9d5d63c40000000000008598b7e8ec0d63d6ff01000000000000000040000000000100000000000000000000000300000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000f4ffffffffffffff00000000000000000000000000000000030000000a00000000000000ff01000000000000000000000000000100000900000000276df1e2300b0e1d000000000000000000000000000000000000000000000000000000000000000000ebff00000000000000000000000000000000000000000000c8553cfd83a3bf4f000000000000000000000000000000000000000000000000120880b24a699ae70000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0000000000000000000000000000000000000000000000000000220000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006ab85e4c4b635f848fb70a6de9a8fa27936b17556488711d321544de24177905e0121748907223041d259ab47da0cbe9e4ca10046133bac98f2e11ede4f4cd19c6dab8c7b08eab9a5f72788cd20ed315d1e67a0a5a5598ca1d6ca12d2be324115761a4ec9a7a4607f6451ba75c14ca26a3d83fcb88fd4f39c320978038e5fc4caf4f919bf9cc3ee999efdaab55297b9ad0639d9b109a96115a7e52551aa7215840c1b280ce317bac3e9c1422b1000000"], 0x210) accept$inet(r1, &(0x7f0000000080)={0x2, 0x0, @local}, &(0x7f00000000c0)=0x10) [ 227.050934] binder: release 10666:10672 transaction 94 out, still active [ 227.080673] binder: undelivered TRANSACTION_COMPLETE [ 227.110634] binder: send failed reply for transaction 94, target dead 18:18:40 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000040), &(0x7f0000000140)=0x30) syz_open_procfs(0x0, &(0x7f0000000340)='pagemap\x00') openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x40000000) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') geteuid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000b80)={{{@in=@loopback}}, {{@in6=@remote}, 0x0, @in=@remote}}, &(0x7f0000000200)=0xe8) chown(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x200000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x0) 18:18:40 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'gretap0\x00', 0x1000}) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) 18:18:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000600), 0x0, 0x0, 0x0}) 18:18:40 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:40 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) bind$inet6(0xffffffffffffffff, 0x0, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fffffff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) r1 = socket(0x7, 0x5, 0x8) dup(0xffffffffffffffff) getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f00000002c0)=ANY=[@ANYBLOB="6e61740000000000000000000000000000000000000000000000000000000000b9000000f1b20e19b32ec0dcdb4dcab7549352b20ccbf0c755b3076a491695fd226a3e0f1eaab8fddb3a77a785a1234bd50d234cf8deedefa8817df256323f0e1b9a47fc5005e1c49fe9de237ced2f9392aea1b81054e7920473bf19aa320d6ac1a13b47a57e73163518b672bd599f9de37083bd32c44b427a5227efe975ae07ac7ff666179dca7d5fef689aca26f7290aaf296686f5a585dd453bcbf57f5f74444bfc4fd0b6e1e4ba6dd1dbff1aff29fe82b54f3a3b5b586921e8091d"], &(0x7f0000000080)=0xdd) 18:18:40 executing program 0: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000d4b000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}]}, 0x210) madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x64) 18:18:40 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) openat$cgroup_int(r1, &(0x7f00000000c0)='cpuset.memory_spread_slab\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:40 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_pts(0xffffffffffffffff, 0x400080) ioctl$VT_SETMODE(r1, 0x5602, &(0x7f0000000000)={0x100000001, 0x100, 0x400, 0x1000, 0x9}) r2 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) io_setup(0x6, &(0x7f0000000040)=0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x40, 0x0) write$evdev(r4, &(0x7f0000000a80)=[{{0x0, 0x7530}, 0x16, 0x2, 0x10001}], 0x18) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r6 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000680)='/dev/vga_arbiter\x00', 0x404401, 0x0) r8 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000740)='/selinux/enforce\x00', 0x4000, 0x0) r9 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000880)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r10 = dup3(r1, r2, 0x80000) io_submit(r3, 0x9, &(0x7f0000000a00)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0xff, r1, &(0x7f0000000080)="b515769d7007836690b21fdbb791c8239b879096043cd516733e1846ce252448f209", 0x22, 0x3, 0x0, 0x1, r4}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xf, 0x7, r2, &(0x7f0000000140)="36f40c0a76e6c0a1609706a2b5c7347599e5127422abe51694", 0x19, 0x3, 0x0, 0x1, r5}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x7, 0x9, r0, &(0x7f0000000240)="ff68f4097f834c4c95ec89e2b0185943a0", 0x11, 0x4e6f, 0x0, 0x3, r0}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0xf, 0x10000, r2, &(0x7f00000002c0)="5769d4c70f7395102d14c9b84be2af025d0a7aa3ea048f9decb1ab3a857c1f9b8f7ead9129cda4741e130d6708b74fd4d562e9744adf7c681ea156ff3e1a97a15bf1db4d3599bcd721be7d0b520eb08f83002d093f9b0e4bfcf2b3db3fc0c70f58dac8dde53eee4dca6ae64ea8c4f1cf3503caa035b77a3c250171c82b36791ae8b09f701d9cc59fe35c486067d44cc878e2eb2e21174cf2434d7d679036ff2e9ff4f0963a759ebb4452e3f430bb91ed6744f539934bb9b7f2cd5b7b7d5c2b703c6c287174acceac32eab18c58858b62a179ea128da76a32700e23bbcffe3ea0fc4ba7be91ae18cf827ca9876d774232", 0xf0, 0x2, 0x0, 0x0, r6}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x7, 0xffffffffffffff81, r2, &(0x7f00000004c0)="0b7e6d755ea40070b9b8a8fc9dc86ef9497e7e03356ee85dd32aae7288c95d2910f391476089bfb6de5827b39303acc58117b3a5b7a66e9834550e8c967e4c4679450b95d93a2818da214f7e0bd9b0ef0d5d7a5b026d3190d3b22a66116364f095602013b170f10167e6fba9e6eb763f81981f10c80aafacda9f3de4d5c1ec352eb01193d3b23c3c5364ccc7f7866ca33074b452bd9edc894889537e047418746d1914df2d7f189de184e3", 0xab, 0x0, 0x0, 0x0, r2}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0xf, 0x1, r2, &(0x7f00000005c0)="999586f48973670b930715c6719633b339e25e1ce03c942f63d25f80b26829d3c31055fd70dee3b5f2c8ab78bfdcc76be2e8cbd77e33f207a0520b2689d7f628d814ff87ecf9abf0955c429b5914f70c0ee87de218ba50492f123881295a12a8c798b838f310d367cf8169c6368f17114c27abe796a2c4937807572e518a87d5b61b40547f2be9683ce1936c322e0d37bb6ab1477eeb9f59e33c0e37a786acf2e29d278aee", 0xa5, 0x1d6, 0x0, 0x0, r7}, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x7e5da0fb9e90546e, 0x4, r0, &(0x7f0000000700)="b34f60099bce3c23c9134613cdf33d4bfe53cd7a498283302da7530abbf809a948d606a8166da26889fc432f62b4f2bb994a0e919c4f31423372", 0x3a, 0x7, 0x0, 0x2, r8}, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x1, 0x63, r2, &(0x7f00000007c0)="17b849e9492a95d5824d4329d4ea4c04d70a5940834ce024f251df63ab153a97a1c2268d2f572c1bfeb918129a97b4f357b6a60e903089d2c5d899a5f96c8cf928e2cf0a51164ebbd25672b398015163d29f24094c53c472f9cd18b025686332e13488b6b3232b5921f58a900afb9c078039e9b47cecd4fd2d0dea80c070e3d503d62e6feb7777dc6c5d358282b7a48143", 0x91, 0x1, 0x0, 0x1, r9}, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0xd, 0x8001, r0, &(0x7f0000000900)="bc91996f81678ada77aa0363535d5eb0c3be7bb0687fd91493c94a3c9129b911e1b654f00cdf4d5fbd2f649065044f6dfc4bceefb4fd092af9c359ddfb381666aab1eff3e264eda97188393fc13e58c6119795ba062928cac139959a2ad8d6543a95c675e0140d3e4eeea04f53b8a2333c3fc906bef0e951dfbad32d27b6af019662bf22147f89a9cd4beed6b6d3874a245feda524584c0e233f500a7de040e835cb41837ecf31905f6d334b9e76a23d3f5b65c405", 0xb5, 0x7, 0x0, 0x0, r10}]) 18:18:40 executing program 0: memfd_create(&(0x7f00000001c0)='/dev/zero\x00', 0x3) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sched_setaffinity(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000000, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000200)='/dev/zero\x00', 0x804, 0x0) getpeername(r0, 0x0, &(0x7f0000000280)) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000000), 0x0) ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000380)={0x0, &(0x7f0000000300)}) timerfd_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x1c9c380}}, &(0x7f0000000080)) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000004c0), 0x4) unshare(0x2000400) sendmsg$key(0xffffffffffffffff, &(0x7f000011bfe4)={0x0, 0x0, &(0x7f000069a000)={&(0x7f0000000500)=ANY=[@ANYBLOB="020e000014000000000000000000000005000600000000000a0000008fe0ce10184aadaa92e9182f60c05c6d0000000000000000000000000000ffff0000000000000000000000000800120000000000000000000000000006000000000000000000000000000000000000000000000000e000000100000000000000000000000005000500000000000a0000000000000000000000000000000000ffff000000000000000000000000000000000000"], 0xaf}}, 0x0) timerfd_gettime(0xffffffffffffffff, &(0x7f00000005c0)) [ 227.875241] binder: release 10693:10697 transaction 96 out, still active [ 227.884549] binder: undelivered TRANSACTION_COMPLETE [ 227.903093] binder: send failed reply for transaction 96, target dead 18:18:40 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'gretap0\x00', 0x1000}) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) 18:18:40 executing program 3: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'gretap0\x00', 0x1000}) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) 18:18:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup2(r0, r0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/status\x00', 0x0, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x20400, 0x0) openat$cgroup_type(r2, &(0x7f00000000c0)='cgroup.type\x00', 0x2, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000004663ec1bf1c07fbd895500e54aa65d439ac6fa4488bd36560efa9e3dcd1205faac0c9c82f0483da33708e4c55691ae1c27f4d9b5f324d13b8fdbdbae0875b86f891c52504b0600c3e060f16f64df4eb01dab5bea1499be22b038c4ef159bb0d834b0a8129af30d0b69a525866366501339c9d09a92af2cc7ff7bab841285e9fe1ab3b39167ae1f854d64b1b3f11b82a90ac9e24296b74f2d6424ad19833df3305c7a5a4d0c60f979e12a45b0e985f9edf8311d1a0094c1a06377c871e4ff81ec326d8741619fdbf0374268bd50bc293c234183d3bf7387c13b9e1914b56a93b8278b82d70000a7f181e656a153c64afb0d39777bc959e0c4ecd6652a2968b18188ac195d"], 0x0, 0x0, 0x0}) [ 228.026715] binder: 10727:10729 got new transaction with bad transaction stack, transaction 98 has target 10727:0 [ 228.048944] binder: 10727:10729 transaction failed 29201/-71, size 0-0 line 3039 [ 228.058807] binder_alloc: binder_alloc_mmap_handler: 10727 20001000-20004000 already mapped failed -16 [ 228.069084] binder: BINDER_SET_CONTEXT_MGR already set [ 228.075029] binder: 10727:10729 ioctl 40046207 0 returned -16 [ 228.082322] binder_alloc: 10727: binder_alloc_buf, no vma [ 228.088076] binder: 10727:10732 transaction failed 29189/-3, size 0-0 line 3135 [ 228.097795] binder_alloc: 10727: binder_alloc_buf, no vma [ 228.105075] binder: send failed reply for transaction 98 to 10727:10729 [ 228.110378] binder: 10727:10729 transaction failed 29189/-3, size 0-0 line 3135 [ 228.123211] binder: undelivered TRANSACTION_ERROR: 29189 [ 228.128734] binder: undelivered TRANSACTION_ERROR: 29189 [ 228.134476] binder: undelivered TRANSACTION_COMPLETE [ 228.142216] binder: undelivered TRANSACTION_ERROR: 29201 [ 228.148074] binder: undelivered TRANSACTION_ERROR: 29189 18:18:41 executing program 1: clone(0x3102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000080)=0x0) sched_getparam(r0, &(0x7f0000000140)) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) r2 = dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x80000) write$cgroup_pid(r2, &(0x7f0000000040)=r1, 0x12) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x24) ptrace$cont(0x18, r1, 0x0, 0x0) umount2(&(0x7f0000000000)='./file0\x00', 0x9) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x80}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) setsockopt$inet_mreqsrc(r2, 0x0, 0x26, &(0x7f0000000180)={@broadcast, @multicast2, @multicast1}, 0xc) ptrace$cont(0x1f, r1, 0x0, 0x0) 18:18:41 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001500050098e50219eb70000000000100"], 0x14}}, 0x0) 18:18:41 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x2000000) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:41 executing program 3: recvmmsg(0xffffffffffffff9c, &(0x7f0000006840)=[{{&(0x7f00000000c0)=@sco, 0x80, &(0x7f0000000340)=[{&(0x7f0000000140)=""/198, 0xc6}, {&(0x7f0000000240)=""/206, 0xce}], 0x2, &(0x7f0000000380)=""/28, 0x1c}, 0x80}, {{&(0x7f00000003c0)=@nfc_llcp, 0x80, &(0x7f0000001500)=[{&(0x7f0000000440)=""/178, 0xb2}, {&(0x7f0000000500)=""/4096, 0x1000}], 0x2}, 0x2}, {{&(0x7f0000001540)=@generic, 0x80, &(0x7f0000002740)=[{&(0x7f00000015c0)=""/4096, 0x1000}, {&(0x7f00000025c0)=""/230, 0xe6}, {&(0x7f00000026c0)=""/83, 0x53}], 0x3, &(0x7f0000002780)=""/250, 0xfa}, 0x1}, {{&(0x7f0000002880)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @dev}}}}, 0x80, &(0x7f0000004dc0)=[{&(0x7f0000002900)=""/79, 0x4f}, {&(0x7f0000002980)=""/255, 0xff}, {&(0x7f0000002a80)=""/22, 0x16}, {&(0x7f0000002ac0)=""/4096, 0x1000}, {&(0x7f0000003ac0)=""/236, 0xec}, {&(0x7f0000003bc0)=""/158, 0x9e}, {&(0x7f0000003c80)=""/226, 0xe2}, {&(0x7f0000003d80)=""/4096, 0x1000}, {&(0x7f0000004d80)=""/52, 0x34}], 0x9, &(0x7f0000004e80)=""/188, 0xbc}, 0xfffffffffffffff7}, {{&(0x7f0000004f40)=@hci, 0x80, &(0x7f00000060c0)=[{&(0x7f0000004fc0)=""/89, 0x59}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/125, 0x7d}], 0x3}, 0x17}, {{&(0x7f0000006100)=@pppoe={0x18, 0x0, {0x0, @link_local}}, 0x80, &(0x7f0000006200)=[{&(0x7f0000006180)=""/98, 0x62}], 0x1, &(0x7f0000006240)=""/23, 0x17}, 0x4}, {{&(0x7f0000006280)=@vsock={0x28, 0x0, 0x0, @host}, 0x80, &(0x7f00000067c0)=[{&(0x7f0000006300)=""/249, 0xf9}, {&(0x7f0000006400)=""/196, 0xc4}, {&(0x7f0000006500)=""/247, 0xf7}, {&(0x7f0000006600)=""/129, 0x81}, {&(0x7f00000066c0)=""/176, 0xb0}, {&(0x7f0000006780)=""/23, 0x17}], 0x6}, 0x1f}], 0x7, 0x40000000, &(0x7f0000006a00)={0x77359400}) getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, &(0x7f0000006a40)={'nat\x00', 0x4a, "c688747d546d1937fcd5a6f3a3febc41770534d284ee8a4ee573f798c84abbf1e48f74132b17d8de97a2b0137ae053ea8c17c41bd415ac0eadf81b25f92b2fae0d8b93897340d4417e2e"}, &(0x7f0000006ac0)=0x6e) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.events\x00', 0x0, 0x0) ioctl$BLKROTATIONAL(r1, 0x127e, &(0x7f0000000080)) r2 = socket$inet6(0xa, 0x100000003, 0x80000000000006) sendfile(r2, r2, 0x0, 0x7324) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) setsockopt$inet6_opts(r2, 0x29, 0x39, &(0x7f0000000000)=@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast1]}, 0x18) 18:18:41 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'gretap0\x00', 0x1000}) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) 18:18:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/zero\x00', 0x40, 0x0) ioctl$TCSETSF(r3, 0x5404, &(0x7f0000000200)={0x1, 0x3, 0x9, 0x0, 0x0, 0xfffffffffffffff9, 0x80000001, 0x1, 0x1, 0x0, 0x5, 0x7}) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000080)={0x4, 0xffffffff, 0x6, 0x0, 0x0, [{r2}, {r1, 0x0, 0x8}, {r0, 0x0, 0xfffffffffffff801}, {r1, 0x0, 0x400}, {r1, 0x0, 0x80000001}, {r2, 0x0, 0x2}]}) 18:18:41 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) 18:18:41 executing program 3: r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, 0x0) 18:18:41 executing program 0: mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xc7c1c1872aeefe0e) bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x4, 0x2, &(0x7f0000000040)=ANY=[@ANYRESHEX], &(0x7f0000000240)='GPL\x00', 0x2, 0xfb, &(0x7f00001a7f05)=""/251, 0x0, 0x1}, 0x48) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$TCSBRK(r0, 0x5409, 0x9) [ 228.792240] binder: 10739:10746 got new transaction with bad transaction stack, transaction 103 has target 10739:0 18:18:41 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'gretap0\x00', 0x1000}) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) 18:18:41 executing program 4: mlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000) r0 = getpid() r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x80, 0x0) perf_event_open(&(0x7f00000000c0)={0x7, 0x70, 0x9, 0x4, 0x2, 0x4, 0x0, 0x1, 0x20021, 0x2, 0x100000000, 0x8, 0x8001, 0x8, 0x1, 0x9, 0xff, 0x0, 0x8, 0x1ff, 0x80000001, 0x8, 0x0, 0x9, 0x8, 0x100000000, 0x400, 0x4, 0x3, 0x2, 0x8, 0xfffffffffffffff8, 0xee1, 0x800, 0x8, 0x3, 0x8, 0x81, 0x0, 0x9, 0x1, @perf_config_ext={0x9d5, 0x8}, 0xa000, 0xfff, 0x80000000, 0xf, 0xfffffffffffffffc, 0x2, 0x4}, r0, 0x6, r1, 0x2) ioctl$TUNSETPERSIST(r1, 0x400454cb, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xca4, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$netlink(0x10, 0x3, 0x1) r3 = fcntl$dupfd(r2, 0x406, r2) ioctl$UI_END_FF_UPLOAD(r3, 0x406855c9, &(0x7f0000000000)={0x3, 0x1ff, {0x57, 0x80000000, 0x7, {0x8, 0x2}, {0x1, 0xfff}, @cond=[{0xda7, 0x8, 0x591, 0x3, 0x3, 0x4ea3}, {0xac4, 0xd394, 0x8, 0xfffffffffffffffc, 0x3, 0x3}]}, {0x54, 0x8, 0x8, {0x9, 0x7ff}, {0x4, 0x5}, @cond=[{0x4000000000, 0xfffffffffffffff8, 0x0, 0x0, 0xffff, 0x10000}, {0xfffffffffffffffc, 0x1, 0xfffffffffffffffe, 0x6, 0x9, 0x5}]}}) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) lsetxattr$security_selinux(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='security.selinux\x00', &(0x7f0000000240)='system_u:object_r:nvram_device_t:s0\x00', 0x24, 0x3) setsockopt$inet6_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f0000000080), 0x4) [ 228.848140] binder: 10739:10746 transaction failed 29201/-71, size 0-0 line 3039 [ 228.879012] binder_alloc: binder_alloc_mmap_handler: 10739 20001000-20004000 already mapped failed -16 18:18:41 executing program 3: mkdir(&(0x7f0000000500)='./file0\x00', 0x0) mount(&(0x7f0000000480), &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000002c0)) readlinkat(0xffffffffffffffff, &(0x7f0000000180)='./file0/file0\x00', &(0x7f0000000640)=""/92, 0x5c) ioctl$BLKPBSZGET(0xffffffffffffffff, 0x127b, &(0x7f0000000240)) fstatfs(0xffffffffffffffff, &(0x7f0000000900)=""/4096) r0 = creat(&(0x7f00000000c0)='./file0/file0\x00', 0x4) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000140)='tls\x00', 0x4) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000400)={{{@in=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}}}, &(0x7f00000001c0)=0xe8) getresgid(&(0x7f0000000580), &(0x7f0000000340)=0x0, &(0x7f0000000540)) fchown(r0, r1, r2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr(0xffffffffffffffff, &(0x7f0000000380)=@random={'osx.', 'ramfs\x00'}, &(0x7f00000003c0)="2a706f7369785f61636c5f6163636573732d245e7d707070307070703128766d6e6574312ac76c6f00", 0x29, 0x1) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f0000000280)=@bridge_getneigh={0x20, 0x1e, 0x303, 0x0, 0x0, {0xc00}}, 0x20}}, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000000c0)=@generic, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000640)=""/4096, 0x1000}, 0x0) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) write$P9_RXATTRCREATE(r4, &(0x7f0000000000)={0x7}, 0x1) sendfile(r4, r4, &(0x7f0000000040), 0x80000001) [ 228.899861] binder: BINDER_SET_CONTEXT_MGR already set [ 228.905697] binder: 10739:10746 ioctl 40046207 0 returned -16 [ 228.918655] binder_alloc: 10739: binder_alloc_buf, no vma [ 228.936181] binder: 10739:10757 transaction failed 29189/-3, size 0-0 line 3135 18:18:41 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x1}, {0x6}]}, 0x10) sendmmsg(r0, &(0x7f0000000180), 0x2a9, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000180)={@multicast2, @dev}, &(0x7f00000001c0)=0xc) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000240)={'\x00', &(0x7f0000000800)=ANY=[@ANYBLOB="41000000050000000180000001000000090000006209000000800000030000000462bdf4ae291d79a9000000a4251e978759ea60c0b1a5a4a2dc7560bf269bf32946810fcb89375d49f6544c737fed9e249e46c0d07bd2d2f94b1e36c9dae303f1290dd0dac556a9f062fa6e38f9ae57088be89e21d83995d24e08618fb807f8f6b95d54490fffb9bab982356b91b3e2c3a02fd98e0449d8791b47b02f49eecbc8b2080d0d83a3fc05a5c77b736c52e0571b"]}) prctl$PR_SET_SECUREBITS(0x1c, 0x31) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') execveat(r2, &(0x7f0000000280)='./file0\x00', &(0x7f0000000380)=[&(0x7f0000000740)='eth1{lo\x00', &(0x7f0000000300)='/selinux/avc/hash_stats\x00', &(0x7f0000000700)='\x00'], &(0x7f0000000640)=[&(0x7f00000007c0)='\x00', &(0x7f0000000400)='#[?\x00', &(0x7f0000000440)='TIPC\x00', &(0x7f0000000480)="707070312d2cf82b293a2775736572237d706f7369785f61636c5f616363657373776c616e317d7573657273656c696e75785d7d00", &(0x7f00000004c0)='/selinux/avc/hash_stats\x00', &(0x7f0000000780)="2d632476626f786e6574319100", &(0x7f0000000540)='\x00', &(0x7f0000000580)='/selinux/avc/hash_stats\x00', &(0x7f00000005c0)="3aefff00", &(0x7f0000000600)="2a2c2c73656c696e757874727573746564f72b00"], 0x1000) sendmsg$TIPC_CMD_SHOW_PORTS(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r3, 0x222, 0x70bd26, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4044810) ioctl$BLKSECDISCARD(r2, 0x127d, &(0x7f00000006c0)=0x6) 18:18:41 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_emit_ethernet(0x3a, &(0x7f0000000080)={@local, @remote, [], {@ipv4={0x800, {{0x6, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x4001, 0x0, @dev, @remote={0xac, 0x14, 0x223}, {[@rr={0x7, 0x3}]}}, @icmp=@timestamp_reply}}}}, 0x0) [ 228.952514] binder_alloc: 10739: binder_alloc_buf, no vma [ 228.991934] nla_parse: 13 callbacks suppressed 18:18:41 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0xa) [ 228.991971] netlink: 4 bytes leftover after parsing attributes in process `syz-executor3'. [ 228.992087] binder: send failed reply for transaction 103 to 10739:10746 [ 228.992104] binder: undelivered TRANSACTION_COMPLETE [ 228.992113] binder: undelivered TRANSACTION_ERROR: 29201 [ 228.992117] binder: undelivered TRANSACTION_ERROR: 29189 [ 229.040259] binder: 10739:10780 transaction failed 29189/-3, size 0-0 line 3135 [ 229.047761] binder: undelivered TRANSACTION_ERROR: 29189 18:18:41 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'gretap0\x00', 0x1000}) 18:18:41 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x4) r3 = geteuid() lstat(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchownat(r2, &(0x7f00000000c0)='./file0\x00', r3, r4, 0x1000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 229.053296] binder: undelivered TRANSACTION_ERROR: 29189 18:18:41 executing program 0: r0 = socket$inet6(0xa, 0x806, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/status\x00', 0x0, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x63, &(0x7f0000000600)={'IDLETIMER\x00'}, &(0x7f0000000640)=0x1e) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000300)=0xc8, 0x4) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffe1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000012c0)={&(0x7f0000000000), 0xc, &(0x7f0000001280)={&(0x7f0000000900)=@newlink={0x38, 0x10, 0x501, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_FLAGS={0x8, 0x9}]]}}}]}, 0x38}}, 0x0) sched_setaffinity(0x0, 0xffffffffffffffb1, &(0x7f0000000180)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect(r4, &(0x7f0000000140)=@pppol2tp={0x18, 0x1, {0x0, r3, {0x2, 0x0, @broadcast}, 0x4, 0x0, 0x1, 0x3}}, 0x80) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r5, &(0x7f00000000c0)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$inet_tcp_int(r5, 0x6, 0x2, &(0x7f0000000040)=0xfff, 0x4) sendto$inet(r5, &(0x7f0000000000), 0x0, 0x20000802, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000000)='sit0\x00', 0xa) r6 = dup3(0xffffffffffffffff, r4, 0x80000) ioctl$UI_END_FF_ERASE(r6, 0x400c55cb, &(0x7f00000004c0)={0x8}) getsockname$inet6(r6, &(0x7f00000001c0), &(0x7f0000000200)=0x1c) sendto$inet(r5, &(0x7f0000d7cfcb), 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r6, 0xc0505405, &(0x7f0000000240)={{0x3, 0x0, 0x0, 0x3}, 0xc26, 0x9, 0x4}) shutdown(r0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r6, 0xc0505405, &(0x7f0000000400)={{0x3, 0x3, 0x332, 0x3, 0x21}, 0x4, 0x3ff, 0xffffffffffffff80}) ioctl$TCSETAF(r6, 0x5408, &(0x7f00000005c0)={0x1, 0x4, 0x64c9, 0x326ee025, 0x7, 0x40, 0x0, 0x4, 0xd54c, 0x8}) r7 = gettid() capset(&(0x7f0000000580)={0x20080522, r7}, &(0x7f0000000480)={0x7, 0x4, 0x5, 0xa3e5, 0x9, 0x8000}) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000080)={'lo\x00', {0x2, 0x4e24, @local}}) getsockopt$EBT_SO_GET_INIT_INFO(r6, 0x0, 0x82, &(0x7f00000002c0)={'broute\x00'}, &(0x7f00000003c0)=0x78) ioctl$sock_inet6_tcp_SIOCATMARK(r6, 0x8905, &(0x7f0000000380)) bind$inet(r5, &(0x7f0000000540)={0x2, 0x4e20, @rand_addr=0x9}, 0x10) 18:18:41 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x1, 0x0) openat$cgroup_int(r1, &(0x7f0000000080)="6367726f7570010061780b830e22746800", 0x2, 0x0) socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) [ 229.111090] netlink: 4 bytes leftover after parsing attributes in process `syz-executor3'. [ 229.128813] binder: 10800:10802 got new transaction with bad transaction stack, transaction 108 has target 10800:0 [ 229.153184] binder: 10800:10802 transaction failed 29201/-71, size 0-0 line 3039 18:18:41 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x2) openat$random(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/urandom\x00', 0x8040, 0x0) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)="09cdc10bb3efd22a78a2d6c5e96c2ee076528f99b9601b649b2399ce7319b1d4c8877e6118c12a2696e92c9f539ec5d7111ef67f1fd4ed17025f53c7701e3aa1d343b1cb908de3db5aa31805e6a4884b668ed08a9db55c74e5fee3fbe8340db59b564118d92b09eed32a48015471e01e009a77724cf8c77e8e880d4238f4c3848099728c45c1cfd3d5efc5b65376b0958202e0d3e1acd75f9af6850ea0019f323420a56cc6cf302776e38df966c8088eb5b40d6a527ae1b849be85d1054b123a5c8d85341abfda6d5edc114d4fa8aa41db5c7ff87a2d0030526088ae6ab915efd19d8fe1cfcef355e53cb113e03a8967649556748cc061917a22990af513", 0xfe}], 0x10000000000000b6) r2 = add_key(&(0x7f0000000140)='.dead\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000240)="52b548adea43014addd2b3a20d9ee16d5f541856b2ea79cbb790c940086903cf4817f9ef9898889c682f57ff84dfe2381c750eba850037b4f1ab74d970284e7398f60102b230a60f60c4ee7027b1c40c174033994ae5a34bf5e3de71", 0x5c, 0xffffffffffffffff) keyctl$get_security(0x11, r2, &(0x7f00000002c0)=""/65, 0x41) [ 229.200458] binder_alloc: binder_alloc_mmap_handler: 10800 20001000-20004000 already mapped failed -16 [ 229.228608] binder: BINDER_SET_CONTEXT_MGR already set [ 229.234724] binder: 10800:10802 ioctl 40046207 0 returned -16 [ 229.240939] binder_alloc: 10800: binder_alloc_buf, no vma 18:18:41 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) [ 229.265427] binder: 10800:10817 transaction failed 29189/-3, size 0-0 line 3135 [ 229.276986] binder: send failed reply for transaction 108 to 10800:10802 [ 229.291671] binder: undelivered TRANSACTION_COMPLETE [ 229.305053] binder: undelivered TRANSACTION_ERROR: 29201 18:18:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x2) r2 = socket$netlink(0x10, 0x3, 0x1f) ioctl$sock_SIOCADDDLCI(r2, 0x8980, &(0x7f0000000080)={'yam0\x00', 0x9}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100)='nbd\x00') r4 = openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x0, 0x0) setsockopt$inet6_udp_int(r4, 0x11, 0x67, &(0x7f0000000380), 0x4) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10004806}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x2c, r3, 0x20, 0x70bd28, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x240080d0}, 0x4000001) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000000000000007246f82a66b4b352000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 229.318331] binder: undelivered TRANSACTION_ERROR: 29189 [ 229.328156] binder: undelivered TRANSACTION_ERROR: 29189 [ 229.386107] binder: 10827:10829 got new transaction with bad transaction stack, transaction 112 has target 10827:0 [ 229.398023] binder: 10827:10829 transaction failed 29201/-71, size 3096302199257432064-1387508838 line 3039 [ 229.420430] binder: BINDER_SET_CONTEXT_MGR already set [ 229.426515] binder: 10827:10829 ioctl 40046207 0 returned -16 [ 229.440636] binder_alloc: 10827: binder_alloc_buf, no vma [ 229.446538] binder: 10827:10837 transaction failed 29189/-3, size 0-0 line 3135 [ 229.455552] binder_alloc: 10827: binder_alloc_buf, no vma [ 229.462387] binder: send failed reply for transaction 112 to 10827:10829 [ 229.469573] binder: 10827:10829 transaction failed 29189/-3, size 3096302199257432064-1387508838 line 3135 [ 229.480137] binder: undelivered TRANSACTION_COMPLETE [ 229.485736] binder: undelivered TRANSACTION_ERROR: 29201 [ 229.500308] binder: undelivered TRANSACTION_ERROR: 29189 [ 229.511626] binder: undelivered TRANSACTION_ERROR: 29189 [ 229.525486] binder: undelivered TRANSACTION_ERROR: 29189 18:18:42 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) 18:18:42 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/tcp\x00') r1 = socket(0x2, 0x10000000001, 0x0) listen(r1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x7) sendfile(r2, r0, 0x0, 0x462c) 18:18:42 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) lremovexattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.system.Security\x00') r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)="617474722f736f636b6372656174650026a0d1f210f916450b760e027ab62f25bd516528e7e6ced06e838dee008c46df847c7641c8e60d3a5c1d2edb1e1a6dd45d080b30d40c") write$selinux_context(r1, &(0x7f00000000c0)='system_u:object_r:semanage_trans_lock_t:s0\n', 0x2b) r2 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) getsockopt$inet6_int(r2, 0x29, 0x12, 0x0, &(0x7f00000002c0)) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) 18:18:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x80, 0x0) ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f00000000c0)={0x0, 0x7fff, 0x7489}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) setsockopt$inet_int(r2, 0x0, 0x3f, &(0x7f0000000140)=0xfff, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e0703f1406d4438ff0000000000002000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000100)) 18:18:42 executing program 3: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'gretap0\x00', 0x1000}) 18:18:42 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'gretap0\x00', 0x1000}) 18:18:42 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 229.876215] binder_alloc: 10851: binder_alloc_buf size -1080011660208373760 failed, no address space [ 229.890423] audit: type=1400 audit(1544897922.379:80): avc: denied { create } for pid=10850 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:semanage_trans_lock_t:s0 tclass=tcp_socket permissive=1 18:18:42 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) [ 229.924134] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 229.939797] audit: type=1400 audit(1544897922.409:81): avc: denied { write } for pid=10850 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:semanage_trans_lock_t:s0 tclass=tcp_socket permissive=1 18:18:42 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) r2 = socket$netlink(0x10, 0x3, 0x9) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000080)={{{@in6=@local, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@loopback}}, &(0x7f00000001c0)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000200)={{{@in=@multicast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@mcast2}}, &(0x7f0000000300)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000480)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@multicast1}}, &(0x7f0000000340)=0xe8) r6 = getuid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000580)={{{@in=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}}}, &(0x7f00000003c0)=0xe8) lstat(&(0x7f0000000680)='./file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000740)={{{@in6=@mcast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast1}}, 0x0, @in6=@mcast2}}, &(0x7f0000000840)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000880)={{{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4}, 0x0, @in=@empty}}, &(0x7f0000000980)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000009c0)={{{@in=@multicast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f0000000ac0)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000b00)={{{@in=@empty, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@dev}}, &(0x7f0000000c00)=0xe8) r13 = getegid() fstat(r1, &(0x7f0000000c40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x8, &(0x7f0000000cc0)=[0x0, 0xee00, 0xee01, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0]) lstat(&(0x7f0000000d00)='./file0\x00', &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000dc0)='./file0\x00', &(0x7f0000000e00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000e80)='./file0\x00', &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f0000000f40)={{}, {0x1, 0x2}, [{0x2, 0x0, r3}, {0x2, 0x1, r4}, {0x2, 0x0, r5}, {0x2, 0x4, r6}, {0x2, 0x3, r7}, {0x2, 0x0, r8}, {0x2, 0x5, r9}, {0x2, 0x4, r10}, {0x2, 0x6, r11}, {0x2, 0x4, r12}], {0x4, 0x7}, [{0x8, 0x4, r13}, {0x8, 0x4, r14}, {0x8, 0x2, r15}, {0x8, 0x0, r16}, {0x8, 0x7, r17}, {0x8, 0x5, r18}], {0x10, 0x2}, {0x20, 0x3}}, 0xa4, 0x1) [ 229.972374] binder: 10851:10854 transaction failed 29201/-28, size 0--1080011660208373760 line 3135 [ 229.980256] binder: 10851:10867 ioctl 80086601 20000100 returned -22 [ 229.989974] audit: type=1400 audit(1544897922.409:82): avc: denied { getopt } for pid=10850 comm="syz-executor4" lport=38908 faddr=::1 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:semanage_trans_lock_t:s0 tclass=tcp_socket permissive=1 [ 230.015128] binder_alloc: binder_alloc_mmap_handler: 10851 20001000-20004000 already mapped failed -16 18:18:42 executing program 3: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'gretap0\x00', 0x1000}) 18:18:42 executing program 1: mkdir(&(0x7f0000000140)='./control\x00', 0x0) r0 = inotify_init1(0x80900) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vga_arbiter\x00', 0x80, 0x0) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000002c0)={0x40, 0x7}, 0x4) r2 = dup2(r0, r0) set_tid_address(&(0x7f0000000340)) getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x0, 0x83, &(0x7f0000000080)={'nat\x00', 0x0, 0x4, 0xc9, [], 0x1, &(0x7f0000000000)=[{}], &(0x7f0000000180)=""/201}, &(0x7f0000000100)=0x78) inotify_add_watch(r0, &(0x7f0000103000)='./control\x00', 0x40) inotify_add_watch(r0, &(0x7f0000000040)='./control\x00', 0x22000002) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$FS_IOC_GETFLAGS(r3, 0x80086601, &(0x7f0000000380)) truncate(&(0x7f0000000300)='./control\x00', 0x9) ioctl$FICLONE(r1, 0x40049409, r1) [ 230.029810] audit: type=1400 audit(1544897922.409:83): avc: denied { create } for pid=10850 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:semanage_trans_lock_t:s0 tclass=netlink_tcpdiag_socket permissive=1 [ 230.035958] binder: BINDER_SET_CONTEXT_MGR already set [ 230.035968] binder: 10851:10864 ioctl 40046207 0 returned -16 [ 230.036534] binder_alloc: 10851: binder_alloc_buf, no vma [ 230.036560] binder: 10851:10864 transaction failed 29189/-3, size 0--1080011660208373760 line 3135 18:18:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:42 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'gretap0\x00', 0x1000}) [ 230.036650] binder_alloc: 10851: binder_alloc_buf, no vma [ 230.036940] binder: 10851:10867 transaction failed 29189/-3, size 0-0 line 3135 [ 230.037136] binder: 10851:10864 ioctl 80086601 20000100 returned -22 [ 230.037317] binder: undelivered TRANSACTION_ERROR: 29189 [ 230.037330] binder: undelivered TRANSACTION_ERROR: 29189 [ 230.037376] binder: send failed reply for transaction 118 to 10851:10864 [ 230.060470] binder: undelivered TRANSACTION_ERROR: 29201 [ 230.060482] binder: undelivered TRANSACTION_COMPLETE [ 230.060491] binder: undelivered TRANSACTION_ERROR: 29189 [ 230.133286] binder: 10876:10877 got new transaction with bad transaction stack, transaction 122 has target 10876:0 [ 230.155015] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pig=10881 comm=syz-executor4 18:18:42 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000080)={'ifb0\x00', 0x400}) 18:18:42 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_emit_ethernet(0x32, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0x7, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x223, 0x3e8}, @local, {[@lsrr={0x83, 0x7, 0x5ef, [@multicast1]}]}}, @igmp={0x0, 0x0, 0x0, @broadcast}}}}}, 0x0) setpgid(0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x40, 0x140) openat(r1, &(0x7f0000000040)='./file0\x00', 0x0, 0x2) [ 230.185184] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pig=10881 comm=syz-executor4 [ 230.198672] binder: 10876:10877 transaction failed 29201/-71, size 0-0 line 3039 18:18:42 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) 18:18:42 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r0, &(0x7f0000000180), 0x100000000000027e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.swap.current\x00', 0x0, 0x0) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000040)=0x8001) 18:18:42 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'gretap0\x00', 0x1000}) [ 230.286567] binder_alloc: binder_alloc_mmap_handler: 10876 20001000-20004000 already mapped failed -16 [ 230.314359] binder: BINDER_SET_CONTEXT_MGR already set [ 230.319751] binder: 10876:10877 ioctl 40046207 0 returned -16 [ 230.326061] binder_alloc: 10876: binder_alloc_buf, no vma 18:18:42 executing program 3: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'gretap0\x00', 0x1000}) 18:18:42 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000001000004) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getgroups(0x3, &(0x7f0000000100)=[0xee00, 0xee01, 0xee01]) getgroups(0x1, &(0x7f0000000140)=[r2]) ioctl$TIOCGSID(r1, 0x5429, &(0x7f00000000c0)) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000000)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) epoll_create(0x8c49) [ 230.342773] binder: 10876:10902 transaction failed 29189/-3, size 0-0 line 3135 [ 230.358036] binder_alloc: 10876: binder_alloc_buf, no vma [ 230.365153] binder: send failed reply for transaction 122 to 10876:10877 [ 230.372254] binder: 10876:10877 transaction failed 29189/-3, size 0-0 line 3135 [ 230.379928] binder: undelivered TRANSACTION_COMPLETE 18:18:42 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') [ 230.392561] binder: undelivered TRANSACTION_ERROR: 29201 [ 230.412404] audit: type=1400 audit(1544897922.439:84): avc: denied { write } for pid=10850 comm="syz-executor4" path="socket:[27677]" dev="sockfs" ino=27677 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:semanage_trans_lock_t:s0 tclass=netlink_tcpdiag_socket permissive=1 18:18:42 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) getsockopt$inet6_opts(r0, 0x29, 0x0, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_open_dev$sndtimer(0x0, 0x0, 0x10000) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000000)=0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000100)=0x3) ptrace$getregs(0xe, 0x0, 0x8, 0x0) r3 = open$dir(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000180)='trusted.overlay.upper\x00', &(0x7f0000000f80)={0x0, 0xfb, 0x1015, 0x4, 0x4, "92eebbfba9acb25f112383e839052802", "41aef8e56d553eac0152280d2304e606bf58c6de45b81d14a4ae68dd11a3f84b59bfb7c4b808868c7191126ba3549aed013e949d302b6f34390755bb0bee44b19f8874531cb387f5046ffca42856faab84c7faf3df40f9f5d421f8435744e30a35c4661e541a785458d7238fc84e960dd99f6659444cd61d7a372bc8db410f2e603f288fa6f76cdc6225a25416f6906df0adaf0640b153de073062d501f1010fb783b02f5b8d33416d7c401ed7f30348cf53e52721d93ffcd50a0db2e339b6fec01acfac026dee01795a9ae48501ae1ff68b99ff3040e4fb14eff102ad0d99b36a620cf8633e7e1a3cadf9cc256a4ab402fec8ac49b7678c990246f01d83b2cb0d350aad0334944018f5f82ca82b28e16a69c3c08bf6425f0c5b5513a169108b809ebc45e5fdb42eb514c3c7357476832d33ea0f8dceb32256a7d2494f704467c3d9e81e96344ece30463725448b570c837ebb52d0f897ef447e47a01600d8dba955dccf108d324384de0a7d3a5e0253dc1402ee535e7b9b4913e08903f7a68d4e5fcc756479b25525633a159b65ef030a47d824fa729daa276228dab73a206e0723db4a5a93aa00778b600bc4e1df43650a4e944a67efb71889c5a216c12d5cee581c5f2c450857f0d30a6bbd2070e85676fb706fee6c18349576e21deb657331dbf211bd3cfa0cfb5a37db0ac50bbf0f4faf9a72ebf37925eff439edaa9a6dc09a1b5812cc7129e91b9c90db5491c38eacb3d49ffe08275f890ea8fa7006b29b29d66b6c7b70303082472484273203af84538db5cd0acac8ae3505e5fcb2ec7a3a0f98cad9ef5c4ac1efce5ee25eff636c859b7da858d1b6694b5f28f00798ba7b6429a80ea498426d8b6aa4fd069734703421872da2d7f2ecbb1b2133a95b1393d8baf7d9ebec2d5c7e83dd9de5a7cce3fcfda1d4aeeb5c7a1e4503df178e8b7f9bf4d78268a11923075030b2e6a5350117bb8a53887f226fceb850a8ec1408cc29a2aec3bc488f3b188df0adcf07fb55b160ac0262838e1c9ce5adcd4ed0287f06a268dbcbce3ed7ea8cd8ae585521e1e133c3111a013d5e2f38cc0bd4c243bf7e0b27a62c60f6660ecc2cf1f36ac0a5c23c3251c84633f7ce7fc9925252dd5d58b6418dff8181fa6e94aaa990fd3d342806ac517685202184f4321edb9d66bb7db6cc34e74678c27b5a7030b1b4eb42e7584f3265885e90b10c5210ae6b346e1a89cf11e870c7af95f48b51d271027d3cef1fea6eb0f398802cd3b5888736f0b5191e3c5c57ebb5b4f19097b6d68ffda36688aafc4194ffa5cef32204a881b5019332f0a2de3294a063d05beb9b0d47d16cec6e71ac2061c41e50088e8ffb11d02749bd970d5d2ced081652fcc9290aba7d012a5f055b6fc41c85963b1e66c8cb15da5e5787e7c932374b9cd0591800a300150586f23166b1a2c7f91c5f79fc2b3bc66e11918d9e6af41aac4f3acd9154c973175e45eabb08258e5a4de2c2dd04ee813ba9b91a3e638ca03a7ba9c8d9cec8a4aea63417f8dc8c7f101cc1d83046e642a75e72df58fd8fb93dddeaed1655efa1bfad0d366cfc69050b9d714f069bf924c05c4fa4fb208d60e4d43c18e842b987d73948fad658906492036d9bd8e9a86b901b9e333abc055406b8380b897e6ae72906240620bb9aed428430119e956d3f7707460383ce03b05121681406507e3c8ac259487df4c954d8f4a61772717a7b9007b419abcb681b57a0c3ff2f335854eb9489fa18470e3bbfae0f5c02c5b257ec168c61daf3a2b96a3e080163c56dea8949b401060f3517632b5bd9b4f47b827da7a01639b6e254ae9e526190b7b68f4eed33015c56ba9c07c15806f634028c2f5fed810348f8d35d624937733db0f1e3bf38d5b6241159ee0aa328cf7b36a3707de40c0185b53ad8663da2b9630af75da99bd10e90ca9b8e0020aa6c217d96ce20a3734539295bf8755e171143cd4bed069047727aea1fb336b29a719e84478759bb42686b0239f49040a2c4df96fae1153cc0b82eee2330a31ff4893f4b9fcf6f7ee7827b2bca9ff67073f9f7e5a0a50066d6b58f21145ebd56d62e901f9025fa8909de72801a2649f62453619064e941fa4c9ad89f1da4ded6b4b5485294b043803fae0ad8a6f2963d0dff694d5c532daa8c06a9e6c4be12bfbd02f7f75d8c677b49a269df9103fe39a3ab20e1e9f42ac801da5707ebe33e9a6432b70173275b4a60ee646c0c98d0eb62c173352ceb34ba5c461fce8f0e7cc9120389180e496ba60107ed6fae294822a3ccd0903c2963ae4bbda34caf5638df3acef5297809ee36393b02ab76ebc9ceb2fe359494f4140a5f7b6ac783a9da383b1b00c409f5a620ceaafe1a259a5cff8b68394332eebc70b31ef4ea1256b56971e9aa213d5854f494bd48e82c011a90354a79e10b4ddca6ebe3ec8136671045760ff31ca5fcf4a461f742f005e89bd53f18e817f7c96df45f616ed6121d94e5cf0efccc218087743508a02da5d6ddea6032202f7b9bd549a1fa48f81a2a23a8dca36da8c56499312d5a0a5938e62627c60d8133821fe6b0f93d6bbdb785a915ab14259b72f1a84373cc43735f8ca63dc9978a0cec08b05563a8fda02cbba82ced2773ca21437896954fe8d838ce167d2dd87074a158fe6dad103d05d3da8521d69847530ee3c979e702a0f8fa4ea9996ff2848578663cf09290f59fb23743d0c4e601c2c3f3e2950ea8743d25e6f212ac79ccf2a8c82d7cd7f2bc57092f3d85ce069edcb3b0d2c87238d42ec379945823d4f4a27ee6f425032487e3772c21c5fc57c80fb02bf04feb240c4779acc62757badc3e09ac8c3c17dce262a33b9b3547de9d2f9f5184b05dca63a8cba35e37a9aea4f6ae37bc472c64f7c35d49f5d173a07ebffeea1abccc1c261297109a97a1d3880e4ec6ca70e6bd7c1eb8f53dfd56562d11597da9ef8e6bbd85e4017cce690da58984b3ebf5de4c6c60173d635af311e91fbc2f88ef046d80a393c2f8b52c5775d01e4fed049d3e36ad974b8dd48024cfce0109d3470f16f0ce08d21328ccf779314738abcb543f098bdb39e80dcb27f3f7acd4b09cdff7fd02378223a691381b2eaef8ae3fdc2d76044ca1af05153592db3b136f2e83c4626a805252e0519e97da06165f1e8615858385fb58ce2619fe6dab6d1d2e6006d0fecf41fad4c432ec5d04c43650cb56eb90f054e40243577ee633b0cd5be615f707fc003b269d8022d01d5bc238cf51b576fe810ccf2154d0e24f032b5005744d23c478da2b1cec81890cdb9106a0b89d5d7aa75611a694f02e0a436b2b6729ad810753cb7c163e6e25dbc6710850fd42d0a378e74bdc65dac60a0b2821fe7e7a1237f428c38d134164ba927929ea4c669acdb66ad4589aff3b35b7801b5fa7986e93bd7353e1015852eee7b9cd847ad4a854b2e8bf3cf192eb22f07c1f9897b268188276b1a55633e0ff5d2a1344dc9729bee0af10ce05033c71268e448fc406afd2631edcdd86aa33333a801c3fc1ca36440673287899f1a5bed0904720260d80d12e95c8c0aa9e77d3e85eafbf56a582361311bfbac5f4af50e65a44f83f941076e366907c104926ae612ca44ea36d01373a85092d3c5dd580f0243470a38078ef93d92fa415f64fc944282f758c58c550e63dd782e4fc32b4fd2b7d2aacff170941cfadcb83d3fada977f82084a8b51bda289135ab36e0d766077cfd3b4a50d7302b090fa815c89fdc7535585f542d75b2cc69c640bd2404fd54f4646115efdab684d0ca8e1a84e01ff2767d9dbc65064d0bac9aa0f13b2cf97d647384200b8aad08051cde27b169f0ee55a6c04f7c9a67bdd6ac28e75f00f884d2e81c57f2bebb695dc6743d6218c5f2a2b82c5729dfb5f379e01ad55ab3c07818f332f8fd208582e3f1ff2ca39dd6a9be48629b2e9b9b93c61efb4a24b4b83843ea7bc59dd0559baa3f8d5f4a2a8ff2536726e43e1b126e87cc60eeb85391d8fb069b10dee53891ad7a8c41763ecdf0eaa49f526067448610048a382a1bde6738935468a28064bba02096e4100f6eb4ef6d3163cf06cee4313054a6907aaa7f36698ff528751f8c827937c838c6938984620892ba48f7fd2d1e4cb63ab8c291858c9d31907503658e289e695df1be0dbeffee46ed9a5017af3a0990fb3916d2b8f90865dcda4304dd0071834ee7941a027447b12a431911c5cb6a7a88522c72fe3d9e6162ebecf3f6b7d04f3308389b1377ae75f4de1568bee76677f0bd90c7b8ad31a34055b6eb3199f5aff4392f6d5060a07d7e385f1176b31b2deed2a598a337b3892ca6c306ae1b82394a2a97597c91a3fe517bdb56988a9fb1166c93743b4fb781e1644d003c50370411fbfba3ace7133e752f4c6b193719a69d6337d262fd15776f7350a1022abe71a56891c9632e0dbc9c03c180b74c7fe1e92e7503046366727b3d3d27ec0234f701768d74b4109050089c2d702f664f052037d8d6d09e9a1021b3768ae77e6da1a2cf0b5598de5229869ed8e0ddac6851849dd465d069cfefb781a75ae46777493ea4a10ef33da1bd81a702d43a8847526ab4ff01074dbea8985a7e12116dd1330a64d751cb5d91bbe725b846ba3774f444306d2cff749d9e50ab52f6234cf1fb6810a00745465996b99d616375e28b20ccedb693e0e480bc081b40542e44dacc87dfb10b4f637730239464a9a2d6f2d13a42bf6a4198e9a6ad1ce5391d1cc7f1d9dc6f362c67a6d1619767c6e0573581b7e27414a6dfd0106f0aa2306d1863cd44741ce62ac5884402fb1716c00d64e3366d90e5a3dee39b9ce19f6bb034abca0c7910c86a2b47a48d9d9bc4f45ce0ed4aa35f787b5f217f45412dcafabba7b533fe38c38b6fe10a776639969f71a697cd813633e8ed46f4b9fb5a890164907860e352b3d311cd8ef67675e88b390e07b3e913d7788332ca329133955d72507028fe4e73631fd078e180479b205e241bfbdd065cde689f2220fa8b366f4890c2f6024e1c2cedcb7b38b0c302303cddfd247ee369004dbc26710ca23e63e765da186107b9082895bb0f212d061f98cf632eb452bf48ddd4ea2c10885b51732635e972ddc2e1f01eee74c275a4108394b8bf6aa417d36e1ae7371872a960e5f729cae74fc485575d5e48be1c28f38836429fea1cb02dee5eb4fad5f1b5224246bf0dcdb71d8747cd3517684837f64ff5b2269fed5c1811bd3908da9dc8253b5102e94656fc6f9e8da69e91ac4702045245287bd0abb0a0e7508dc8174bb14de35bf06f4a9951e6a9d3087b7c01d581468996d5f65717399438cc23ae61eab0301f8e315dd7f808d33b66501152fb9c7770b7f1d51f020d2ff22c681b3f099e0fc6eaf7229f3b209215c109db58e2c7aa1560da782e75eccd730cd00bb769a7761c91c58de696a20b3ddd73e0ecb6ab49c08f07620f06c6d12e057d434e73f0cbd9d7f6161e1cda99cc0fe4574292d6777a66469fdd477f8e6f99d7b8a8e1127efcd96f71f96e3cf4d484987bf88bfc16c417717b30a91603656999024a7dde54ce1250e55c23a51e82495f7f949c252380f1bd3808a670ee6a520ca15554be41df9e85d609c3bef32ec060a18e1f5abd18f56d6afddc4faeeca140c2196f65c196c93561fb7138e4fa4b94eed759262119b99144ee78458236c4a7e73c46714b52f2b7ae60726ede21d657f8a2bedbad7ac2ddb9d9272988287c842b0c1ea341bb7ef0b5608ef307a76855feaaa0b025dd48113b1b8c72254c111b92dccd83400b08b39e4b30437bb3f972b886f07"}, 0x1015, 0x3) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/status\x00', 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000f40)) flock(r3, 0x4) listxattr(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write(r0, &(0x7f0000000400)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, &(0x7f00000002c0)=0x26a) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000009c0)={{{@in=@multicast2, @in=@local, 0x0, 0x3, 0x4e20, 0x0, 0xa, 0xa0, 0x0, 0x5e}, {0x0, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xfffffffffffffffa}, {0x0, 0x94, 0xa7, 0x9}, 0x7a22eee4, 0x6e6bbb, 0x0, 0x0, 0x3, 0x2}, {{@in6=@ipv4, 0x0, 0xff}, 0x0, @in=@multicast2, 0x0, 0x6, 0x2, 0x0, 0x2, 0x7ec, 0x8}}, 0xe8) sendfile(r0, r3, 0x0, 0x10000) 18:18:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000080)={0x3, 0x12, 0x303}) 18:18:42 executing program 4: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) ioctl$RTC_AIE_ON(r0, 0x7001) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, &(0x7f0000000000), &(0x7f0000000080)=0x68) [ 230.441366] binder: undelivered TRANSACTION_ERROR: 29189 [ 230.446846] binder: undelivered TRANSACTION_ERROR: 29189 [ 230.454542] binder: undelivered TRANSACTION_ERROR: 29189 18:18:43 executing program 0: sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x8000009) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000100)) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpgrp(0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) capget(&(0x7f00000001c0)={0x20080522, r1}, &(0x7f0000000200)={0x9, 0x81, 0xffffffff, 0x6, 0x3ff, 0x8001}) r2 = socket$inet6(0xa, 0x400000000001, 0x0) r3 = dup(r2) keyctl$session_to_parent(0x12) fsync(r0) ioctl$ASHMEM_SET_PROT_MASK(r3, 0x40087705, &(0x7f0000000280)={0x6}) ioctl$int_in(r2, 0x5452, &(0x7f0000000580)=0xe2e) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000340)={0x800000001, 0x0, 0x5, 0xffffffff80000000}) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000000c0)='syzkaller1\x00', 0x10) ptrace$setregset(0x4205, r1, 0x3, &(0x7f0000000380)={&(0x7f0000000680)="2a118ffa87db273dae83a284988593a5ffb540c83125972fc03a8d0ec5ec5ad60ac810819820c770ac79d139d6175978c639fe46dc9053e60f3e6a6bb63bc6a96d3bd67ba0daa78334d4e91683237746bfd5ec01663da8187cc39189f7ed1c69eaf07b491c25cb14607620d8361f1617c79ae4e57e8da998763caf7d0c4cb0438826b90061b360638b1af62445f65c7a30b3d6e5d20b36718427e9", 0x9b}) io_setup(0xfffffffffffffff9, &(0x7f0000000240)) io_setup(0x20, &(0x7f0000000300)=0x0) io_cancel(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x8, 0x423, r3, &(0x7f00000005c0)="f2f42245d196f91a48f2b821d3442e277a43f0ca0ad8ed1b65a81f934bc9a4fdca52f744ec264514eba836b2ca9b2e580d83a0ab4e20c5f62b71ca27af042df6ea32e6c5c9369755e64b56aec0188ec11bcea89595863c737ff8c0f248ad0d9201ff46962f0087fc1990817fdbaf8c2d3ca9a833872d38e2a9005b2e2903904e622869", 0x83, 0xf, 0x0, 0x0, r3}, 0x0) bind$inet6(r2, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) write$binfmt_aout(r2, &(0x7f0000000740)=ANY=[@ANYBLOB="07010509f7020000b80100000700000066000000090000000000000000000000ae4ce8b7539d67e1099ebadd122a2e359b6ee0ef2467226e8f39f1f265b9969c4dcfe4ac47529e15b8fcece96d76566c3bc3baac04d04019290f55dd753e4dedf44450e38d6fcb093fcb84b9f4ba2334886da23f8ac5f20468a8fffbf088fd089dc4e08ad1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004f0b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x785) [ 230.505904] audit: type=1400 audit(1544897922.439:85): avc: denied { nlmsg_read } for pid=10850 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:semanage_trans_lock_t:s0 tclass=netlink_tcpdiag_socket permissive=1 18:18:43 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$RTC_WIE_ON(r1, 0x700f) r2 = socket$netlink(0x10, 0x3, 0x8000000000000004) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x82000, 0x0) write$9p(r3, &(0x7f0000000480)="a6118e8785aa9a9fbd9a192369845bec1202a2c67ff869edca3856b47d3e0efde81614dd9609dd8c555ecdc5627fd63836d5ff93d6432ad6a15a92c83dd94b5ba7232e1f279b0326c3867109c3877260cf13256f8dabafa690868f8af80ad9fcd8a7450ede6fb56e6ba7590df00935da23b0ad0d1ca21102a1eb383d44850036c3bca3cd81c6d90bffd472fa131df3d7ea80524f404df45c2fcb0f626a04691133af1c9691d297763cbf6b2136bae4d60da7cb6b2cc323f9c68920e2aeee59181a603d67b79121ef78d10fb7c5f9d2c22e92a21b616cd7ee4ddc9c49fa46a058edd28f1f02128f22c3583f246c5a16f2707769541ed2a2b2fb800f55711b09bda32e92499a412ca7092849d60760dcaa1de17d938cbef28ee55d04e44a089c3c1a4290aa2061389b9bf2685297324459c320ba03cbdc697fd78e27a70746468924c6b13b43f1c2374a7865e9bce27e4d72afa4aa855b269250d29f2d2b2baac357baa859d5ce7e0960eafc320746a81dbf56d9bd1813e1319d9f38f26bc61694335ddfffe9e2fedb600f8d629a7fae066e22d597f9249624b9dc99af1f56088b2fc5ef9f95ae5f652f16a3777f450c21430e90943e86cc274aac4bee542febb8518f76c34d744b4f0191039d5feeecbacae6b267acdfe8595edbdc748f0ad04018ebae8b892fb51573661f3b077880dc5e3186bfd88f588fc24260083d2fe8bd0e125593e5a8574ebd9045fed3b54b4fec3ccb87b91b8da744951d46ac9c1fc5fcc177a3df249a9bec35c881714e75c7b3c0ecf6848948d4078879a70c8176ea1940f93fe9b464c69d351c1c66a3877a5165550bc63213b93e0f25b200e63a245f013729541ffae32d6af509b18717bcc6fa8127523ebb4841b69f797015449133d4336fc6f5a036906a659a7142ff4c6a32f0b54213b9a035f2d7ca3ce5db55299c42fd33fc4a5aab2ae65d3692b7d89e54347d4b4555f0ecbea09b825841e4c8891d6e04f4f537cea3b93bf78a090f68ff9d92665e76ed3a3ace47236025af766db4342d86ebe82ed1d6f09182e2bac16b3aefd97e8be5e183c88940708ab48b7ac817927005944f2d6497c32206f564da7e825609a11dd7dd73f3ec2ccd65af29a48219da0b0678534de2407f5e4e579edcd910b612e878897fc2c711a7639a43dfef0814ac0b2c46ace6012274e761829518128c675f47ac8a8e3870602aa8e3afef4cf3d91ce288e62d13dc915806dc94c4e847aee040324f40124ec332ff56a4a2898ada573aaa0936acb56f07b1eed8ff4b307577c5b8116de1b8cb24131b6d34a6044b03199bdb94acbb334d05ce47c758598f9b2c4b571189e1560f9347ad0a4bc94fb5dbe8f0a8e12b76013aa2463581e52692d7069625020d1e3c6c47fe87746439d6fcc79d68c7d16693d24b05ad58c4aaa4c4c880f5479a0e117fb10ad09d38e4bafb84fb48cf4c92cdc31c0f079e5e9750409a1bb9c6aeda5785da9ecbf6a259a3aedb7bd3e2d8e7984c6290506201346ae255c8dcec10bf773906296608c6cc864e98c4873a48ed05942102b87e61a36e4e8d4fea16eadf83f9b7157bc169db25ef8caa5d4383bf4d67746b680bda9a1db2ffcf93c933a18d197e8074e883e29a1608b3c08f871677f3ec4c292bd25ee2e0b45215b822a08848ab2ec2b4aff612ace2d4781068331c8a68273466b9bd8a133e4ddc7ae7e0934e3cf89be7533cbc0522550999a19e1c09146f00480712916c7a6161be26bcaad66d110d2b211cb7fc3ca10768025a886f5dfd419b2d056fc9d492d94ea2269030144939aaa21e56ceaa26b687ff72ac65b42e5616f228d0789c1f7da111305b56e08a13fb939665f4fad51343cfbe4357226d04296d8f93de7c239f3308885d060097bed64de9633bb846595fcecb81e274f503e593abad09162105f8c5fc79805d39952884f5f29bb324120c1ce0445e77396c846386b3026380968a11e96f770bf7844316e11271ffe10f122881f92bf657902bfb6b5b2496cb7bd136ebb1bad2db553dd7de8b288c9a54382d09010addc4404e1b0e3dbe36700ce87193dc003a58742740d69f13fa6c61b80c40e76fe300e0e295347def546367585cd39d72aeb6f88a235e4d3c76b10e172d2e6e98ae6d5d3ea099e16f0eaa83c034266da4dd92a345e6301e0aa5683f9482f02b5e77dba192393d4ba126bcaf98de0e05f413be7a1f65a804b8694401a917126bfd9d160cf821266d6c8a20d820620c2a8b56a9e16963438c5b7be5ea70999b5aa90caeef8281f1ae2bbbae8ef46de04b32ed45933bc94ea631055ff1518a93bf958f64d7f3c0d5368db76ceac1e774651ffc43300edd06358e7e36626e71aa35d2085c59867880c3683adbce20d2a0bbff555c5f56f782b9f3e91d06c4bf3c7fd2bc8b59b6e1462c187877b03e17b003b9205985a92940feca6894b490a8bffb506ba2634fc15e889fe28d35945a9a5965ef57e964c5304a86a314f2ef6ed3c78abed8e2cbe9053e018e8b6930b7b6761ac671210d35b245c44387bbecf451b1d6cb12f85d0371445d5881e32774153f685612c3f5cff6436ef630555036fa18196314078132f6147e1aca022765c1e8d90fab412e14d822aa0d9289da7beb7c888897440f6ed20c60ed54338c972acc6ff2455892a1d8c0585272368d6619460060445c856499c7425183000282e6e9a020a25f6b8926c93162cab0ba7f2acb888c006d9d9e71e4b2b11d696af7cfb13669c633a770dcbc7cae943a9deb538230f55941f302a58cd015ee15cbc038bcdd0b51b4deabd4e2e03d8a83cd1e5c0e7bf38cdee830dc43624aff1fc67a17360747f0e67930d4cf8781f29f5e1553c550bc8082e5cf2054e0511ee628da208e99651416baa9752ecb9ce2c3963ab8c154de07bf3c1c72707c35506f2c7fd051eb2e3f393833a3843ecab939ef675b84226937f559294de597d15d88b224d46cc7d05c9e2be07f328a2f29e13055d35a97466ce9e1c7f64731549153bd00e88f5a1a2bdd2b408dddb2c92ce9b57cc388434b94d891d0ed79e715010a149b6b0d5abeda63c12e68523087532c1715ede487b62d9a8192f79253523beb12c7aab522316e6ad1e12acc60979c8e03065178bde45949b5991e08772a3c88a77e3685707588950b41a8d7912f0640a05e80ce4c41e34574b3e261994d284b6b41847b0bbe239abcef666bc298ad6d9171b0ea3e63a1775ffaf43c0a63501271fed1531bad1cd77a6888143dfe57e2a56559f24b25bfcaf800d68ea6424d20db473e72e1ad64b1e97d1a3dd911eae117ec7b21bd8d918ffb96bc4267cbff4e9389c1c0747a539cba8974d488acc34cf786eb5e2b9fb32788301f81c116995998e6cced200867791e930dbb8bb80f7d470fb2bf5b6c1389e19c84eb3633ac535dcbbb2bdf560e89a888135c70186a52410eb385716ec65c96b843e76dfb897b91d9fec6f333f85baf59b4a1a0e6dc1567fd44333dba767dd9a4ee8bbab4cb29252dd2c06b033debeb8d59775aea60c9eec1c436e6b4d20ef9a508eb29143009c2864820eeefa04fcf9a7c13c464fde3ca950d0c080c2cc1382dd4181ddf0218656022e653059748e73bb670eb9e9eeefec581014974ee0fd91ff458292c1323a3de2237fd9dd99e76cce3b6cb30c61a3f3855b9656d8c4de1c6c17d87d830b05b2f228268ae740bbfcf6644c4596b5e63e74f117df5fd396bdbde5525a793ec26171485c43fb66dd0fd5eeb1ea3da2f9451a721cc28c8a495910489f0db283cfd17609ded9ba54cbc8421c2b5ef6c9bbab950de95174b67b3f66dab2dcea01d77167a7b56cd0cf13d15ebce1697dcbad16533960c601dd923a6a1e6f6313999164f8d9e4d6998a1be6781a054e79d81a5e8b6160cffdccebcd807418c5bf574655acf1ef5c118933c62f839727c40471eb06bcfd71b8a22e1c72cd066ff5010aa754b2f3e7676fda263fa34b0b96e061fb6d9e0cbad4f4ce106432e9b2826466c354af277d109fa5082f68688306cb48124ac6e78e1e24d51582e7c03f47c315cc3b461788808483c473183163546c1210b1a61e60a25d305b40c70a7146cdd5c353b6abe99cc77a1f4ef1c537d8a395280095faa8309ae6ea78b042d6bc4b676d2c388ce30d9b122b0cedd9adabc402878381e2b7f2aa0e279c7898eb53e00247c7ac459e9b306f127caf658f11a98a36374a61a09f495225d97ace4aff075a09d52549e74da3c6d31612c9f05ae80a9c80ee90b61f2793e4352b7d3003afb4c6114966c1a898556d0347759f7ae368219e0408cbc1eaf4c804a6634fcf8d2211d765f03cf77397c9668cdb64215b70eefa889e9b4f450a191efb5e97be29434f17744e408993ada3b7d9d18fbf21407306b30a749e0039f596d1f9bb8392f3bc9449b5d1930b2e7ce6cf3e101d747c769d0bc6da54a417611604f63184dab2144f26e667d520c0ebc24f80e46026aa2de3684dfada9a597964d194967a02e1874b707fc84227f7a515d5735f48603eecc8c28f65b7dbb78e32e56b5cb8b18704bfaa1cc9f8ae97049bd8be3f913a1e7748df8b956221fe1d07cf09eecde41afb7e839e6d076c5928048b54fbfdf85c648be1f7c671970ce71bb5208c742ac980965fc84b1adaffd600608a7409cf5b59c40aaaeb8813c7bc47c6245fa14254cfd94360d99ae5bc5374e61fd10b7c93754b383bf20a99be01d7c5efef0dc2b079c8ef5f38156b2b72331449c87fd887deb088344c0d75512e17c0af90d70576fd74f61f2bfdd1d669792e09cdc0058dfa6991cb6e73b1179149fd2f2321181bc13980e32e3a2eda570461008d11f6c62fb24bd1bb5ca331252eac020348c6ea0ecd0ad56e9a7f9278e1dd549b61b2252c4e330e9dfd173d8a8ce614bb226e2c7a22d05b1ffa3ba02aa66448bfc8cac238aade0abf1738f9e7cb9659f4fd670d722df4c9186cec413d1edd06d292530c2b91793bdf07ee56c1e857621147556588ad08d5056193b219c4f562dc5076b24d027907baf528f29c5e994bee540c1712f61999362bf736345bbd4546092b888c1a4ae3f022ed0b85ce33211ee8557678aa952f89a5c16cc424a1b64ad7085f316859957e6fb95f50ada0545d68349ea9181759ecd462d264759d602a743f2704f17dc1e106e299db0fec6dd94ae217656059cec2e21b7a7e2e1561507e91f71649c82c32634437e9526308ceb65535eda3f08c5b4f0a46f90ef03bb1249939f0c1d77f736ec475295aeb88d83e556ec975f40491992b942449bb06222f9ed4c985f9aaafb4019cc63f9c95dd9a7aef115f8145efdfe824cc274c8aba1ba784e0da7bef93a2b655b60ea36370e583da57ac11317df6ff936ca75bb6aa8186422e4b3c7e8ce11911e4ff30421b8dd78b71e72f4300598c2d9e750cd8ed1872735ff271befb681a143e03559c033a2416f71fa8a7fb6c8c151001233f2f0734c9f26a925b9110a2a87879453e3a759088f5912094a0496f9f5fb128245e1cc38e62a3c302d2009c1f2a2a99ed016cc90f004852576cc6b3360eb11fbd7945de67629dac5bd95c902d52441e046f133f1bbff5a900419d9eb66b0d9c2b78973e23e665e83c99d0a0286ec9ae8102b6ab96aee6d0f37d45453dfe5754a948edcc5fc85b31628852b0bcee2178ee274a4b501e5a6917e4ce9e68a1373019a7c4509a915d313ca283110d4368295fd37105a651ebbfea7a13453f3783634ec5230aa0288aaaaf3e95248a2052cc06d908adf0750e964", 0x9b3fa71a) [ 230.548055] binder: 10922:10929 got new transaction with bad transaction stack, transaction 127 has target 10922:0 [ 230.570723] binder: 10922:10929 transaction failed 29201/-71, size 0-0 line 3039 [ 230.580115] binder_alloc: binder_alloc_mmap_handler: 10922 20001000-20004000 already mapped failed -16 [ 230.589974] binder: BINDER_SET_CONTEXT_MGR already set 18:18:43 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') [ 230.609003] binder: 10922:10929 ioctl 40046207 0 returned -16 [ 230.616855] binder_alloc: 10922: binder_alloc_buf, no vma [ 230.635964] binder: send failed reply for transaction 127 to 10922:10929 [ 230.644612] binder: undelivered TRANSACTION_COMPLETE [ 230.648196] binder: 10922:10936 transaction failed 29189/-3, size 0-0 line 3135 18:18:43 executing program 3: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) 18:18:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000600)=[@register_looper], 0x0, 0x0, 0x0}) [ 230.651960] binder_alloc: 10922: binder_alloc_buf, no vma [ 230.657991] binder: 10922:10939 transaction failed 29189/-3, size 0-0 line 3135 [ 230.692752] binder: undelivered TRANSACTION_ERROR: 29201 [ 230.707842] binder: undelivered TRANSACTION_ERROR: 29189 18:18:43 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x800, 0x0) ioctl$TIOCLINUX3(r1, 0x541c, &(0x7f0000000040)) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) [ 230.736071] binder_alloc: 10948: binder_alloc_buf, no vma [ 230.743356] binder: undelivered TRANSACTION_ERROR: 29189 [ 230.757822] binder: undelivered TRANSACTION_ERROR: 29189 [ 230.777906] binder: 10948:10950 transaction failed 29189/-3, size 0-0 line 3135 18:18:43 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000000000004) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000080)='/dev/keychord\x00', 0x14d280, 0x0) getsockopt$inet6_int(r1, 0x29, 0xd1, &(0x7f00000000c0), &(0x7f0000000100)=0x4) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000400)="480000001400190a20ffff7fffffff5602113b850e1de0974881000000fe58a2bc4a03049164643e89720000de213ee23ffbf510040041feff5aff2b000000000000070000000000", 0x48}], 0x1) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) write$P9_RLERRORu(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="2400db0007010017005c28266e6f6465766b65797f086e675c757365721f000000000000"], 0x24) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000140)=0xc00000000000000) [ 230.787774] binder: 10948:10957 ERROR: BC_REGISTER_LOOPER called without request [ 230.821118] binder: BINDER_SET_CONTEXT_MGR already set [ 230.827823] binder: 10948:10957 ioctl 40046207 0 returned -16 18:18:43 executing program 3: r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r3, r4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r3, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000000)=""/13) [ 230.829961] binder_alloc: 10948: binder_alloc_buf, no vma [ 230.829988] binder: 10948:10961 transaction failed 29189/-3, size 0-0 line 3135 [ 230.830382] binder: undelivered TRANSACTION_ERROR: 29189 [ 230.830418] binder: undelivered TRANSACTION_ERROR: 29189 18:18:43 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) 18:18:43 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r1) sendmsg$netlink(r2, &(0x7f0000028fc8)={0x0, 0x0, &(0x7f0000019000)=[{&(0x7f00000001c0)=ANY=[@ANYRES64], 0x1}], 0x1, &(0x7f0000000040)=[@rights={0x18, 0x1, 0x1, [r0]}], 0x18}, 0x0) recvmmsg(r0, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000000)={0x0, @aes256, 0x1, "8739c981cc7a6de4"}) 18:18:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000600)=[@register_looper], 0x0, 0x0, 0x0}) 18:18:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000080)=ANY=[], 0xfffffffffffffec1, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:43 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r1, r2) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r1, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') 18:18:43 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 18:18:43 executing program 0: sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x8000009) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000100)) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpgrp(0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) capget(&(0x7f00000001c0)={0x20080522, r1}, &(0x7f0000000200)={0x9, 0x81, 0xffffffff, 0x6, 0x3ff, 0x8001}) r2 = socket$inet6(0xa, 0x400000000001, 0x0) r3 = dup(r2) keyctl$session_to_parent(0x12) fsync(r0) ioctl$ASHMEM_SET_PROT_MASK(r3, 0x40087705, &(0x7f0000000280)={0x6}) ioctl$int_in(r2, 0x5452, &(0x7f0000000580)=0xe2e) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000340)={0x800000001, 0x0, 0x5, 0xffffffff80000000}) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000000c0)='syzkaller1\x00', 0x10) ptrace$setregset(0x4205, r1, 0x3, &(0x7f0000000380)={&(0x7f0000000680)="2a118ffa87db273dae83a284988593a5ffb540c83125972fc03a8d0ec5ec5ad60ac810819820c770ac79d139d6175978c639fe46dc9053e60f3e6a6bb63bc6a96d3bd67ba0daa78334d4e91683237746bfd5ec01663da8187cc39189f7ed1c69eaf07b491c25cb14607620d8361f1617c79ae4e57e8da998763caf7d0c4cb0438826b90061b360638b1af62445f65c7a30b3d6e5d20b36718427e9", 0x9b}) io_setup(0xfffffffffffffff9, &(0x7f0000000240)) io_setup(0x20, &(0x7f0000000300)=0x0) io_cancel(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x8, 0x423, r3, &(0x7f00000005c0)="f2f42245d196f91a48f2b821d3442e277a43f0ca0ad8ed1b65a81f934bc9a4fdca52f744ec264514eba836b2ca9b2e580d83a0ab4e20c5f62b71ca27af042df6ea32e6c5c9369755e64b56aec0188ec11bcea89595863c737ff8c0f248ad0d9201ff46962f0087fc1990817fdbaf8c2d3ca9a833872d38e2a9005b2e2903904e622869", 0x83, 0xf, 0x0, 0x0, r3}, 0x0) bind$inet6(r2, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) write$binfmt_aout(r2, &(0x7f0000000740)=ANY=[@ANYBLOB="07010509f7020000b80100000700000066000000090000000000000000000000ae4ce8b7539d67e1099ebadd122a2e359b6ee0ef2467226e8f39f1f265b9969c4dcfe4ac47529e15b8fcece96d76566c3bc3baac04d04019290f55dd753e4dedf44450e38d6fcb093fcb84b9f4ba2334886da23f8ac5f20468a8fffbf088fd089dc4e08ad1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004f0b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x785) 18:18:43 executing program 4: socketpair$unix(0x1, 0x4000005, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) pipe(&(0x7f0000000640)) vmsplice(r0, &(0x7f0000001340)=[{&(0x7f0000001280)}], 0x1, 0x9) readahead(r0, 0xfff, 0x7) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x40) fchmod(r0, 0x60) open$dir(&(0x7f0000000180)='./file1\x00', 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffffff, &(0x7f0000000480)='./file1\x00', 0x0, 0xfffffffc) mkdir(&(0x7f00000004c0)='./file0\x00', 0x0) write(0xffffffffffffffff, &(0x7f0000000080)="2400000021002551071c0165ff00fc020200000000100f000ee1000c08000f0000000000", 0x24) [ 231.419413] binder: 10977:10981 unknown command 0 [ 231.424210] binder: BINDER_SET_CONTEXT_MGR already set [ 231.424220] binder: 10975:10985 ioctl 40046207 0 returned -16 [ 231.425400] binder: 10975:10985 ERROR: BC_REGISTER_LOOPER called without request [ 231.425603] binder: release 10975:10985 transaction 135 out, still active [ 231.425608] binder: undelivered TRANSACTION_COMPLETE 18:18:43 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) [ 231.465675] binder: 10977:10981 ioctl c0306201 20000000 returned -22 [ 231.480154] binder_alloc: binder_alloc_mmap_handler: 10977 20001000-20004000 already mapped failed -16 [ 231.494565] binder: BINDER_SET_CONTEXT_MGR already set [ 231.499990] binder: 10977:10990 unknown command 0 [ 231.507884] binder: 10977:10981 ioctl 40046207 0 returned -16 18:18:44 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r1, r2) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r1, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:44 executing program 1: perf_event_open(&(0x7f00004e7000)={0x2, 0x70, 0xdb, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x20002000000001, 0x0, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, 0x0, 0x0) fcntl$setpipe(r0, 0x407, 0x5) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000080)) r2 = getpgid(0x0) syz_open_procfs(r2, &(0x7f00000005c0)='sessionid\x00') ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$smack_current(r3, &(0x7f00000000c0)='em1-mime_type\x00', 0x234) [ 231.520131] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 231.544023] binder: send failed reply for transaction 135, target dead [ 231.550862] binder: send failed reply for transaction 136 to 10977:10990 [ 231.558461] binder: 10977:10990 ioctl c0306201 20000000 returned -22 18:18:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = fcntl$dupfd(r0, 0x406, r1) ioctl$EVIOCGBITSND(r2, 0x80404532, &(0x7f0000000080)=""/250) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x4) [ 231.565827] binder: undelivered TRANSACTION_COMPLETE [ 231.579711] binder: undelivered TRANSACTION_ERROR: 29189 18:18:44 executing program 4: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x22402) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000001c0)=0xfffffd45) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000340)='highspeed\x00', 0xa) r1 = getpid() r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x2) setpgid(r1, r1) ftruncate(r2, 0x8200) r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) r4 = getpid() getpgid(0x0) rt_tgsigqueueinfo(r4, r1, 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x80000000012, 0xffffffffffffffff, 0x0) perf_event_open(0x0, r4, 0xc, r3, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) lstat(0x0, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) r5 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl$int_in(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r6 = dup(r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000300)=0x50, 0x30) setsockopt$inet6_int(r5, 0x29, 0x7e, &(0x7f0000000200), 0xfffffffffffffe3f) setns(r3, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$int_in(r5, 0x5452, &(0x7f0000000000)=0x7) bind$inet6(r5, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, 0x0, 0x0) r7 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0) sendfile(r6, r7, &(0x7f0000d83ff8), 0x8000fffffffe) 18:18:44 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') [ 231.639942] binder: 11002:11006 ioctl 80404532 20000080 returned -22 [ 231.657685] binder: 11002:11006 got new transaction with bad transaction stack, transaction 138 has target 11002:0 18:18:44 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r1, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 231.686578] binder: 11002:11006 transaction failed 29201/-71, size 0-0 line 3039 [ 231.696463] binder: 11002:11006 ioctl 2400 4 returned -22 [ 231.704344] binder_alloc: binder_alloc_mmap_handler: 11002 20001000-20004000 already mapped failed -16 18:18:44 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) [ 231.743272] binder: BINDER_SET_CONTEXT_MGR already set [ 231.763645] binder: 11002:11006 ioctl 40046207 0 returned -16 [ 231.769730] binder_alloc: 11002: binder_alloc_buf, no vma [ 231.784111] binder: 11002:11014 transaction failed 29189/-3, size 0-0 line 3135 [ 231.795740] binder: 11002:11021 ioctl 80404532 20000080 returned -22 [ 231.804941] binder_alloc: 11002: binder_alloc_buf, no vma [ 231.810868] binder: 11002:11014 ioctl 2400 4 returned -22 [ 231.816661] binder: 11002:11006 transaction failed 29189/-3, size 0-0 line 3135 [ 231.827360] binder: send failed reply for transaction 138 to 11002:11006 [ 231.834985] binder: undelivered TRANSACTION_COMPLETE [ 231.847652] binder: undelivered TRANSACTION_ERROR: 29201 18:18:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0) stat(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000240)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast2}}, &(0x7f0000000140)=0xe8) sendmsg$nl_netfilter(r2, &(0x7f0000000380)={&(0x7f00000000c0), 0xc, &(0x7f0000000340)={&(0x7f0000000d80)=ANY=[@ANYBLOB="30060000000f000b2bbd7000fedbdf250f000001e40024004de4e203a4aa6bc4da2daea7156d2aa3dc7a691cd5fc977d45f1104e6cbce7f6466ec5036335977fafdd44fb5eb0d50347cf1918bb401c8029209ade5db3df9485dd425da0c45175293d21bb59c18bac29073b50e212e994d0ffd3f07501c6b50c0c887579d2ee5d9f47dea6b7bd78ef326c5078123ce52ee69ec2fff8fd20b5db49768bd52b7c023828da25d5a66cfa93bd9ef18650de8b83356b085c1bc16ebc9ca7ded933b990e6dcf30678724e4ebe3f8af71585f973cf35877fb0edaa18bc7415f1f6f26e82b414007a0000000000000000000000ffffffffffff0000001c1b61bccfbec6138cd0a1a5c2bb77e3a246fadb3200ef006e0470e3caf61c3d438187f0ebcb005c7630fc8c24d249b01f08212d67b82ec43bb3c70a8ebca8cd6e54e86b05614659f9413aa89a21d847e364fa979477064ad794f75ce97208c7c9798290deb7c5af7f064ff6a1139433dda535595b97a2120b9596244fb9e9fb94faac416e90804c7dbe016e8cc061f2d246cbea39f72f3f56b3cb5aa6da5603c7c49315d8eb7c1bfd3d598a30ef66cd4f4773e07f522e8a1a6a804ef61a99e7fa0c37af47a6e7f11cc0b793e4cc025e00f5bca8be95246fc812ee61869efafc462bf0599c768fb845ed297dfe9f6a51b61acde13e8b6aa00e92c1ff2509fb12e78bcaf84754356a903d9a1cfeb65681ccd602c8d2b15ab9dfba0b8323e0dbc66b78c8575d276df456037e1242bb5c94bf21d998310b45cd77ce7dae6dfc81ec1a555e7cebe784d0fe6c0c101e8cbf9150834a4879d6e9a2b48c7742b47586daff17670723936e4791a496c282909c24eb6fbb77a6407aa5b7b6005bff7c67901101244f1ee9fa9c2279567eb47ed1af5e8f2dc231a8bd33a38b4a4b09831e51627799965da80495d73d59d9b45189442b02260765b633b6675cc72012478fc2251cc79070d25210f958119aa6cdd34d4ee678af02f588793c7e32229084820e0ff194194416ea2fb37b696cd95cbd9fe4af2975fcbf202dff9158b66a086cd8366ce7d5cb75f5a5a5653fd2dca984ca8aa172ed585b8abb52fe5fa609bc58b9582c59d1e22066be80fdc1ca2d5cf57307f0282bff2f7186b513471be61a8bd15f9d6acd71fa2ecd5bedbf4a0802e68dcd2ad324aa197dbe4e7a08342591435509e992b4fa7bb397407cf73d5be88f13da67bcf0e4788e30ba95cc41bc2c0c9d2330d505b6587ec18e17a749d6e5fa6d29b16442f3dd5c22f1a08cc5b5145926c13937f395c79be733bd114be7cbe507774e2357849b2634fbed488466ea615b829f08c83e4bfe8116dafb4324bcd15d3621f11fcfcffac69d5b07c0a5941ad00800510011ffffff9a5b3f2a0ce6c82a4a3a9780df4fd104f067e56d1c2e7bb26712665df9231259f79652c4a2a2bfc58b8078fbbcf5cb79856ba7efd45e52299ffdd37902340fb507b856daf4127142de46cc11b01220b355ada81ab0da5ab05294bf46ba985334148072932327ea29897a2ce653c1174dba8edf71fd608c0d7290c1e62b6097da1eab4f3e9392eda9774c7937b00953c7d7868aa4db1bd29dd186a273d31f0a038fcea7e4667a3acfad1e0c6a1cb342000014002b00ff0100000000000000000000000000010c00450008004400", @ANYRES32=r3, @ANYBLOB="38006800e1207c1f1c8e414926797b1b2cb71f34c1dc015a6465d8697653e15c1b39eac16b3964160a550c0012000001000000000000000020014c0008005100", @ANYRES32=r4, @ANYBLOB="4d87945d3c0918753c5953793ce5db91cc55eb67804ff0d2915118d724c81a1a8d8c8c1a8fef7b505056f7f9ff199641d8ff9f21e5807b8375e4dc798b8d5d7d700648dc9fc92aba5df093f67f67292262077aa0c24584ba18a8a6be00edc3516eadf2115c0379859f0eccb570cec0df540b91b434b2914d5ecbb897bc7649695184f42d5b2ac02ae9e17d9eb9713062e21f94e87ffba1e39a58ec7e83cc47997c74c908d7c8cf06fdb7da7228dc18714f930bd2e162106c9d6b171a07e0e1cb785a8316394dfa2c7351aa11f3a80304cfc8e387876d8ef13059c1d403704b6eb76a8e00fe273a2db019757bedda8584e6e1e21f7f1f9e935b321453a7b18b3b5f4d7b1ad8cc256ad0d7841b340197593764aa0ec55f7fd7401bbbd93b44f82a181b1ccc065eb773991f0af471f936bd6b2eb763bc54f323000000b1fe1c545a5bc30cf9b476df291a5e5494d5b7c6995f74b76e120d77a61c550cc2365e2ad733ce136f0822f5f3d47d25d85c9cbad7d9a6adee8ccfe4760428da4fe4803acebb811115421578d71d7fa175b18291f6471a1a27623f465b53d13e588f9ba5a94e7279d1d6e475b7abc056b50d45a18f801cd6ba1f593ddfee10b6bb23fadce89413dee66cfb0fbe508ced44f257b62219104d5e71e022148f6d5119aba72f780a9a08bd7930ab65075e023b0d"], 0x630}, 0x1, 0x0, 0x0, 0x40084}, 0x80) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:44 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) [ 231.859856] binder: undelivered TRANSACTION_ERROR: 29189 18:18:44 executing program 0: sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x8000009) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000100)) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpgrp(0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) capget(&(0x7f00000001c0)={0x20080522, r1}, &(0x7f0000000200)={0x9, 0x81, 0xffffffff, 0x6, 0x3ff, 0x8001}) r2 = socket$inet6(0xa, 0x400000000001, 0x0) r3 = dup(r2) keyctl$session_to_parent(0x12) fsync(r0) ioctl$ASHMEM_SET_PROT_MASK(r3, 0x40087705, &(0x7f0000000280)={0x6}) ioctl$int_in(r2, 0x5452, &(0x7f0000000580)=0xe2e) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000340)={0x800000001, 0x0, 0x5, 0xffffffff80000000}) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000000c0)='syzkaller1\x00', 0x10) ptrace$setregset(0x4205, r1, 0x3, &(0x7f0000000380)={&(0x7f0000000680)="2a118ffa87db273dae83a284988593a5ffb540c83125972fc03a8d0ec5ec5ad60ac810819820c770ac79d139d6175978c639fe46dc9053e60f3e6a6bb63bc6a96d3bd67ba0daa78334d4e91683237746bfd5ec01663da8187cc39189f7ed1c69eaf07b491c25cb14607620d8361f1617c79ae4e57e8da998763caf7d0c4cb0438826b90061b360638b1af62445f65c7a30b3d6e5d20b36718427e9", 0x9b}) io_setup(0xfffffffffffffff9, &(0x7f0000000240)) io_setup(0x20, &(0x7f0000000300)=0x0) io_cancel(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x8, 0x423, r3, &(0x7f00000005c0)="f2f42245d196f91a48f2b821d3442e277a43f0ca0ad8ed1b65a81f934bc9a4fdca52f744ec264514eba836b2ca9b2e580d83a0ab4e20c5f62b71ca27af042df6ea32e6c5c9369755e64b56aec0188ec11bcea89595863c737ff8c0f248ad0d9201ff46962f0087fc1990817fdbaf8c2d3ca9a833872d38e2a9005b2e2903904e622869", 0x83, 0xf, 0x0, 0x0, r3}, 0x0) bind$inet6(r2, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) write$binfmt_aout(r2, &(0x7f0000000740)=ANY=[@ANYBLOB="07010509f7020000b80100000700000066000000090000000000000000000000ae4ce8b7539d67e1099ebadd122a2e359b6ee0ef2467226e8f39f1f265b9969c4dcfe4ac47529e15b8fcece96d76566c3bc3baac04d04019290f55dd753e4dedf44450e38d6fcb093fcb84b9f4ba2334886da23f8ac5f20468a8fffbf088fd089dc4e08ad1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004f0b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x785) 18:18:44 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) socket(0x10, 0x2, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 231.906141] binder: undelivered TRANSACTION_ERROR: 29189 [ 231.930406] binder_alloc: binder_alloc_mmap_handler: 11025 20001000-20004000 already mapped failed -16 [ 231.932991] binder: undelivered TRANSACTION_ERROR: 29189 18:18:44 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r1, r2) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r1, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') 18:18:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b9e037"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="11634840000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 231.991038] binder: BINDER_SET_CONTEXT_MGR already set [ 231.997034] binder: send failed reply for transaction 143 to 11025:11027 [ 232.004267] binder: 11025:11027 ioctl 40046207 0 returned -16 [ 232.015917] binder: undelivered TRANSACTION_COMPLETE [ 232.033775] binder: undelivered TRANSACTION_ERROR: 29189 18:18:44 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:44 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) [ 232.091624] binder: 11037:11039 got transaction to invalid handle [ 232.101212] binder: 11037:11039 transaction failed 29201/-22, size 0-0 line 3012 [ 232.112127] binder_alloc: binder_alloc_mmap_handler: 11037 20001000-20004000 already mapped failed -16 [ 232.133303] binder: BINDER_SET_CONTEXT_MGR already set [ 232.138658] binder: 11037:11039 ioctl 40046207 0 returned -16 [ 232.144919] binder_alloc: 11037: binder_alloc_buf, no vma [ 232.151280] binder: 11037:11043 transaction failed 29189/-3, size 0-0 line 3135 [ 232.158959] binder: 11037:11039 got transaction to invalid handle [ 232.165789] binder: send failed reply for transaction 145 to 11037:11039 [ 232.176779] binder: 11037:11039 transaction failed 29201/-22, size 0-0 line 3012 18:18:44 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r1, r2) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r1, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') 18:18:44 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r1, r2) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r1, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:44 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 232.189881] binder: undelivered TRANSACTION_COMPLETE [ 232.195722] binder: undelivered TRANSACTION_ERROR: 29201 [ 232.224023] binder: undelivered TRANSACTION_ERROR: 29189 [ 232.235816] binder: undelivered TRANSACTION_ERROR: 29201 [ 232.246371] binder: undelivered TRANSACTION_ERROR: 29189 [ 232.264632] binder: 11054:11056 got new transaction with bad transaction stack, transaction 150 has target 11054:0 [ 232.285309] binder: 11054:11056 transaction failed 29201/-71, size 0-0 line 3039 18:18:44 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r1, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 232.294402] binder_alloc: binder_alloc_mmap_handler: 11054 20001000-20004000 already mapped failed -16 [ 232.305637] binder: BINDER_SET_CONTEXT_MGR already set [ 232.311540] binder: 11054:11056 ioctl 40046207 0 returned -16 [ 232.317734] binder_alloc: 11054: binder_alloc_buf, no vma [ 232.323652] binder: 11054:11060 transaction failed 29189/-3, size 0-0 line 3135 [ 232.334159] binder_alloc: 11054: binder_alloc_buf, no vma [ 232.340061] binder: send failed reply for transaction 150 to 11054:11056 18:18:44 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 232.347227] binder: 11054:11056 transaction failed 29189/-3, size 0-0 line 3135 [ 232.355946] binder: undelivered TRANSACTION_COMPLETE [ 232.361340] binder: undelivered TRANSACTION_ERROR: 29201 [ 232.373195] binder: undelivered TRANSACTION_ERROR: 29189 [ 232.380650] binder: undelivered TRANSACTION_ERROR: 29189 [ 232.388390] binder: undelivered TRANSACTION_ERROR: 29189 18:18:44 executing program 0: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) 18:18:44 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r1, r2) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r1, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') 18:18:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:44 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:44 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r1, r2) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r1, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:44 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) socket(0x10, 0x2, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:45 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 232.471646] binder: 11071:11075 unknown command 0 [ 232.516296] binder: 11071:11075 ioctl c0306201 20000000 returned -22 [ 232.526552] binder_alloc: binder_alloc_mmap_handler: 11071 20001000-20004000 already mapped failed -16 [ 232.541978] binder: BINDER_SET_CONTEXT_MGR already set [ 232.547403] binder: 11071:11075 ioctl 40046207 0 returned -16 [ 232.553601] binder: 11071:11081 unknown command 0 18:18:45 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r1, r2) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r1, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') 18:18:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000190}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x12c, r3, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x34, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x18}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x20}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9f7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xcd}]}, @TIPC_NLA_LINK={0x90, 0x4, [@TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x212a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}]}, @TIPC_NLA_NET={0x54, 0x7, [@TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7fffffff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x200}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x800}, 0x10) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) write$binfmt_aout(r0, &(0x7f0000000680)={{0x10f, 0x80000001, 0x10001, 0x33f, 0x332, 0x0, 0x2c2, 0x20}, "b353313b4c0a40ebbfe1c8a37a9ede2b61b200783e64778052bd42e7f96c9a3a9d051a08ebb3aef34d652e41d1153ab47504e24891b53980495ff408475ba41b561be88f51dbcf86484094aae87f249c136d25e733cc5017cfdd2f53390ce9e5d5cf0f0e98941aa60b5c97de974519e9b2a5e6537dc2e5d6eb7f3f70d93f644b7afe52d0efb510612a491a81528923786a18e08b34ac893b72bb21a8f94f2e", [[], []]}, 0x2bf) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:45 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:45 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 232.562587] binder: 11071:11081 ioctl c0306201 20000000 returned -22 [ 232.570336] binder: send failed reply for transaction 155 to 11071:11081 [ 232.579393] binder: undelivered TRANSACTION_COMPLETE [ 232.592410] binder: undelivered TRANSACTION_ERROR: 29189 18:18:45 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:45 executing program 0: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) 18:18:45 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r1, r2) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r1, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:45 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r1, r2) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r1, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:45 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:45 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 232.699426] binder: BINDER_SET_CONTEXT_MGR already set [ 232.704969] binder: 11087:11095 ioctl 40046207 0 returned -16 [ 232.722496] binder: 11087:11095 got new transaction with bad transaction stack, transaction 157 has target 11087:0 [ 232.735233] binder: 11087:11095 transaction failed 29201/-71, size 0-0 line 3039 18:18:45 executing program 0: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) [ 232.745510] binder: BINDER_SET_CONTEXT_MGR already set [ 232.791745] binder_alloc: 11087: binder_alloc_buf, no vma [ 232.797404] binder: 11087:11104 transaction failed 29189/-3, size 0-0 line 3135 [ 232.802448] binder: BINDER_SET_CONTEXT_MGR already set [ 232.802459] binder: 11087:11116 ioctl 40046207 0 returned -16 [ 232.805021] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 232.812328] binder_alloc: 11087: binder_alloc_buf, no vma [ 232.812354] binder: 11087:11117 transaction failed 29189/-3, size 0-0 line 3135 18:18:45 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r1, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:45 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 232.813040] binder: send failed reply for transaction 157 to 11087:11095 [ 232.816414] binder: undelivered TRANSACTION_COMPLETE [ 232.816423] binder: undelivered TRANSACTION_ERROR: 29201 [ 232.816426] binder: undelivered TRANSACTION_ERROR: 29189 [ 232.864092] binder: 11087:11106 ioctl 40046207 0 returned -16 [ 232.886874] binder: undelivered TRANSACTION_ERROR: 29189 18:18:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=ANY=[], 0xfffffffffffffe57, 0x0, 0x0}) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f00000000c0)=0x4, 0x4) 18:18:45 executing program 0: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, r3) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r2, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) chdir(&(0x7f0000000340)='./file0\x00') ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) 18:18:45 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:45 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 232.897160] binder: undelivered TRANSACTION_ERROR: 29189 18:18:45 executing program 2: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:45 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) socket(0x10, 0x2, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 232.957776] binder: 11127:11131 unknown command 0 [ 232.965226] binder: 11127:11131 ioctl c0306201 20000040 returned -22 [ 232.984158] binder_alloc: binder_alloc_mmap_handler: 11127 20001000-20004000 already mapped failed -16 18:18:45 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r1, r2) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r1, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:45 executing program 0: mkdir(&(0x7f0000000100)='./file0\x00', 0xfffffffffffffffe) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0) openat(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x0, 0x1) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getegid() perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfff7fffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x400000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10003, 0x10, r1, 0x0) fcntl$getownex(r0, 0x10, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) rename(0x0, &(0x7f0000000400)='./file0\x00') syz_open_procfs(0x0, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r0, 0xc06855c8, &(0x7f0000000380)={0x10, 0x1ff, {0x55, 0x100000001, 0x5, {0x7}, {0x4, 0x1}, @rumble={0x3, 0x9}}, {0x56, 0x1000, 0x4, {0x4, 0x1}, {0x4, 0xd791}, @cond=[{0xc7f, 0x4, 0x4, 0xa0000000000, 0x39, 0x6}, {0x8, 0xca8, 0x6, 0x2, 0x9, 0x3ff}]}}) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) mkdirat(r0, &(0x7f0000000280)='./file0\x00', 0x0) r2 = open$dir(&(0x7f00004daff8)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000000)=ANY=[], &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000340)='-,wlan0cgroup') r3 = openat(r2, &(0x7f0000000300)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000080), &(0x7f0000000040)='./file0\x00', &(0x7f00009b9000)="05000900667300", 0x801008, &(0x7f0000000000)) symlinkat(&(0x7f000001fff7)='./file0\x00', r3, &(0x7f000001fff8)='./file0\x00') renameat2(r3, &(0x7f0000000180)='./file0/file0/file0/file0\x00', r2, &(0x7f00000000c0)='./file0/file0/file0/file0\x00', 0x0) [ 233.020534] binder: BINDER_SET_CONTEXT_MGR already set [ 233.026319] binder: 11127:11131 ioctl 40046207 0 returned -16 [ 233.031621] binder_alloc: 11127: binder_alloc_buf, no vma [ 233.031648] binder: 11127:11141 transaction failed 29189/-3, size 0-0 line 3135 [ 233.031734] binder: 11127:11134 unknown command 0 [ 233.031744] binder: 11127:11134 ioctl c0306201 20000040 returned -22 [ 233.032152] binder: undelivered TRANSACTION_ERROR: 29189 [ 233.032191] binder: send failed reply for transaction 162 to 11127:11131 18:18:45 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x1000002) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat(r0, &(0x7f00000000c0)='./file0\x00', 0x210040, 0x10) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000140)=@req={0x10001, 0x3365, 0x2, 0x40}, 0x10) write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000025c300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000001c0)=@req={0x6, 0x9, 0x3, 0xfffffffffffff801}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0xfffffffffffffe42, 0x0, &(0x7f0000000100)=[@release={0x40046306, 0x4}], 0xfe66, 0x0, 0x0}) 18:18:45 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 233.032306] binder: undelivered TRANSACTION_COMPLETE [ 233.032315] binder: undelivered TRANSACTION_ERROR: 29189 18:18:45 executing program 2: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 233.138868] binder: 11146:11152 ioctl c0306201 20000040 returned -14 [ 233.163874] binder_alloc: binder_alloc_mmap_handler: 11146 20001000-20004000 already mapped failed -16 [ 233.175098] binder: BINDER_SET_CONTEXT_MGR already set [ 233.181278] binder: 11146:11152 ioctl 40046207 0 returned -16 18:18:45 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:45 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 233.189639] binder_alloc: 11146: binder_alloc_buf, no vma [ 233.195859] binder: send failed reply for transaction 165 to 11146:11152 [ 233.215610] binder: undelivered TRANSACTION_COMPLETE [ 233.223128] binder: 11146:11158 transaction failed 29189/-3, size 0-0 line 3135 [ 233.233172] binder: undelivered TRANSACTION_ERROR: 29189 18:18:45 executing program 2: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x100) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f00000001c0)={0x0, @loopback, @remote}, &(0x7f0000000200)=0xc) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000240)={@remote, @dev={0xfe, 0x80, [], 0x19}, @loopback, 0x80, 0xfffffffffffffffb, 0x56e, 0x100, 0xfffffffffffffffa, 0x20, r3}) readlinkat(r2, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=""/69, 0x45) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 233.249368] binder: undelivered TRANSACTION_ERROR: 29189 18:18:45 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32=r1, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:45 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:45 executing program 2: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 233.319938] binder: 11170:11172 ioctl 890b 20000240 returned -22 [ 233.341920] binder: 11170:11172 got new transaction with bad transaction stack, transaction 168 has target 11170:0 [ 233.365969] binder: 11170:11172 transaction failed 29201/-71, size 0-0 line 3039 [ 233.377160] binder_alloc: binder_alloc_mmap_handler: 11170 20001000-20004000 already mapped failed -16 [ 233.396120] binder: BINDER_SET_CONTEXT_MGR already set [ 233.401914] binder: 11170:11172 ioctl 40046207 0 returned -16 [ 233.429403] binder: 11170:11185 ioctl 890b 20000240 returned -22 [ 233.437658] binder_alloc: 11170: binder_alloc_buf, no vma [ 233.444035] binder: 11170:11181 transaction failed 29189/-3, size 0-0 line 3135 [ 233.452835] binder_alloc: 11170: binder_alloc_buf, no vma [ 233.459045] binder: send failed reply for transaction 168 to 11170:11172 [ 233.466437] binder: 11170:11172 transaction failed 29189/-3, size 0-0 line 3135 [ 233.474074] binder: undelivered TRANSACTION_COMPLETE 18:18:46 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/cache_stats\x00', 0x0, 0x0) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r1) ioprio_set$uid(0x3, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket(0x3, 0x6, 0x9) perf_event_open(&(0x7f00000002c0)={0x5, 0x70, 0x22d, 0x1bd, 0x0, 0x0, 0x0, 0x0, 0x8440, 0x0, 0xfffffffffffff801, 0x0, 0x3, 0x0, 0x2, 0x1, 0x0, 0x1, 0x8001, 0x2, 0x0, 0x7, 0x1, 0x101, 0x5, 0x0, 0x8, 0x0, 0x6, 0x6, 0x0, 0x9, 0x0, 0x582, 0x0, 0x7, 0x0, 0x9c, 0x0, 0x0, 0x5, @perf_config_ext={0x4e, 0x1cf4}, 0x0, 0x7fffffff, 0x0, 0x4, 0xffffffff, 0x3}, 0xffffffffffffffff, 0xe, r0, 0x2) ioctl$sock_inet6_udp_SIOCINQ(r2, 0x541b, 0x0) r3 = syz_open_procfs(0x0, 0x0) getdents(r0, 0x0, 0x0) r4 = perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ffffd, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(r4, 0x0, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) fstatfs(r5, 0x0) getpid() write$9p(r3, 0x0, 0x0) unshare(0x40000000) 18:18:46 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) socket(0x10, 0x2, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000100)={0x400000004, 0x5, 0x7ff}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004b6ccdcccb9edb588da257441dc911f77e4f2dfe94f95f62943b743e77e4ca"], 0x0, 0x0, 0x0}) [ 233.479186] binder: undelivered TRANSACTION_ERROR: 29201 [ 233.488599] binder: undelivered TRANSACTION_ERROR: 29189 [ 233.494144] binder: undelivered TRANSACTION_ERROR: 29189 [ 233.499596] binder: undelivered TRANSACTION_ERROR: 29189 18:18:46 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 233.546999] binder: 11193:11198 ioctl c0185879 20000100 returned -22 [ 233.554004] binder: 11193:11198 got new transaction with bad transaction stack, transaction 173 has target 11193:0 [ 233.566186] binder: 11193:11198 transaction failed 29201/-71, size 0-0 line 3039 [ 233.587297] binder_alloc: binder_alloc_mmap_handler: 11193 20001000-20004000 already mapped failed -16 18:18:46 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 233.604087] binder: BINDER_SET_CONTEXT_MGR already set [ 233.612674] binder: 11193:11198 ioctl 40046207 0 returned -16 [ 233.619787] binder_alloc: 11193: binder_alloc_buf, no vma [ 233.631655] binder: 11193:11202 transaction failed 29189/-3, size 0-0 line 3135 18:18:46 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 233.657969] binder: 11193:11198 ioctl c0185879 20000100 returned -22 [ 233.658001] binder_alloc: 11193: binder_alloc_buf, no vma [ 233.658032] binder: 11193:11209 transaction failed 29189/-3, size 0-0 line 3135 [ 233.658444] binder: send failed reply for transaction 173 to 11193:11198 [ 233.664503] binder: undelivered TRANSACTION_COMPLETE [ 233.664513] binder: undelivered TRANSACTION_ERROR: 29201 [ 233.664517] binder: undelivered TRANSACTION_ERROR: 29189 [ 233.774836] binder: undelivered TRANSACTION_ERROR: 29189 [ 233.780555] binder: undelivered TRANSACTION_ERROR: 29189 18:18:46 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f00000001c0)=0x1000000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x100, 0x0) getpeername(r2, &(0x7f00000000c0)=@alg, &(0x7f0000000140)=0x80) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:46 executing program 0: socketpair$unix(0x1, 0x4000000000007, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000005c0)=0x0) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, &(0x7f00000003c0)=r1) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000400)={0x0, 0xbe}, 0x8) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000280)) perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x72, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x438, &(0x7f00000000c0)=0x9) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FITRIM(r2, 0xc0185879, &(0x7f0000000240)={0xffffffffffffe31b, 0xffff, 0x6}) r5 = getpgrp(0x0) capget(&(0x7f00000001c0)={0x20080522, r5}, &(0x7f0000000200)={0x9, 0x81, 0xffffffff, 0x6, 0x3ff, 0x8001}) ioctl$sock_SIOCOUTQ(r3, 0x5411, &(0x7f0000000300)) r6 = socket$inet6(0xa, 0x400000000001, 0x0) r7 = dup(r6) fsync(r4) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000740), &(0x7f0000000340)=0xc) setfsgid(0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r6, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) eventfd(0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) 18:18:46 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 234.266529] binder: 11230:11234 ioctl 1 200001c0 returned -22 [ 234.297507] binder: 11230:11234 got new transaction with bad transaction stack, transaction 178 has target 11230:0 18:18:46 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 234.341977] binder: 11230:11234 transaction failed 29201/-71, size 0-0 line 3039 [ 234.374755] binder_alloc: binder_alloc_mmap_handler: 11230 20001000-20004000 already mapped failed -16 18:18:46 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:46 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 234.391803] binder: BINDER_SET_CONTEXT_MGR already set [ 234.397341] binder: 11230:11251 ioctl 1 200001c0 returned -22 [ 234.403637] binder: 11230:11234 ioctl 40046207 0 returned -16 [ 234.420134] binder_alloc: 11230: binder_alloc_buf, no vma 18:18:46 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(0x0, &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) [ 234.448192] binder_alloc: 11230: binder_alloc_buf, no vma [ 234.454999] binder: 11230:11251 transaction failed 29189/-3, size 0-0 line 3135 [ 234.466030] binder: 11230:11258 transaction failed 29189/-3, size 0-0 line 3135 [ 234.472474] binder: send failed reply for transaction 178 to 11230:11234 [ 234.473514] binder: undelivered TRANSACTION_COMPLETE [ 234.473524] binder: undelivered TRANSACTION_ERROR: 29201 [ 234.473527] binder: undelivered TRANSACTION_ERROR: 29189 18:18:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000000c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000240)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000280)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0xdc, 0x0, &(0x7f0000000380)=[@reply_sg={0x40486312, {{0x4, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x40, 0x10, &(0x7f0000000100)=[@ptr={0x70742a85, 0x1, &(0x7f0000000080), 0x1, 0x0, 0x3f}, @flat={0x73682a85, 0x100, r2, 0x3}], &(0x7f0000000140)=[0x28, 0x48]}, 0x7}}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x38, &(0x7f00000001c0), &(0x7f0000000200)=[0x28, 0x68, 0x38, 0x38, 0x20, 0x28, 0x60]}}, @enter_looper, @enter_looper, @acquire_done={0x40106309, r3, 0x3}, @increfs={0x40046304, 0x4}, @dead_binder_done={0x40086310, 0x3}, @request_death={0x400c630e, 0x2, 0x4}, @free_buffer={0x40086303, r4}], 0xd3, 0x0, &(0x7f0000000480)="265eee05f062ee010d5378fbf85bd9181777d429b66f0235ea4570dda0325c3181462b506e4778ffbd2523fee4536a35e4baa0f565520efa32114343a57b9f55b7512e7dbeccbf32fd18cbea55b2dd00d29bfccaa9a2bdac0ac94bec60f77bfee5bbc5a35a5f450b5885d248b40ca61fc0a94a696145e064b283dcc4da98c15fb91207485b162cb95c52a3b0ffa9ca1560e63f012e029c4675f53d8eaa8e2e1e591642eb7c95a06c194a3187496051f9ee4d57fc01d13419d4c9f92fd2736b67094e887b35d27a4e34db4a4ff521399c0e5ddc"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000000000000e9ffffffffffffff0000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 234.509430] binder: undelivered TRANSACTION_ERROR: 29189 [ 234.518424] binder: undelivered TRANSACTION_ERROR: 29189 18:18:47 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x1, 0xfffffdfd, &(0x7f0000000480)="f2"}) 18:18:47 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 3: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(0x0, &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) [ 234.571480] binder: 11271:11273 got reply transaction with no transaction stack [ 234.591425] binder: 11271:11273 transaction failed 29201/-71, size 64-16 line 2920 18:18:47 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 0: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r0, 0x20000000008912, &(0x7f0000000080)="0a5c2d0240316285717070") socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000000)={&(0x7f0000000200)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 18:18:47 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(0x0, &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) [ 234.618802] binder_alloc: 11271: binder_alloc_buf size -369098752 failed, no address space [ 234.649934] binder_alloc: allocated: 8 (num: 1 largest: 8), free: 12280 (num: 1 largest: 12280) 18:18:47 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 3: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 234.672563] binder: 11271:11273 transaction failed 29201/-28, size -385875968-16777215 line 3135 [ 234.703674] binder_alloc: binder_alloc_mmap_handler: 11271 20001000-20004000 already mapped failed -16 18:18:47 executing program 0: r0 = socket$packet(0x11, 0x20000000000003, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={"6c6f000000000200"}) sendto$packet(r0, &(0x7f00000000c0)="75c804983bd70e04d52df080ab8d7f", 0xf, 0x0, 0x0, 0x0) [ 234.722370] binder: BINDER_SET_CONTEXT_MGR already set [ 234.728237] binder: 11271:11273 ioctl 40046207 0 returned -16 [ 234.737731] binder: 11271:11282 got reply transaction with no transaction stack [ 234.755023] binder_alloc: 11271: binder_alloc_buf, no vma [ 234.775930] binder: 11271:11282 transaction failed 29201/-71, size 64-16 line 2920 [ 234.785362] binder: send failed reply for transaction 184 to 11271:11282 [ 234.795316] binder: 11271:11297 transaction failed 29189/-3, size 0-0 line 3135 [ 234.805559] binder: undelivered TRANSACTION_ERROR: 29201 [ 234.813333] binder: undelivered TRANSACTION_COMPLETE 18:18:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) clock_settime(0x4, &(0x7f00000000c0)={r2, r3+10000000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:47 executing program 3: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) 18:18:47 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 234.827036] binder: undelivered TRANSACTION_ERROR: 29189 [ 234.836559] binder: undelivered TRANSACTION_ERROR: 29189 18:18:47 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ptype\x00') sendfile(r0, r0, 0x0, 0x5) 18:18:47 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) [ 234.867191] binder: 11310:11314 got new transaction with bad transaction stack, transaction 189 has target 11310:0 18:18:47 executing program 4: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 234.900858] binder: 11310:11314 transaction failed 29201/-71, size 0-0 line 3039 18:18:47 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdir(&(0x7f00000013c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r2, 0x0) readv(r2, &(0x7f00000007c0)=[{&(0x7f0000002300)=""/4096, 0x1000}], 0x3b6) 18:18:47 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 234.945736] binder_alloc: binder_alloc_mmap_handler: 11310 20001000-20004000 already mapped failed -16 [ 234.962687] binder: BINDER_SET_CONTEXT_MGR already set [ 234.975371] binder: 11310:11314 ioctl 40046207 0 returned -16 [ 234.983436] binder_alloc: 11310: binder_alloc_buf, no vma [ 234.993508] binder: 11310:11325 transaction failed 29189/-3, size 0-0 line 3135 18:18:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x3fffffffd) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = fcntl$dupfd(r0, 0x406, r0) write$P9_RLINK(r2, &(0x7f0000000080)={0x7, 0x47, 0x1}, 0x7) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000000000000005281318b2afa8732cb1914cd8a451e00000000000000000000003500fff60000000000000034fb89c4391ca83221df00000000000000000000000000007ff4658332c8d8f00ef505c6d6ca3a71bd2fb9a0e8ab059d4f9ff6e179e36d972f49a705191453d4164b2a"], 0x0, 0x0, 0x0}) 18:18:47 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) 18:18:47 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 4: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 235.020442] binder: send failed reply for transaction 189 to 11310:11314 [ 235.027369] binder: undelivered TRANSACTION_COMPLETE [ 235.059911] binder: undelivered TRANSACTION_ERROR: 29201 18:18:47 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', 0x0, 0x0, 0x1) 18:18:47 executing program 0: dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) clone(0x82004000, &(0x7f0000000080), 0x0, 0x0, 0xffffffffffffffff) [ 235.081493] binder: undelivered TRANSACTION_ERROR: 29189 [ 235.086998] binder: undelivered TRANSACTION_ERROR: 29189 [ 235.096809] binder_alloc: binder_alloc_mmap_handler: 11341 20001000-20004000 already mapped failed -16 18:18:47 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x110, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000002c0)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001c80)={0x148, 0x0, &(0x7f0000001a00)=[@free_buffer={0x40086303, r1}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x8, &(0x7f0000001700)=[@flat={0x77682a85, 0x101, r2, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f00000005c0), 0x1, 0x0, 0x2b}, @fd={0x66642a85, 0x0, r0, 0x0, 0x3}], &(0x7f0000001780)=[0x38]}}, @transaction={0x40406300, {0x1, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x28, &(0x7f00000017c0), &(0x7f0000001800)=[0x38, 0x0, 0x28, 0x78, 0x20]}}, @transaction_sg={0x40486311, {{0x3, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x50, 0x38, &(0x7f00000018c0)=[@ptr={0x70742a85, 0x1, &(0x7f0000001840), 0x1, 0x1, 0x3b}, @ptr={0x70742a85, 0x0, &(0x7f0000001880), 0x1, 0x4, 0x3c}], &(0x7f0000001940)=[0x78, 0x48, 0x18, 0x30, 0x48, 0x70, 0x28]}}}, @dead_binder_done={0x40086310, 0x4}, @reply_sg={0x40486312, {{0x1, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x0, 0x30, &(0x7f0000001980), &(0x7f00000019c0)=[0x40, 0x20, 0x78, 0x70, 0x0, 0x38]}, 0xffffffff}}, @register_looper, @register_looper, @decrefs={0x40046307, 0x3}], 0xfa, 0x0, &(0x7f0000001b80)="03ba6eb97e430ab65d59a4ff4b819cd650cc06145c5086c155bc5c725da5273de3b0097bd990b06566e299582e84030dd69dd668a8526facb5d73f33babb1207f978ff02f55b19c74e24d197bb60c04d6bc5c73fd15f6ee06188bad0bd0d7193ee8ec3c976c059c8543053b569e9ffbbefbfd979ee4fcb764261a92a76ef0b4475b9353d62a18eb3923ed309acb1c4ce176c1f4fca09c1653e6da36269f224d9f57e603cf68a19da8b5ec8a95068cba0836115e462815f9c1de425e494ebcfd8fe4682a32ed58cbf9635b8cae15375e327bbacde0e4e30d17f5a93428fc450e4994ca9e3966087274b3f2a5c22a323844924bd02b3acbc699767"}) r3 = accept4$inet(0xffffffffffffffff, &(0x7f0000000600)={0x2, 0x0, @multicast2}, &(0x7f0000000640)=0x10, 0x80800) accept4$inet(r3, &(0x7f00000017c0), &(0x7f0000001980)=0x10, 0x80000) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x802) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x6e, 0x0, &(0x7f0000001cc0)=ANY=[@ANYBLOB="116348400000000100da2746dc31b5c72b060baf75f700080000000000000000000044930600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e3f2a9e3f50fa64998a91507dd81a6be6e66153e78"], 0x0, 0x0, 0x0}) readv(r4, &(0x7f0000001680)=[{&(0x7f0000000080)=""/201, 0xc9}, {&(0x7f00000001c0)=""/135, 0x87}, {&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000000280)=""/11, 0xb}, {&(0x7f0000000380)=""/186, 0xba}, {&(0x7f0000000440)=""/79, 0x4f}, {&(0x7f00000004c0)=""/246, 0xf6}], 0x7) [ 235.136869] binder: BINDER_SET_CONTEXT_MGR already set [ 235.142670] binder: 11341:11346 ioctl 40046207 0 returned -16 18:18:47 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 4: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000280)='bdev]vmnet1\x00', 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x1767, 0x0, 0x0, 0x200000}) 18:18:47 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', 0x0, 0x0, 0x1) [ 235.219488] binder: 11362:11366 BC_FREE_BUFFER u0000000000000000 no match [ 235.252193] binder: 11362:11366 got reply transaction with no transaction stack [ 235.259668] binder: 11362:11366 transaction failed 29201/-71, size 88-8 line 2920 18:18:47 executing program 4: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 235.273513] binder: 11362:11374 transaction failed 29189/-22, size 0-0 line 3012 18:18:47 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 235.320803] binder: 11362:11366 got transaction to invalid handle [ 235.327058] binder: 11362:11366 transaction failed 29201/-22, size 6-0 line 3012 [ 235.355232] binder: 11362:11374 BC_FREE_BUFFER u0000000000000000 no match 18:18:47 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', 0x0, 0x0, 0x1) 18:18:47 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 235.367800] binder: 11362:11374 got reply transaction with no transaction stack [ 235.376768] binder: 11362:11366 transaction failed 29189/-22, size 0-0 line 3012 [ 235.384849] binder: 11362:11387 got transaction to invalid handle [ 235.407398] binder: 11362:11374 transaction failed 29201/-71, size 88-8 line 2920 [ 235.418511] binder: 11362:11387 transaction failed 29201/-22, size 6-0 line 3012 [ 235.426427] binder: undelivered TRANSACTION_ERROR: 29201 [ 235.432170] binder: undelivered TRANSACTION_ERROR: 29189 [ 235.453419] binder: undelivered TRANSACTION_ERROR: 29189 18:18:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f00000001c0)={'syz1', "756e0e2cd278ecefd4fc630568cd75667208fe3c47ca66ad57797d8597bb0bbc812b6a2e7e45dd4d1a7d6226fd9b2b4351c218de898074e020bd85218cc2149f4b930ef4795a16b5dc9ca9a5e5c7a0a4f163cde130b12e833a3a31553723fbc3bd465c9245ce1bb6052ca9787251b5bee2f13e83cbb1567a5a58cf3713f2190fa2213f001240f27fa16aa643739b0f4e0be9c7e6f3a2ae31da7f60f28b94eea90f7012314fe0618bfabb46b8438e0ad10dde76e617f4b0dc79ed80e70c6bc79b45095132d0f84fdf17"}, 0xcd) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) truncate(&(0x7f0000000080)='./file0\x00', 0xfd2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:47 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:47 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:48 executing program 0: 18:18:48 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32], 0x2, 0x1) 18:18:48 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(0x0, &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) [ 235.472653] binder: undelivered TRANSACTION_ERROR: 29201 [ 235.510695] binder: 11401:11404 got transaction to context manager from process owning it 18:18:48 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 235.528862] binder: 11401:11404 transaction failed 29201/-22, size 0-0 line 3003 [ 235.549279] binder: BINDER_SET_CONTEXT_MGR already set [ 235.569212] binder_alloc: 11401: binder_alloc_buf, no vma 18:18:48 executing program 0: 18:18:48 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32], 0x2, 0x1) [ 235.574914] binder: 11401:11404 ioctl 40046207 0 returned -16 [ 235.585752] binder: 11401:11409 transaction failed 29189/-3, size 0-0 line 3135 [ 235.595537] binder: undelivered TRANSACTION_ERROR: 29201 18:18:48 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) prctl$PR_SET_THP_DISABLE(0x29, 0x1) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:48 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(0x0, &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) 18:18:48 executing program 0: 18:18:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:48 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 235.627181] binder: undelivered TRANSACTION_ERROR: 29189 18:18:48 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32], 0x2, 0x1) 18:18:48 executing program 0: 18:18:48 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:48 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(0x0, &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) 18:18:48 executing program 0: [ 235.708168] binder: 11426:11431 got new transaction with bad transaction stack, transaction 203 has target 11426:0 18:18:48 executing program 0: 18:18:48 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB], 0x3, 0x1) [ 235.757829] binder: 11426:11431 transaction failed 29201/-71, size 0-0 line 3039 18:18:48 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:48 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:48 executing program 0: [ 235.806332] binder: send failed reply for transaction 203 to 11426:11431 [ 235.819470] binder_alloc: 11426: binder_alloc_buf, no vma [ 235.827812] binder: 11426:11445 transaction failed 29189/-3, size 0-0 line 3135 [ 235.836221] binder: undelivered TRANSACTION_ERROR: 29189 18:18:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0xfffffff7fffffffc, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:48 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) 18:18:48 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB], 0x3, 0x1) 18:18:48 executing program 0: 18:18:48 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(0x0, &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) 18:18:48 executing program 0: [ 235.870533] binder: undelivered TRANSACTION_COMPLETE [ 235.875716] binder: undelivered TRANSACTION_ERROR: 29201 [ 235.906175] binder: undelivered TRANSACTION_ERROR: 29189 18:18:48 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) 18:18:48 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB], 0x3, 0x1) 18:18:48 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(0x0, &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) [ 235.935792] binder: 11457:11460 got new transaction with bad transaction stack, transaction 208 has target 11457:0 [ 235.959407] binder: 11457:11460 transaction failed 29201/-71, size 0-0 line 3039 18:18:48 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:48 executing program 0: 18:18:48 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) [ 236.005953] binder_alloc: binder_alloc_mmap_handler: 11457 20001000-20004000 already mapped failed -16 [ 236.035138] binder: BINDER_SET_CONTEXT_MGR already set [ 236.051110] binder: 11457:11460 ioctl 40046207 0 returned -16 [ 236.060417] binder_alloc: 11457: binder_alloc_buf, no vma [ 236.086579] binder: send failed reply for transaction 208 to 11457:11460 [ 236.094042] binder: 11457:11474 transaction failed 29189/-3, size 0-0 line 3135 18:18:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0xffffffffffffffff) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:48 executing program 0: r0 = memfd_create(&(0x7f0000001fc1)='#vmnet1nodevem1\x00', 0x0) write(r0, &(0x7f0000002000)='/', 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xfec) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0) umount2(&(0x7f0000000080)='./file0\x00', 0x0) 18:18:48 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', 0x0, 0x0, 0x1) 18:18:48 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(0x0, &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) 18:18:48 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 236.094055] binder_alloc: 11457: binder_alloc_buf, no vma [ 236.094081] binder: 11457:11460 transaction failed 29189/-3, size 0-0 line 3135 [ 236.119176] binder: undelivered TRANSACTION_COMPLETE [ 236.132292] binder: undelivered TRANSACTION_ERROR: 29201 [ 236.147331] binder: undelivered TRANSACTION_ERROR: 29189 18:18:48 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200"], 0x3, 0x1) 18:18:48 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', 0x0, 0x0, 0x1) [ 236.175191] binder: undelivered TRANSACTION_ERROR: 29189 [ 236.189180] binder: 11489:11493 transaction failed 29189/-22, size 0-0 line 3012 [ 236.203486] binder: undelivered TRANSACTION_ERROR: 29189 18:18:48 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) 18:18:48 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:48 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200"], 0x3, 0x1) [ 236.227748] binder: 11489:11500 transaction failed 29189/-22, size 0-0 line 3012 [ 236.243039] binder: 11489:11493 transaction failed 29189/-22, size 0-0 line 3012 [ 236.256457] binder: undelivered TRANSACTION_ERROR: 29189 [ 236.268783] binder: undelivered TRANSACTION_ERROR: 29189 18:18:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:48 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', 0x0, 0x0, 0x1) [ 236.308929] binder: undelivered TRANSACTION_ERROR: 29189 18:18:48 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) [ 236.370861] binder: 11513:11516 got new transaction with bad transaction stack, transaction 216 has target 11513:0 [ 236.392051] binder: 11513:11516 transaction failed 29201/-71, size 0-0 line 3039 [ 236.434093] binder_alloc: binder_alloc_mmap_handler: 11513 20001000-20004000 already mapped failed -16 [ 236.461727] binder: BINDER_SET_CONTEXT_MGR already set [ 236.467145] binder: 11513:11516 ioctl 40046207 0 returned -16 [ 236.469555] binder_alloc: 11513: binder_alloc_buf, no vma [ 236.469579] binder: 11513:11522 transaction failed 29189/-3, size 0-0 line 3135 [ 236.469901] binder: undelivered TRANSACTION_ERROR: 29189 [ 236.469942] binder: send failed reply for transaction 216 to 11513:11516 [ 236.473062] binder: undelivered TRANSACTION_COMPLETE [ 236.473071] binder: undelivered TRANSACTION_ERROR: 29201 [ 236.473075] binder: undelivered TRANSACTION_ERROR: 29189 18:18:49 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount(0x0, &(0x7f000000aff8)='./file0\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000040)='./bus\x00', 0x3) fchdir(r0) r2 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00'], 0x5) utime(&(0x7f0000000100)='./bus\x00', &(0x7f0000001a80)={0x1000000000}) sendfile(r2, r2, &(0x7f0000000000), 0x8080fffffffe) 18:18:49 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200"], 0x3, 0x1) 18:18:49 executing program 1: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:49 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) 18:18:49 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32], 0x2, 0x1) 18:18:49 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x40000, 0x0) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f00000000c0), &(0x7f0000000100)=0xc) r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063229a09d477e4dd3e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:49 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', 0x0, 0x0, 0x1) 18:18:49 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32], 0x2, 0x1) 18:18:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0x0, 0x7fd) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x0, 0x0) renameat(r2, &(0x7f0000000280)='./file0\x00', r2, &(0x7f00000002c0)='./file0\x00') setsockopt$inet_MCAST_LEAVE_GROUP(r2, 0x0, 0x2d, &(0x7f00000001c0)={0x7f, {{0x2, 0x4e24, @multicast1}}}, 0x88) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) getpeername$inet(r2, &(0x7f0000000100)={0x2, 0x0, @multicast2}, &(0x7f0000000140)=0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/context\x00', 0x2, 0x0) 18:18:49 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000"], 0x3, 0x1) [ 236.607864] binder: 11532:11536 unknown command -1709022464 [ 236.618276] FAT-fs (loop0): codepage cp437 not found [ 236.621550] binder: 11532:11536 ioctl c0306201 20000000 returned -22 [ 236.623755] binder_alloc: binder_alloc_mmap_handler: 11532 20001000-20004000 already mapped failed -16 [ 236.623838] binder: BINDER_SET_CONTEXT_MGR already set [ 236.623846] binder: 11532:11536 ioctl 40046207 0 returned -16 [ 236.623883] binder: 11532:11543 unknown command -1709022464 18:18:49 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f00000002c0)=0x0) ptrace$pokeuser(0x6, r3, 0x3, 0x3) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000100)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) r4 = geteuid() fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r1, r4, r5) [ 236.623902] binder: 11532:11543 ioctl c0306201 20000000 returned -22 [ 236.624262] binder: send failed reply for transaction 220 to 11532:11536 [ 236.630300] binder: undelivered TRANSACTION_COMPLETE [ 236.630309] binder: undelivered TRANSACTION_ERROR: 29189 [ 236.685120] binder_alloc: binder_alloc_mmap_handler: 11544 20001000-20004000 already mapped failed -16 [ 236.695184] binder: BINDER_SET_CONTEXT_MGR already set [ 236.701734] binder: 11544:11549 ioctl 40046207 0 returned -16 18:18:49 executing program 0: r0 = socket$inet6(0xa, 0x803, 0x100000003) ioctl(r0, 0x1000008912, &(0x7f0000000180)="0a5c2d023c126285718070") syz_mount_image$msdos(&(0x7f0000000340)='msdos\x00', &(0x7f0000000480)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 18:18:49 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', 0x0, 0x0, 0x1) 18:18:49 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000"], 0x3, 0x1) 18:18:49 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32], 0x2, 0x1) [ 236.747729] binder: 11555:11558 got new transaction with bad transaction stack, transaction 223 has target 11555:0 [ 236.780964] binder: 11555:11558 transaction failed 29201/-71, size 0-0 line 3039 [ 236.804521] binder: BINDER_SET_CONTEXT_MGR already set [ 236.809821] binder: 11555:11562 ioctl 40046207 0 returned -16 [ 236.825209] binder_alloc: 11555: binder_alloc_buf, no vma [ 236.831032] binder: 11555:11558 transaction failed 29189/-3, size 0-0 line 3135 [ 236.838565] binder_alloc: 11555: binder_alloc_buf, no vma 18:18:49 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', 0x0, 0x0, 0x1) 18:18:49 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000"], 0x3, 0x1) [ 236.856678] binder: 11555:11562 transaction failed 29189/-3, size 0-0 line 3135 [ 236.867916] FAT-fs (loop0): bogus number of reserved sectors [ 236.874497] binder: send failed reply for transaction 223 to 11555:11558 [ 236.882438] binder: undelivered TRANSACTION_COMPLETE [ 236.887682] binder: undelivered TRANSACTION_ERROR: 29201 [ 236.895568] FAT-fs (loop0): Can't find a valid FAT filesystem 18:18:49 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB], 0x3, 0x1) 18:18:49 executing program 5: openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x200000, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000008a5a777315584e00000000000000000000000000000000000000000000000000001000000000000000000000000000"], 0x0, 0x0, 0x0}) 18:18:49 executing program 1: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 236.908989] binder: undelivered TRANSACTION_ERROR: 29189 [ 236.915673] binder: undelivered TRANSACTION_ERROR: 29189 [ 236.929434] binder: undelivered TRANSACTION_ERROR: 29189 18:18:49 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000"], 0x3, 0x1) 18:18:49 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB], 0x3, 0x1) [ 236.971918] FAT-fs (loop0): bogus number of reserved sectors [ 236.979617] FAT-fs (loop0): Can't find a valid FAT filesystem [ 237.005530] binder: 11584:11591 got new transaction with bad transaction stack, transaction 228 has target 11584:0 18:18:49 executing program 1: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:49 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000180)={0x4}) epoll_wait(r1, &(0x7f0000000000)=[{}], 0x1, 0x0) 18:18:49 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32], 0x2, 0x1) 18:18:49 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000"], 0x3, 0x1) [ 237.024254] binder: 11584:11591 transaction failed 29201/-71, size 0-0 line 3039 [ 237.038283] binder_alloc: binder_alloc_mmap_handler: 11584 20001000-20004000 already mapped failed -16 [ 237.047864] binder: BINDER_SET_CONTEXT_MGR already set [ 237.053852] binder: 11584:11591 ioctl 40046207 0 returned -16 [ 237.065469] binder_alloc: 11584: binder_alloc_buf, no vma 18:18:49 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000"], 0x3, 0x1) 18:18:49 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB], 0x3, 0x1) 18:18:49 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x3b, &(0x7f0000000080)=@dstopts, 0x8) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_int(r1, 0x29, 0x4, &(0x7f0000000100)=0x6, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) recvmmsg(r1, &(0x7f0000008880), 0x178, 0x0, 0x0) 18:18:49 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32], 0x2, 0x1) [ 237.080209] binder: 11584:11599 transaction failed 29189/-3, size 0-0 line 3135 [ 237.093110] binder_alloc: 11584: binder_alloc_buf, no vma [ 237.093410] binder: send failed reply for transaction 228 to 11584:11591 [ 237.093426] binder: undelivered TRANSACTION_COMPLETE [ 237.093434] binder: undelivered TRANSACTION_ERROR: 29201 [ 237.093438] binder: undelivered TRANSACTION_ERROR: 29189 18:18:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1163484000000000000008000000000000000000000000000000000000000000000000000000000000000000001d8802f9a313f1000000000000000000000000000000d532463b9c59d952589878626dabcebff0be2026e8e7228d419d5d30"], 0x0, 0x0, 0x0}) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000080)='trusted.overlay.nlink\x00', &(0x7f00000000c0)={'L-', 0x8}, 0x28, 0x1) 18:18:49 executing program 1: mkdir(0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:49 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x3, 0x1) [ 237.159229] binder: 11584:11591 transaction failed 29189/-3, size 0-0 line 3135 [ 237.168169] binder: undelivered TRANSACTION_ERROR: 29189 [ 237.177308] binder: undelivered TRANSACTION_ERROR: 29189 18:18:49 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32], 0x2, 0x1) 18:18:49 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200"], 0x3, 0x1) 18:18:49 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 237.241247] binder: 11626:11629 got new transaction with bad transaction stack, transaction 233 has target 11626:0 [ 237.259991] binder: 11626:11629 transaction failed 29201/-71, size 0--1075335596126757632 line 3039 18:18:49 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x3, 0x1) 18:18:49 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB], 0x3, 0x1) 18:18:49 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200"], 0x3, 0x1) 18:18:49 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 237.305269] binder_alloc: binder_alloc_mmap_handler: 11626 20001000-20004000 already mapped failed -16 [ 237.317299] binder: BINDER_SET_CONTEXT_MGR already set [ 237.331527] binder: 11626:11629 ioctl 40046207 0 returned -16 [ 237.341572] binder_alloc: 11626: binder_alloc_buf, no vma [ 237.353337] binder: 11626:11640 transaction failed 29189/-3, size 0-0 line 3135 [ 237.364178] binder_alloc: 11626: binder_alloc_buf, no vma [ 237.372568] binder: send failed reply for transaction 233 to 11626:11629 [ 237.379560] binder: undelivered TRANSACTION_COMPLETE [ 237.389993] binder: 11626:11629 transaction failed 29189/-3, size 0--1075335596126757632 line 3135 [ 237.399677] binder: undelivered TRANSACTION_ERROR: 29201 [ 237.407154] binder: undelivered TRANSACTION_ERROR: 29189 [ 237.428415] binder: undelivered TRANSACTION_ERROR: 29189 [ 237.434066] binder: undelivered TRANSACTION_ERROR: 29189 18:18:50 executing program 0: r0 = dup(0xffffffffffffffff) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000005c0)={0x5, &(0x7f0000000580)=[{0x3, 0x7, 0x7f, 0x9}, {0x8000, 0x0, 0x5, 0x8}, {0x3f, 0x10000, 0x7, 0x1f8}, {0x6, 0x7ff, 0xf8000000, 0x8}, {0x7, 0x1, 0x400, 0x6d}]}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000600)='trusted.overlay.redirect\x00', &(0x7f0000000640)='./file0\x00', 0x8, 0x3) syz_open_dev$loop(&(0x7f00000004c0)='/dev/loop#\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x4) lsetxattr$security_capability(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='security.capability\x00', &(0x7f0000000180)=@v2={0x2000000, [{0x5, 0x3}]}, 0x14, 0x3) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f00000002c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffa) add_key(&(0x7f00000003c0)="2e64706164005bba419ae6b89ccc1f3c9fa84938ae09d765c00abaa0ec1264a4dddf5aaa47e3f9fdea94b923ddca014821a23ac1e35a6aa12d0e256c3cedd0bf79000930f8febfe4724a8f06042d0508732af4b038d805072aa998ef940770a64cf706ab8793a74a8cfe8bdbb1c48aff3c597c9527f4a2b767020467c6b4fe451089b7b6d7ac3bb36edde9b71a3279ace73c203c02429794553f370f0af59c595033773d56fa6a5cc44d9b2df531684aca79b24f0be9c379ea305e5136cea6bb72f21b1f", &(0x7f0000000380)={'syz'}, &(0x7f0000000300)="b659cb43901f5fbd3e0caa071177dd991114c5a5fb3cdde247c569d64804000000000000001dda4d6507b4026c992e2c9bf561c3fc9733d2", 0x38, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000500)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) read$eventfd(r1, &(0x7f0000000540), 0x8) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='fdinfo/3\x00') epoll_pwait(r2, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000280), 0x8) ioctl$EXT4_IOC_RESIZE_FS(0xffffffffffffffff, 0x40086610, &(0x7f0000000340)=0x9) r3 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f000044f000)={0xa, 0x4e20}, 0x1c) listen(r3, 0x0) syz_emit_ethernet(0x230, &(0x7f0000000840)=ANY=[@ANYBLOB="aaaaaaaaaaaacf2bb43c40b80800450002220000000000069078ac14ffaae000000100004e201c5afaf0df642e5c557286ef06c661cd76bfe696a4ea569a4f6c0aed93ca50b217b75e69d7d17b9e035029ab31cd853a6be147b1d0a2a333176987d4b980903dc00d9a1ba7358a1faeb4d513cfbfb9912c66dddbf63d4bab7129ba0f01000000000000001c70ef9286af5c1720779cf18480be3f2b799d106dcdd55057d48179dbce847c8ad60e5cb28790d37a2b9fd73310f7a42d25f15754cf18e4b51f6ad765b3de4fd31433c02c22d970a58b86cb997ac6d90ab98719f0d030b77680afcc2e729035c28f9551f2232d108f4bf73556876d6b7174057301986bfe5aa5a21d172f4b89605c12db81aea225251a678a9c397552af0a6895000000000000000000000000", @ANYRES32=0x42424242, @ANYRES32=0x42424242, @ANYBLOB="f000ca453b1181008dddf77ef49cc68f8c314c8ab1494eeb9229b2890a5305a4e6961e44f69216a8bc489fadae"], 0x0) 18:18:50 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x3, 0x1) 18:18:50 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB], 0x3, 0x1) 18:18:50 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:50 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200"], 0x3, 0x1) 18:18:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) fstatfs(r1, &(0x7f0000000080)=""/153) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:50 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB], 0x3, 0x1) 18:18:50 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2, 0x1) 18:18:50 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:50 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000"], 0x3, 0x1) [ 237.998053] binder: 11668:11673 transaction failed 29189/-22, size 0-0 line 3012 [ 238.015577] binder_alloc: binder_alloc_mmap_handler: 11668 20001000-20004000 already mapped failed -16 [ 238.050102] binder: 11668:11675 transaction failed 29189/-22, size 0-0 line 3012 [ 238.057813] binder: 11668:11673 transaction failed 29189/-22, size 0-0 line 3012 [ 238.065750] binder: undelivered TRANSACTION_ERROR: 29189 [ 238.078593] binder: undelivered TRANSACTION_ERROR: 29189 [ 238.091860] binder: undelivered TRANSACTION_ERROR: 29189 18:18:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) sendfile(r2, r0, 0x0, 0x1) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x100, r3, 0x321, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x400}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2113}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_SERVICE={0x54, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x9}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x1a}}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x53ef170912a73083}]}, @IPVS_CMD_ATTR_DAEMON={0x80, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bond_slave_0\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'eql\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x5}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}]}, 0x100}, 0x1, 0x0, 0x0, 0x10}, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000380)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000600), 0x0, 0x0, 0x0}) 18:18:50 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2, 0x1) [ 238.231521] binder: BINDER_SET_CONTEXT_MGR already set [ 238.237012] binder_alloc: 11687: binder_alloc_buf, no vma [ 238.243023] binder: 11687:11689 ioctl 40046207 0 returned -16 [ 238.249115] binder: 11687:11693 transaction failed 29189/-3, size 0-0 line 3135 [ 238.272512] binder: undelivered TRANSACTION_ERROR: 29189 [ 238.278922] binder: send failed reply for transaction 241 to 11687:11689 [ 238.305968] binder: undelivered TRANSACTION_COMPLETE [ 238.330442] binder: undelivered TRANSACTION_ERROR: 29189 18:18:51 executing program 0: r0 = inotify_init() pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) r2 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/self/attr/current\x00', 0x2, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000440)=0x80000000, 0x4) fsetxattr$trusted_overlay_upper(r2, &(0x7f0000000300)='trusted.overlay.upper\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="00fbff03f9816bca6493357311b4e1e7e4ff1febb1c7dea7fe939811ef2ed096b18c1e3c289497e9f834c6fd3836bd66a5fb0f89e1049094d4b43696b46990f988134a88153add48a10557266c995fccba521e58441bc2b8e8cc3008e4763a2143079da5dd34041fb732282dc3b8b9dc3b05b0e7f68b6ae3e9b1257ca854290b29fe4646f64a3ac4c4f99c5d4aaa492e650b13beb9f5b7c9450e40dd0379dd48954fea1e03751d832988e082bf2801e1f91217933fae055ec0839e05939f54e88d6aadcf44a47aa46678f494468cc02e6bdb3e413a15008e4f04575950f11893963d59aeb4217e3ef643f359d6fd06400a14107f5757245bc416f790559bbf"], 0xff, 0x1) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x5, 0x9, 0x12, 0x1, "5d85ea72f1bb76a4f0273a2a95dad871f83cc5533f2e6f317177090000000000000054e91bc5a977927b06fc779e926643249d6d2c16bf521400", "3750b3d610bad049571d323eff2c5cec5a28b29d0ca697b8e8188f7952c28637", [0x2, 0x2]}) ioctl$void(r0, 0xc0045878) getsockopt$inet_udp_int(r1, 0x11, 0x67, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f0000000180)={0x8, 0x401, 0x100, 0x7}) clone(0x0, &(0x7f00000001c0)="65da1bfd84", &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)="adbcc0c3afb765bea7f0b503516d6a39422aa0") 18:18:51 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200"], 0x3, 0x1) 18:18:51 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000"], 0x3, 0x1) 18:18:51 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:51 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2, 0x1) 18:18:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000e4ffffff00000000000000000000000000000000b52206000000d8f410e9387036cf9a0a2a567b260b0400000000000000146f1928213985d1aaa258233354a5f1d4a538096ce990fc9213a5ec990e486f704604bd1e98441efc444c15411047722d8eb38a519f142ae72ec5a7c5f8047fa2076b9fb17f141c5a30e00c3a8b66bc5dd8ae80fe1d28ce96176d0bf01e1e4e65356ca696fdfa82c89725f241efc06f4074ddea6a25bad79d824f"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000280)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x68, 0x0, &(0x7f00000002c0)=[@release={0x40046306, 0x3}, @transaction_sg={0x40486311, {{0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x28, 0x38, &(0x7f0000000200)=[@ptr={0x70742a85, 0x0, &(0x7f00000001c0), 0x1, 0x4, 0x32}], &(0x7f0000000240)=[0x48, 0x30, 0x0, 0x38, 0x28, 0x78, 0x48]}, 0x7fff}}, @acquire={0x40046305, 0x1}, @free_buffer={0x40086303, r2}], 0x72, 0x0, &(0x7f0000000340)="a083afe30f4727dc87584ad27b8833b1b7024706d5ab4636ef19cd83236b8c0f01e2681b6efe468b4f5d221776567ea1bcb0a0dcd00acae9f5f5406f1eae04566aa4dbe4a3801e19e4e4890016d000358699fdf8cf2eca7edcd9b2afcabdd246d25078210ec77e4d893e4971affb0b262068"}) 18:18:51 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000"], 0x3, 0x1) 18:18:51 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200"], 0x3, 0x1) 18:18:51 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB], 0x2, 0x1) [ 238.579334] binder_alloc: 11709: binder_alloc_buf size -2017612633045204992 failed, no address space 18:18:51 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x208041, 0x3) ioctl$EVIOCREVOKE(r1, 0x40044591, &(0x7f00000000c0)=0x1abe) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x2}, 0x1c) setsockopt$inet_tcp_int(r0, 0x6, 0xc, &(0x7f0000000140), 0x4) listen(r2, 0x7e) connect$inet(r0, &(0x7f0000000000)={0x2, 0x2, @loopback}, 0x10) 18:18:51 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) socket$inet6(0xa, 0x803, 0x3) r1 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = dup3(r0, r1, 0x0) ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f0000000000)) [ 238.623284] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 238.643290] binder: 11709:11712 transaction failed 29201/-28, size -2017612633061982208-16777215 line 3135 [ 238.644243] binder: 11709:11718 Release 1 refcount change on invalid ref 3 ret -22 [ 238.644250] binder: 11709:11718 got transaction to invalid handle 18:18:51 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) [ 238.644260] binder: 11709:11718 transaction failed 29201/-22, size 40-56 line 3012 18:18:51 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000"], 0x3, 0x1) 18:18:51 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB], 0x2, 0x1) 18:18:51 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200"], 0x3, 0x1) 18:18:51 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2c, 0x1) 18:18:51 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(0x0, &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) [ 238.767789] binder_alloc: binder_alloc_mmap_handler: 11709 20001000-20004000 already mapped failed -16 [ 238.801131] binder: BINDER_SET_CONTEXT_MGR already set [ 238.811494] binder: 11709:11712 ioctl 40046207 0 returned -16 [ 238.817530] binder_alloc: 11709: binder_alloc_buf, no vma 18:18:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:51 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000dec000)={0x6, 0x4, 0x338d, 0x7}, 0x2c) r0 = accept(0xffffffffffffff9c, &(0x7f0000000000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000080)=0x80) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f00000000c0)={'irlan0\x00', {0x2, 0x4e23, @local}}) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x10020000000, 0x0, 0x8}, 0x2c) 18:18:51 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000"], 0x3, 0x1) 18:18:51 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000"], 0x3, 0x1) 18:18:51 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB], 0x2, 0x1) 18:18:51 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(0x0, &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) [ 238.841764] binder: 11709:11718 transaction failed 29189/-3, size -2017612633061982208-16777215 line 3135 [ 238.853770] binder_alloc: 11709: binder_alloc_buf, no vma [ 238.861044] binder: send failed reply for transaction 245 to 11709:11718 [ 238.868086] binder: undelivered TRANSACTION_ERROR: 29201 [ 238.873613] binder: 11709:11749 transaction failed 29189/-3, size 0-0 line 3135 [ 238.905159] binder: undelivered TRANSACTION_COMPLETE 18:18:51 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000"], 0x3, 0x1) 18:18:51 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000"], 0x3, 0x1) 18:18:51 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200"], 0x2, 0x1) [ 238.933814] binder: undelivered TRANSACTION_ERROR: 29189 [ 238.934332] binder: 11752:11761 got new transaction with bad transaction stack, transaction 250 has target 11752:0 [ 238.934345] binder: 11752:11761 transaction failed 29201/-71, size 0-0 line 3039 [ 238.964241] binder: BINDER_SET_CONTEXT_MGR already set 18:18:51 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(0x0, &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) 18:18:51 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x3, 0x1) 18:18:51 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0xfffffdc6, 0x20000004, &(0x7f000031e000), 0x1c) connect(r0, &(0x7f00000000c0)=@ethernet={0x0, @dev}, 0x80) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$TCSBRKP(r1, 0x5425, 0x51) [ 238.990271] binder: 11752:11766 ioctl 40046207 0 returned -16 [ 238.990388] binder: undelivered TRANSACTION_ERROR: 29189 [ 238.990418] binder: undelivered TRANSACTION_ERROR: 29189 [ 239.009121] binder_alloc: 11752: binder_alloc_buf, no vma [ 239.015665] binder_alloc: 11752: binder_alloc_buf, no vma [ 239.039603] binder: 11752:11772 transaction failed 29189/-3, size 0-0 line 3135 [ 239.047390] binder: 11752:11761 transaction failed 29189/-3, size 0-0 line 3135 [ 239.059442] binder: send failed reply for transaction 250 to 11752:11761 [ 239.071011] binder: undelivered TRANSACTION_COMPLETE [ 239.088845] binder: undelivered TRANSACTION_ERROR: 29201 18:18:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) fcntl$setstatus(r0, 0x4, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:18:51 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200"], 0x2, 0x1) 18:18:51 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x1, @remote}, 0xfffffffffffffe96) syz_emit_ethernet(0x423, &(0x7f0000000cc0)={@link_local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0x0, 0x0, 0x0, 0x200000000000011, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x1, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) 18:18:51 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000"], 0x3, 0x1) 18:18:51 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x3, 0x1) 18:18:51 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) 18:18:51 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, &(0x7f0000000500)={'nat\x00', 0xbb, "93ccc396eefc7e5a9a2cad201bbb9418a6087f35487632793957fa19de32a71a9f2e4e7634f67b0d8feb4c4c65d155457c61007c7d1c16256d4f3a2ba76dab7a54bc1257ce363e05f53e55f80e23f4129bcf68a7132dfecc2375dbac3e9a23ba07602dfdb98be9ae4817eee144350d7380a7f1574b5c761e5ebd445bdae1c7d4d6f59a3310700ad20e58abe163add158f633fd6be06cebdded5c49fd1942191cc5a1af9e006e6fbd0e3ed1a9ca5f4a766cc0c8bf3eeae4ed69fc9a"}, &(0x7f00000000c0)=0xdf) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f00000006c0)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x2001001, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bpf(0x20000000, &(0x7f0000000700)='./file0/file0\x00', 0x0, 0x5004, 0x0) mount$bpf(0x20000000, &(0x7f00000004c0)='./file0/file0\x00', 0x0, 0x5890, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='bpf\x00', 0x0, 0x0) mount$bpf(0x20000000, &(0x7f0000000380)='./file0\x00', 0x0, 0x5890, 0x0) 18:18:51 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200"], 0x2, 0x1) [ 239.115556] binder: undelivered TRANSACTION_ERROR: 29189 [ 239.128083] binder: undelivered TRANSACTION_ERROR: 29189 [ 239.136966] binder: undelivered TRANSACTION_ERROR: 29189 18:18:51 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000"], 0x3, 0x1) 18:18:51 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x3, 0x1) [ 239.182618] binder_alloc: binder_alloc_mmap_handler: 11790 20001000-20004000 already mapped failed -16 [ 239.215468] binder: BINDER_SET_CONTEXT_MGR already set 18:18:51 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) 18:18:51 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000"], 0x2, 0x1) 18:18:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x208000, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0xb7d5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) socket$nl_xfrm(0x10, 0x3, 0x6) [ 239.227890] binder: 11790:11800 ioctl 40046207 0 returned -16 [ 239.236076] binder_alloc: 11790: binder_alloc_buf, no vma [ 239.242410] binder: send failed reply for transaction 255 to 11790:11797 [ 239.242598] binder: 11790:11797 transaction failed 29189/-3, size 0-0 line 3135 [ 239.258109] binder: undelivered TRANSACTION_ERROR: 29189 [ 239.263760] binder: undelivered TRANSACTION_COMPLETE [ 239.280099] binder: undelivered TRANSACTION_ERROR: 29189 18:18:51 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x10, 0x4000000003, 0x0) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000380)="2400000052000703fffd946f610500020000000000fd21fe1c4095421ba3a204005557ca3c835f83a8ffffba1ea0aa1c82581c0130040dc43cf6f74065f42520e20856244180e0320dfb004c1c63a0de5f15b1b82c69274da2a63ede837146460adf9aa3989646a1de844b68789ea1caa44443759b650700000088490d7806ff789fb5461f32cda35ec16129ddd390c6f1cb4949dac2edc1aae9ff5567a8643bbaf67203d3a4ad2bea645fd3360466e76c72cd6ee81e420f4b7bcd000702b11b4a5dfbed5ae677bf548f1939ed13c682f2a8e8ec670befaa5b05e7c05d8c23d72b6d0021bbb0a8a13851637c670b0f5e96fdb71773976b45aa55d6cef28824c1d47e508b4b8d4e956272f729a1a19b52d85fe6298cfdc63667614446067a60165571aa49c261a9", 0x127}], 0x1}, 0xffffffffffffffff) 18:18:51 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2, 0x1) 18:18:51 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000"], 0x3, 0x1) 18:18:51 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000"], 0x2, 0x1) 18:18:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) write(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(0xffffffffffffffff, 0x891b, &(0x7f0000000140)={'bond_slave_0\x00'}) creat(&(0x7f00000001c0)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000380)=0x8) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) times(0x0) syz_mount_image$ext4(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x100020, 0x0) 18:18:51 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x3, 0x1) [ 239.320273] binder: 11815:11820 got new transaction with bad transaction stack, transaction 258 has target 11815:0 [ 239.355268] binder: 11815:11820 transaction failed 29201/-71, size 0-0 line 3039 [ 239.368498] binder_alloc: binder_alloc_mmap_handler: 11815 20001000-20004000 already mapped failed -16 18:18:51 executing program 0: sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x8000009) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000100)) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x40, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpgrp(0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) capget(&(0x7f00000001c0)={0x80000000008051e, r1}, &(0x7f0000000200)={0x9, 0x81, 0xffffffff, 0x6, 0x402}) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) fsync(r0) ioctl$ASHMEM_SET_PROT_MASK(r4, 0x40087705, &(0x7f0000000280)={0x3, 0x1}) ioctl$int_in(r3, 0x5452, &(0x7f0000000580)=0xe2e) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000340)={0x800000001, 0x0, 0x5, 0xffffffff80000000, r1}) ioctl$RTC_IRQP_READ(r4, 0x8008700b, &(0x7f00000000c0)) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, 0x0, 0x0) ptrace$setregset(0x4205, 0x0, 0x0, 0x0) io_setup(0x3, 0x0) io_cancel(0x0, 0x0, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f0000000380)=0x6, 0x39d) sendto$inet6(r3, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ioctl$BLKFRASET(r5, 0x1264, &(0x7f0000000240)=0xae) ftruncate(r5, 0x2007fff) sendfile(r4, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 18:18:51 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000"], 0x2, 0x1) 18:18:51 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2, 0x1) [ 239.414125] binder: BINDER_SET_CONTEXT_MGR already set [ 239.419629] binder: 11815:11820 ioctl 40046207 0 returned -16 [ 239.451752] binder_alloc: 11815: binder_alloc_buf, no vma 18:18:51 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000"], 0x3, 0x1) 18:18:51 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', 0x0, 0x0, 0x1) 18:18:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getsockopt$sock_int(r1, 0x1, 0xc, &(0x7f00000000c0), &(0x7f0000000100)=0x4) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000380)={{{@in6=@ipv4={[], [], @remote}, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@remote}}, &(0x7f00000002c0)=0xe8) setsockopt$inet6_IPV6_PKTINFO(r3, 0x29, 0x32, &(0x7f0000000480)={@local, r4}, 0x14) [ 239.458464] binder: 11815:11845 transaction failed 29189/-3, size 0-0 line 3135 [ 239.468678] binder_alloc: 11815: binder_alloc_buf, no vma [ 239.474864] binder: send failed reply for transaction 258 to 11815:11820 [ 239.475411] binder: 11815:11820 transaction failed 29189/-3, size 0-0 line 3135 [ 239.490478] binder: undelivered TRANSACTION_ERROR: 29189 [ 239.496090] binder: undelivered TRANSACTION_ERROR: 29189 18:18:52 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x3, 0x1) 18:18:52 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2, 0x1) [ 239.517524] TCP: request_sock_TCPv6: Possible SYN flooding on port 20000. Dropping request. Check SNMP counters. [ 239.528546] binder_alloc: binder_alloc_mmap_handler: 11848 20001000-20004000 already mapped failed -16 [ 239.533162] binder: undelivered TRANSACTION_COMPLETE [ 239.533171] binder: undelivered TRANSACTION_ERROR: 29201 [ 239.533175] binder: undelivered TRANSACTION_ERROR: 29189 18:18:52 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', 0x0, 0x0, 0x1) 18:18:52 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000"], 0x2, 0x1) 18:18:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = getpgrp(0xffffffffffffffff) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f0000000100)=0xc) tgkill(r2, r3, 0x41) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000005806000000fd00000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000687d71420000000000000000000000000000000000000000000000000000000000000000223e840c41269eb5efa92a36d287feb1f64e5ac1693176d63b9c3895934d45f188cc132bc6e8d63c24d624c4990e331d1d7e8bdd60b64e23763d18392ef1eb75383ff2838df561416f6a76e7fb1e3b03d604f1e8942c86082d64bc223df79ffa45dde7a2c0f9bebf8409088643fb257c49b33f91b067882682cc9e9d03bc66edead473e5ffa0fb427871a47de76e39d9e66b5d392a83453516e0cedbf456ee7153093e1f920f8c98ca3aefffca7a635a3908a3bee373cb61b5bc63ac3366579ce6ef42d8b655308f8527782908e2cbd7a350da22c5bb845718d8c90a036ebe2cb72b986e71af47db7705a02d5ef032d99db17e7c77c243e74dc88e06dbf06dbe5890a337a9ffefd326762a1ca25bda33581cd701d6a31ecfc560efe6bab63e78c6ebcc06fa205c1c8ded00a33866ddb2fc9567ab75be54293f1e6b7ff805c6f83e3406c9363d923ccea149c505989d10b3c74f4612adbe79b6a39cbd31a9ff5ae08ff750f96e12f966e4f58b992603cafecc19c38ea32832288bafc36da667eb8cce2bca6fd617389209078fa6b4cebf15c284f76ff972c5cfbb6b17e0bfb61c689be8ed563d5f646859e89e744979120cd59c5532f208621554a626f1f6bab82e193eb2fa294028cda2f16609373792829b5cba71456ecc8f27d425625feb1d65b4f0c2ff53b40dd247dbb247c81ef7ee2b415bbf09810a18a1995f7bd63dcd69aeae8f201920de85fe0dca2143ab4907e87ed93ee386d70e1cfa72cbefda8354fcdf23a084909f4af6db67075f61166fdae496381f7284a818849d1f7dabcdfb30f67a776736c54e3f45197fc9c7c60eb9d72fc11b4f76c9de4c5b7d73098aa7051de45a818b3ac86a1390e0d41dce7109833cf581114ed96f7197a29c5e9421a0825b427a3f7fd3ad75862063b003ccf90659201729f81d6643dbe2c5d47a8c1f174a4617530257dec1a4ac6eeeea90d112a6561450b65cb0be1aed765f7aee1eb12a60b4e67059b2ad23aa701b9fd2421fc5f969102f3319d9323489551a58b6db0153ccaa760657286bfe4388334972f754a2a352"], 0x0, 0x0, 0x0}) [ 239.574355] binder: BINDER_SET_CONTEXT_MGR already set [ 239.579747] binder: 11848:11849 ioctl 40046207 0 returned -16 [ 239.582294] binder_alloc: 11848: binder_alloc_buf, no vma [ 239.582320] binder: 11848:11863 transaction failed 29189/-3, size 0-0 line 3135 [ 239.583129] binder: undelivered TRANSACTION_ERROR: 29189 [ 239.583168] binder: send failed reply for transaction 263 to 11848:11849 [ 239.585662] binder: undelivered TRANSACTION_COMPLETE [ 239.585671] binder: undelivered TRANSACTION_ERROR: 29189 18:18:52 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x3, 0x1) [ 239.705022] binder_alloc: 11872: binder_alloc_buf size 6975026953472 failed, no address space [ 239.721214] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 239.731779] binder: 11872:11874 transaction failed 29201/-28, size 6975026888704-64768 line 3135 [ 239.765587] binder_alloc: binder_alloc_mmap_handler: 11872 20001000-20004000 already mapped failed -16 [ 239.775805] binder: BINDER_SET_CONTEXT_MGR already set [ 239.781292] binder: 11872:11882 ioctl 40046207 0 returned -16 [ 239.787237] binder_alloc: 11872: binder_alloc_buf, no vma [ 239.793395] binder: 11872:11874 transaction failed 29189/-3, size 6975026888704-64768 line 3135 [ 239.793399] binder_alloc: 11872: binder_alloc_buf, no vma [ 239.793425] binder: 11872:11882 transaction failed 29189/-3, size 66-0 line 3135 [ 239.793865] binder: undelivered TRANSACTION_ERROR: 29201 [ 239.820853] binder: undelivered TRANSACTION_ERROR: 29189 [ 239.826307] binder: undelivered TRANSACTION_ERROR: 29189 18:18:52 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x6, 0x1f, 0x3, 0x7fff, 0x8642}, 0x14) setsockopt$inet_int(r0, 0x0, 0x10000000031, &(0x7f00000000c0)=0xe19, 0x4) getsockopt$sock_buf(r0, 0x1, 0x3b, &(0x7f0000000100)=""/135, &(0x7f0000000040)=0x87) 18:18:52 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000"], 0x2, 0x1) 18:18:52 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB], 0x2, 0x1) 18:18:52 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x3, 0x1) 18:18:52 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', 0x0, 0x0, 0x1) 18:18:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffa) r3 = add_key(&(0x7f0000000100)='logon\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f00000001c0)="b897b8ae00cc670e553bb63d7731635f60989caea0631b9044861dcfadd2f1a9750f1ede52bb7c4d10fcacff1dba52b0db83fb9a7ac889bdbe70c942adfc47fc64f2a1f1813033eb0f5130a6fe2bd6899987eb0559198e68d885169e7aa8f10183e783a40c2e98b0b60d1c5699e899c090484475bc66ea43286a28b59b6a0aba20705e3ba6dcdffa7e7e8205238b7af8da3e674d716ad72788a1fa8810949c117370d7df5985e3e6a69d3acd21550a3df88b7f56c54ec2833ae30325a662e8d393b87ed3b42b88d3a5f959118570969ab77034465ff4ae66ca63ace11ce7e641ceb5", 0xe2, 0x0) keyctl$link(0x8, r2, r3) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r4, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x6c, r5, 0x8, 0x70bd26, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x10001}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8f}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x80}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="8276d4ea43cf11634840000000000000000000000000000000000000000000000000000035b30000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) prctl$PR_SET_FPEMU(0xa, 0x3) 18:18:52 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2, 0x1) 18:18:52 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000"], 0x2, 0x1) 18:18:52 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB], 0x2, 0x1) 18:18:52 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)="2f6465762f6e65742f74756eff", 0x200000000000017e, 0x0) write$cgroup_type(r0, &(0x7f0000000000)="74687265616465ffff", 0x11ffffee7) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x20001, 0x0) ioctl$BLKROGET(r1, 0x125e, &(0x7f0000000080)) 18:18:52 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32], 0x2, 0x1) [ 240.340821] binder: 11894:11897 unknown command -355174782 [ 240.353163] binder: 11894:11897 ioctl c0306201 20000040 returned -22 18:18:52 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2, 0x1) [ 240.384564] binder: BINDER_SET_CONTEXT_MGR already set 18:18:52 executing program 0: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() clone(0xa0140100, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x11) wait4(0x0, &(0x7f0000000240), 0x2, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/policy\x00', 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) ioctl$ASHMEM_SET_NAME(r1, 0x41007701, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xb, 0x0, 0x0, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r3, &(0x7f0000000040), 0x0, 0x1}, 0xfffffffffffffe99) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x0) [ 240.415884] binder: 11894:11907 ioctl 40046207 0 returned -16 [ 240.423237] binder_alloc: 11894: binder_alloc_buf, no vma [ 240.430420] binder: 11894:11897 unknown command -355174782 [ 240.436549] binder: 11894:11897 ioctl c0306201 20000040 returned -22 [ 240.446300] binder: send failed reply for transaction 270 to 11894:11897 [ 240.454590] binder: undelivered TRANSACTION_COMPLETE 18:18:52 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x2, 0x1) 18:18:52 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB], 0x2, 0x1) 18:18:52 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2, 0x1) 18:18:53 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = perf_event_open(&(0x7f0000940000)={0x2, 0x3ed, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10003, 0x80011, r1, 0x0) sendto(0xffffffffffffffff, &(0x7f00000001c0)="83", 0x1, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) r2 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000280)=0x0) perf_event_open(&(0x7f0000000200)={0x4, 0x70, 0x200, 0x8, 0xffffffff7fffffff, 0x6, 0x0, 0x52c, 0x2, 0xc, 0x200, 0x100, 0x7c7, 0x20, 0x4, 0x1, 0x8, 0x0, 0x5, 0x10001, 0x4, 0x80000001, 0x3, 0x8, 0x10000, 0x1f, 0x7fffffff, 0x1, 0x6, 0xfffffffffffffffd, 0xfffffffffffffff8, 0x2, 0x5, 0xede, 0x93, 0x8001, 0x5, 0x3, 0x0, 0x1000, 0x5, @perf_bp={&(0x7f0000000140), 0x4}, 0x2, 0xf0c, 0xffffffff7fffffff, 0x1, 0x3ff, 0x401, 0x7ba}, r4, 0x2, 0xffffffffffffff9c, 0x1) socketpair(0xd, 0xf, 0x200000000000, &(0x7f00000002c0)={0xffffffffffffffff}) getsockopt$inet_tcp_int(r5, 0x6, 0x2d, &(0x7f0000000380), &(0x7f00000003c0)=0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) write$selinux_create(r6, &(0x7f00000000c0)=@access={'system_u:object_r:fixed_disk_device_t:s0', 0x20, 'unconfined_u:system_r:insmod_t:s0-s0:c0.c1023', 0x20, 0x1000}, 0x6c) getsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f0000000400)={@loopback, @empty, 0x0}, &(0x7f0000000440)=0xc) ioctl$sock_inet6_SIOCSIFADDR(r6, 0x8916, &(0x7f0000000480)={@local, 0x21, r7}) [ 240.460207] binder: 11894:11914 transaction failed 29189/-3, size 0-0 line 3135 [ 240.470311] binder: undelivered TRANSACTION_ERROR: 29189 [ 240.490580] binder: undelivered TRANSACTION_ERROR: 29189 18:18:53 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32], 0x2, 0x1) 18:18:53 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x2, 0x1) 18:18:53 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200"], 0x2, 0x1) 18:18:53 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB], 0x2, 0x1) 18:18:53 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x2, 0x1) 18:18:53 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32], 0x2, 0x1) 18:18:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x40f, 0x0, &(0x7f0000000080), 0x118, 0x0, 0x0}) [ 240.679715] binder: 11955:11957 unknown command 0 [ 240.687907] binder: 11955:11957 ioctl c0306201 20000040 returned -22 [ 240.705302] binder_alloc: binder_alloc_mmap_handler: 11955 20001000-20004000 already mapped failed -16 [ 240.715012] binder: BINDER_SET_CONTEXT_MGR already set [ 240.724587] binder: 11955:11957 ioctl 40046207 0 returned -16 [ 240.733803] binder_alloc: 11955: binder_alloc_buf, no vma [ 240.740010] binder: 11955:11962 transaction failed 29189/-3, size 0-0 line 3135 [ 240.749118] binder: undelivered TRANSACTION_ERROR: 29189 [ 240.754701] binder: send failed reply for transaction 273 to 11955:11957 [ 240.761800] binder: undelivered TRANSACTION_COMPLETE [ 240.770263] binder: undelivered TRANSACTION_ERROR: 29189 18:18:55 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB], 0x2, 0x1) 18:18:55 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200"], 0x2, 0x1) 18:18:55 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:18:55 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB], 0x3, 0x1) 18:18:55 executing program 0: bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000080), 0x0}, 0x18) socketpair(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)='sit0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getrlimit(0xf, &(0x7f00000004c0)) r0 = socket$inet6(0xa, 0x40000000002, 0x6029) mlock(&(0x7f0000fff000/0x1000)=nil, 0x1000) r1 = creat(&(0x7f0000000400)='./file0\x00', 0x8) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000200)=0x9, 0x4) getsockname(r0, &(0x7f0000000180)=@xdp, &(0x7f0000000300)=0x80) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000240)=@fragment={0x0, 0x0, 0x0, 0x9, 0x0, 0x13d9, 0x64}, 0x8) r2 = request_key(&(0x7f0000000340)='ceph\x00', &(0x7f0000000380)={'syz', 0x2}, &(0x7f00000003c0)='\\\x00', 0xfffffffffffffffd) r3 = getuid() fstat(r0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000580)='./file0\x00', r3, r4) r5 = getgid() keyctl$chown(0x4, r2, r3, r5) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000480)) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000280)={0x41, 0x0, 0x40, 0x7}, 0xc) perf_event_open(&(0x7f0000000040)={0x1, 0xfffffffffffffeff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/rtc0\x00', 0x100, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$EVIOCSREP(r6, 0x40084503, &(0x7f00000000c0)=[0x3240, 0x6]) bind$packet(0xffffffffffffffff, &(0x7f000000ec40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="3b3d2dffb8a0"}, 0x14) madvise(&(0x7f00009fe000/0x600000)=nil, 0x600000, 0xd) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) keyctl$set_timeout(0xf, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f1, &(0x7f0000000140)='sit0\x00') 18:18:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000080)=0x0) ptrace$setregset(0x4205, r2, 0x6, &(0x7f00000000c0)={&(0x7f00000001c0)="abe388beac07732ef92da92cb33f57514cd07ef993f30067694d8c0a92b9d45ffb69216cabd6be1f37864e8ab9d0b2a7277d5ab30d7ef6b15f942910663ec3ecd058dafc360a36f277880131053bd01144ea554f4e934d2b92e5d4b896e84edca781f897bc174bad42a67e3e817a771493515fd635dc61ab02d459bd6ffdfded46e70616310e29045af74ac4b16d8717b3b9532b53c19cf4c8306b416702dbf142a55bcac35386e661480881865195595cc4a38e62c839578cee7d470df5d3f43e4c6172134bb075", 0xc8}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:55 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:18:55 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB], 0x2, 0x1) 18:18:55 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200"], 0x2, 0x1) 18:18:56 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB], 0x3, 0x1) [ 243.455638] binder_alloc: 11971: binder_alloc_buf, no vma [ 243.472363] binder: 11971:11974 transaction failed 29189/-3, size 0-0 line 3135 [ 243.492839] binder: BINDER_SET_CONTEXT_MGR already set [ 243.499630] binder: 11971:11979 ioctl 40046207 0 returned -16 18:18:56 executing program 0: bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000080), 0x0}, 0x18) socketpair(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)='sit0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getrlimit(0xf, &(0x7f00000004c0)) r0 = socket$inet6(0xa, 0x40000000002, 0x6029) mlock(&(0x7f0000fff000/0x1000)=nil, 0x1000) r1 = creat(&(0x7f0000000400)='./file0\x00', 0x8) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000200)=0x9, 0x4) getsockname(r0, &(0x7f0000000180)=@xdp, &(0x7f0000000300)=0x80) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000240)=@fragment={0x0, 0x0, 0x0, 0x9, 0x0, 0x13d9, 0x64}, 0x8) r2 = request_key(&(0x7f0000000340)='ceph\x00', &(0x7f0000000380)={'syz', 0x2}, &(0x7f00000003c0)='\\\x00', 0xfffffffffffffffd) r3 = getuid() fstat(r0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000580)='./file0\x00', r3, r4) r5 = getgid() keyctl$chown(0x4, r2, r3, r5) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000480)) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000280)={0x41, 0x0, 0x40, 0x7}, 0xc) perf_event_open(&(0x7f0000000040)={0x1, 0xfffffffffffffeff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/rtc0\x00', 0x100, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$EVIOCSREP(r6, 0x40084503, &(0x7f00000000c0)=[0x3240, 0x6]) bind$packet(0xffffffffffffffff, &(0x7f000000ec40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="3b3d2dffb8a0"}, 0x14) madvise(&(0x7f00009fe000/0x600000)=nil, 0x600000, 0xd) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) keyctl$set_timeout(0xf, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f1, &(0x7f0000000140)='sit0\x00') [ 243.506222] binder_alloc: 11971: binder_alloc_buf, no vma [ 243.519666] binder: 11971:11979 transaction failed 29189/-3, size 0-0 line 3135 [ 243.521082] binder_alloc: 11971: binder_alloc_buf, no vma [ 243.521107] binder: 11971:11980 transaction failed 29189/-3, size 0-0 line 3135 [ 243.545305] binder: undelivered TRANSACTION_ERROR: 29189 18:18:56 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:18:56 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200"], 0x2, 0x1) 18:18:56 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000"], 0x2, 0x1) 18:18:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = memfd_create(&(0x7f0000000080)='/dev/binder#\x00', 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'nr0\x00', 0x0}) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000100)={r3, 0x1, 0x6, @local}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:56 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB], 0x3, 0x1) [ 243.596188] binder: undelivered TRANSACTION_ERROR: 29189 [ 243.603502] binder: undelivered TRANSACTION_ERROR: 29189 18:18:56 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$IOC_PR_CLEAR(r0, 0x401070cd, &(0x7f0000000040)={0x9}) ustat(0x6, &(0x7f0000000680)) [ 243.657289] binder: 11998:11999 got new transaction with bad transaction stack, transaction 280 has target 11998:0 18:18:56 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200"], 0x2, 0x1) 18:18:56 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB], 0x1, 0x1) 18:18:56 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000"], 0x2, 0x1) 18:18:56 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200"], 0x3, 0x1) 18:18:56 executing program 0: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x100000002132, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0xc812, r0, 0x0) futex(0x0, 0x85, 0x0, 0x0, &(0x7f0000000140), 0xa1f3ffff) [ 243.716874] binder: 11998:11999 transaction failed 29201/-71, size 0-0 line 3039 [ 243.731492] binder_alloc: binder_alloc_mmap_handler: 11998 20001000-20004000 already mapped failed -16 [ 243.741522] binder: BINDER_SET_CONTEXT_MGR already set [ 243.746827] binder: 11998:12014 ioctl 40046207 0 returned -16 [ 243.752937] binder_alloc: 11998: binder_alloc_buf, no vma 18:18:56 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB], 0x1, 0x1) 18:18:56 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000"], 0x2, 0x1) [ 243.774608] binder: 11998:11999 transaction failed 29189/-3, size 0-0 line 3135 [ 243.780911] binder_alloc: 11998: binder_alloc_buf, no vma [ 243.780938] binder: 11998:12014 transaction failed 29189/-3, size 0-0 line 3135 [ 243.781400] binder: send failed reply for transaction 280 to 11998:11999 [ 243.782096] binder: undelivered TRANSACTION_COMPLETE [ 243.782105] binder: undelivered TRANSACTION_ERROR: 29201 [ 243.782109] binder: undelivered TRANSACTION_ERROR: 29189 18:18:56 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200"], 0x2, 0x1) 18:18:56 executing program 0: r0 = openat$keychord(0xffffffffffffff9c, 0x0, 0x101000, 0x0) r1 = creat(&(0x7f0000000580)='./bus\x00', 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0) r3 = gettid() ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000540)) dup2(0xffffffffffffffff, 0xffffffffffffffff) r4 = getuid() fstat(r2, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000280)='./bus\x00', r4, r5) perf_event_open(&(0x7f0000000140)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) ioctl$BLKRESETZONE(0xffffffffffffffff, 0x40101283, &(0x7f0000000240)={0x2}) r6 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) rt_sigaction(0x0, &(0x7f0000000340)={&(0x7f00000001c0)="c401792b780041dd33cfc4e16e5285e800000066450f38020966660f6c2cd1c461265aeff04481060000002199c40211af19", {0xfe8}, 0x10000000, &(0x7f00000002c0)="c4e27d0e3500000000c48213f6b0fbffffff430f78ab89000000f042804c412702ff8e07d90000f2f046302f0f1bae87a1591ef3a5c4a17fe6b50000008045d9f7"}, &(0x7f0000000440)={&(0x7f0000000380)="8f6950014e1f36420f54dbc4a20dbfdb8f6978c11b8f885885cdf9c481ac5cc93e0ffd8bff2f027bf30f7ffcc441e55d1ac4217c118075980000", {}, 0x0, &(0x7f0000000980)="f243afc4c3d122641f1213660fe47cfd0041700cc44199d44006c463b5496f00fa66470f78c30056f3440f2cc0c4237122b5040000000d64410f0f7c81e1a7"}, 0x8, &(0x7f0000000480)) sysinfo(&(0x7f00000007c0)=""/154) ioctl$PIO_SCRNMAP(r0, 0x4b41, &(0x7f0000000740)="2f89b7ae708d875a42998958d6fd90") perf_event_open(&(0x7f00000004c0)={0x5, 0x70, 0x209a, 0x8, 0x4, 0x0, 0x0, 0x9, 0x40814, 0x6, 0xffff, 0x1, 0xfffffffffffffff9, 0x6, 0x0, 0x1, 0x0, 0x6, 0x1, 0x86, 0x7fff, 0x7464, 0x9, 0x81, 0x8, 0x3ff, 0x8001, 0x4, 0xcf, 0xf599, 0x4, 0x9, 0x0, 0x0, 0x0, 0x5, 0x8, 0x3, 0x0, 0x0, 0x4, @perf_config_ext={0x1, 0x10001}, 0x8, 0x0, 0x2, 0x0, 0x7, 0x0, 0x1000}, r3, 0x0, 0xffffffffffffffff, 0x1) ioctl$BLKPG(r6, 0x1269, &(0x7f00000006c0)={0x1, 0x0, 0x0, &(0x7f0000000800)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046205, &(0x7f0000000000)={0x6, 0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="ffcc4a548c3305bbb4cf4f00d3070000dac7eb85a00cda1d4169b033cb9169563f6180760743891cfb6e8de98881af0a87870917c4e2b61e3d76ad7629dc6d1aab4ba57ba50d11606a636e6b0aa054ec5f8dbda65c87007cf389590c305ec39537a5e666b04af1928e2d9050538339a6d4df2947cc925a26324f6ecf02008cab06dbf4a3a42257d87f22ca413252d9ed63ccc7ff7692cd188268b1dc06cd5a72359fcdae1c4c7b9fc064aa843745551dfd72fbbe52650c4e4e87185da4065c3a78070edb38af639aa7c3613943d1cd10ebb748e671d654c8533f46fa7a4bf3b253a78003e72a38b8a4b27f65d795f4337b5d42b4745819a624b58012bb9788137e54491ce6d9e5bd54103d00a945feaf798f"], 0x0, 0x0, 0x0}) r7 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000600)='/dev/rtc0\x00', 0x40, 0x0) r8 = openat$cgroup_ro(r1, &(0x7f0000000080)='io.stat\x00', 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000700)={r8, r7, 0x0, 0x3}, 0x10) ioctl$GIO_SCRNMAP(r0, 0x4b40, &(0x7f0000000240)=""/175) readlinkat(r0, &(0x7f00000005c0)='./file0\x00', &(0x7f0000000880)=""/198, 0xc6) syz_open_procfs(0x0, 0xfffffffffffffffe) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) 18:18:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 243.800130] futex_wake_op: syz-executor0 tries to shift op by 3903; fix this program [ 243.807459] futex_wake_op: syz-executor0 tries to shift op by 3903; fix this program [ 243.849113] binder: undelivered TRANSACTION_ERROR: 29189 [ 243.854671] binder: undelivered TRANSACTION_ERROR: 29189 18:18:56 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000"], 0x2, 0x1) 18:18:56 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200"], 0x3, 0x1) 18:18:56 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB], 0x1, 0x1) 18:18:56 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000"], 0x2, 0x1) [ 243.903638] binder: 12030:12036 got new transaction with bad transaction stack, transaction 285 has target 12030:0 [ 243.942048] binder: 12030:12036 transaction failed 29201/-71, size 0-0 line 3039 [ 243.962505] binder_alloc: binder_alloc_mmap_handler: 12030 20001000-20004000 already mapped failed -16 [ 243.972554] binder: BINDER_SET_CONTEXT_MGR already set [ 243.977942] binder: 12030:12036 ioctl 40046207 0 returned -16 [ 243.987584] binder_alloc: 12030: binder_alloc_buf, no vma [ 243.998854] binder: 12030:12042 transaction failed 29189/-3, size 0-0 line 3135 [ 244.018177] binder_alloc: 12030: binder_alloc_buf, no vma [ 244.024340] binder: send failed reply for transaction 285 to 12030:12036 [ 244.030380] binder: 12030:12036 transaction failed 29189/-3, size 0-0 line 3135 18:18:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="00634040000000000000000001000000000002ed097f66dbcb4dbb860b777f10cdba4459c7000000000000000000000000000000000000007f000000000000000000000000000000000000000000000000000000000000c09331364048a5"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x4800, 0x0) 18:18:56 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200"], 0x1, 0x1) 18:18:56 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000"], 0x2, 0x1) 18:18:56 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000"], 0x2, 0x1) [ 244.065098] binder: undelivered TRANSACTION_ERROR: 29189 [ 244.093454] binder: undelivered TRANSACTION_ERROR: 29189 [ 244.108109] binder: undelivered TRANSACTION_COMPLETE 18:18:56 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200"], 0x1, 0x1) 18:18:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x33f, 0x0, 0x0}) mremap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000003000/0x4000)=nil) syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x400000, 0x0) fsetxattr$trusted_overlay_opaque(r1, &(0x7f0000000080)='trusted.overlay.opaque\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x3) ioctl$EXT4_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000100)=0x10) [ 244.109843] binder: 12057:12060 got transaction with invalid data ptr [ 244.109881] binder: 12057:12060 transaction failed 29201/-14, size 199-0 line 3153 [ 244.109986] binder: 12057:12060 got transaction to context manager from process owning it [ 244.109997] binder: 12057:12060 transaction failed 29201/-22, size 0-0 line 3003 [ 244.129335] binder_alloc: binder_alloc_mmap_handler: 12057 20001000-20004000 already mapped failed -16 [ 244.129424] binder: BINDER_SET_CONTEXT_MGR already set [ 244.129432] binder: 12057:12060 ioctl 40046207 0 returned -16 [ 244.129521] binder_alloc: 12057: binder_alloc_buf, no vma [ 244.129544] binder: 12057:12062 transaction failed 29189/-3, size 199-0 line 3135 [ 244.129668] binder_alloc: 12057: binder_alloc_buf, no vma [ 244.129690] binder: 12057:12060 transaction failed 29189/-3, size 0-0 line 3135 [ 244.149047] binder: BINDER_SET_CONTEXT_MGR already set [ 244.149127] binder: 12064:12065 ioctl 40046207 0 returned -16 [ 244.149220] binder_alloc: 12057: binder_alloc_buf, no vma [ 244.149243] binder: 12064:12065 transaction failed 29189/-3, size 0-0 line 3135 [ 244.149259] binder: 12064:12065 ioctl c0306201 20000000 returned -14 [ 244.149643] binder_alloc: 12057: binder_alloc_buf, no vma [ 244.149666] binder: 12064:12065 transaction failed 29189/-3, size 0-0 line 3135 [ 244.149960] binder: 12064:12065 ioctl 40086602 20000100 returned -22 [ 244.150543] binder_alloc: binder_alloc_mmap_handler: 12064 20001000-20004000 already mapped failed -16 [ 244.150623] binder: BINDER_SET_CONTEXT_MGR already set [ 244.150631] binder: 12064:12065 ioctl 40046207 0 returned -16 [ 244.150692] binder_alloc: 12057: binder_alloc_buf, no vma [ 244.150714] binder: 12064:12066 transaction failed 29189/-3, size 0-0 line 3135 [ 244.150729] binder: 12064:12066 ioctl c0306201 20000000 returned -14 [ 244.151034] binder_alloc: 12057: binder_alloc_buf, no vma [ 244.151056] binder: 12064:12065 transaction failed 29189/-3, size 0-0 line 3135 [ 244.151198] binder: 12064:12066 ioctl 40086602 20000100 returned -22 [ 244.300597] binder: undelivered TRANSACTION_ERROR: 29201 [ 244.306047] binder: undelivered TRANSACTION_ERROR: 29189 18:18:56 executing program 0: open(&(0x7f00000000c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000080)='./file0\x00') mkdir(&(0x7f0000000140)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) renameat2(r0, &(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", r0, &(0x7f0000000040)='./file0\x00', 0x4) 18:18:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:18:56 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200"], 0x3, 0x1) [ 244.311624] binder: undelivered TRANSACTION_ERROR: 29189 [ 244.317092] binder: undelivered TRANSACTION_ERROR: 29189 [ 244.322765] binder: undelivered TRANSACTION_ERROR: 29189 [ 244.328236] binder: undelivered TRANSACTION_ERROR: 29189 [ 244.345753] binder: undelivered TRANSACTION_ERROR: 29189 18:18:56 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200"], 0x1, 0x1) 18:18:56 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000"], 0x2, 0x1) [ 244.362679] binder: undelivered TRANSACTION_ERROR: 29189 [ 244.368303] binder: undelivered TRANSACTION_ERROR: 29201 [ 244.395409] binder: undelivered TRANSACTION_ERROR: 29201 18:18:56 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000"], 0x3, 0x1) 18:18:56 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000"], 0x2, 0x1) 18:18:56 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x13102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x5, 0x37}) wait4(r0, &(0x7f0000000000), 0x40000002, &(0x7f00000001c0)) wait4(r0, &(0x7f0000000040), 0x40000000, &(0x7f0000000280)) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:18:56 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000"], 0x1, 0x1) 18:18:56 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000"], 0x2, 0x1) [ 244.412881] binder: 12075:12077 got new transaction with bad transaction stack, transaction 299 has target 12075:0 [ 244.431508] binder: 12075:12077 transaction failed 29201/-71, size 0-0 line 3039 [ 244.456130] binder_alloc: binder_alloc_mmap_handler: 12075 20001000-20004000 already mapped failed -16 18:18:57 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000"], 0x1, 0x1) 18:18:57 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x2, 0x1) [ 244.496505] binder: BINDER_SET_CONTEXT_MGR already set [ 244.506509] binder: 12075:12077 ioctl 40046207 0 returned -16 [ 244.517230] binder_alloc: 12075: binder_alloc_buf, no vma [ 244.531529] binder: 12075:12103 transaction failed 29189/-3, size 0-0 line 3135 [ 244.540508] binder_alloc: 12075: binder_alloc_buf, no vma 18:18:57 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000"], 0x2, 0x1) 18:18:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:18:57 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000"], 0x3, 0x1) [ 244.546079] binder: 12075:12077 transaction failed 29189/-3, size 0-0 line 3135 [ 244.554199] binder: send failed reply for transaction 299 to 12075:12077 [ 244.571063] binder: undelivered TRANSACTION_ERROR: 29189 [ 244.594035] binder: undelivered TRANSACTION_ERROR: 29189 [ 244.612765] binder: undelivered TRANSACTION_COMPLETE [ 244.632521] binder_alloc: binder_alloc_mmap_handler: 12110 20001000-20004000 already mapped failed -16 18:18:57 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x2, 0x1) 18:18:57 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000"], 0x1, 0x1) 18:18:57 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000"], 0x2, 0x1) 18:18:57 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000"], 0x3, 0x1) [ 244.640544] binder: undelivered TRANSACTION_ERROR: 29201 [ 244.640548] binder: undelivered TRANSACTION_ERROR: 29189 [ 244.654095] binder: BINDER_SET_CONTEXT_MGR already set [ 244.659394] binder: 12110:12117 ioctl 40046207 0 returned -16 [ 244.664426] binder_alloc: 12110: binder_alloc_buf, no vma [ 244.664459] binder: 12110:12119 transaction failed 29189/-3, size 0-0 line 3135 [ 244.664911] binder: undelivered TRANSACTION_ERROR: 29189 [ 244.664951] binder: send failed reply for transaction 304 to 12110:12117 [ 244.665332] binder: undelivered TRANSACTION_COMPLETE [ 244.665341] binder: undelivered TRANSACTION_ERROR: 29189 18:18:57 executing program 0: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x4000000000003, 0x0, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$binfmt_script(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) recvmmsg(0xffffffffffffff9c, &(0x7f0000004400)=[{{0x0, 0x0, &(0x7f0000002800)=[{&(0x7f0000001700)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmsg$IPVS_CMD_FLUSH(0xffffffffffffffff, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x3c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) setsockopt$packet_tx_ring(r0, 0x107, 0xd, 0x0, 0x51e) r3 = memfd_create(&(0x7f00000000c0)='-}{usermime_type\x00', 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) sendmmsg(r2, &(0x7f0000001300)=[{{0x0, 0x0, &(0x7f0000001180), 0x240, &(0x7f00000011c0)}}], 0x249, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000280)='gretap0\x00', 0x10) perf_event_open$cgroup(0x0, r0, 0xe, 0xffffffffffffffff, 0x6) mmap(&(0x7f0000556000/0x3000)=nil, 0x3000, 0x2, 0x10, 0xffffffffffffffff, 0x0) r4 = creat(&(0x7f0000000700)='./bus\x00', 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r3, 0x0, 0x0}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000540), 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0xa, 0x30, &(0x7f00000007c0)=ANY=[@ANYBLOB="00000100000000000000020000fffffffffffffeffff74009606080000009500060000000000000035320173d9ff3406f5ecd4e458431edbb0624558e03b474321fa03fa70f199b0dc5520705ef2d6bdc003f1eb7aea8982fcad4c6d0afb4edb7fccb1636fa3df5f182875bb8ab21cf0ea1e1c41865110f792abf9555f2640e33c3f5e7e7b3245c17e9f7b1b87cee9985172191b4d51e206e3107b8b2d9024b098ada7b1e51d7bb3e7ecbbbe4d846b126410011398985a354c4b0014e2d343faa6f4a96bdff05dc4fc8e76d141734934ed502aea0e186ce95b2c9dce2af4721083951d4d3c029d94cba01c289a25e72a05291277c848132456a93062dc8e75fd73f9841153be6e83c7fe460dbcb5d5fe0b9a91453bfc3a87bb4786dfd60423a2005fba7f6cfd3c8bc0464c8a98d65058d1febba859a0f7a5f216e168c8f51fa2d49760c5f39aefc7388c649b1723b29e1d457d07430d1baf3997d634956608b76aff0e2fa1159db8b31e79163e8872c4e8ec17a513d1f68763aea5dafd60099e9c604d54d7"], 0x0, 0x6, 0x0, 0x0, 0x41000, 0x1, [], 0x0, 0x1}, 0x48) ftruncate(r4, 0x208200) r5 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x200, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/status\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r5, 0x0) pipe(&(0x7f00000002c0)) 18:18:57 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x2, 0x1) 18:18:57 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) 18:18:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000003000/0x3000)=nil, &(0x7f0000005000/0x1000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000005000/0x3000)=nil, &(0x7f0000007000/0x1000)=nil, &(0x7f0000005000/0x2000)=nil, &(0x7f0000002000/0x1000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000002000/0x3000)=nil, &(0x7f0000000680)="25db1ae92c22050095a6dedf0b36dbb1049d9e1dbcef0779bb449be78e592501c8050128df5d58284ee323c0d0d796d3b558b65b3ad8f9bfea98eda876043b89667fa384d418fd7af32f91596b9a68a492a885896ae361343e1495191b138e2617094a4c894c8a208f5879b1aab9b9ccdfd8f36584ef6ec2ec67228355a62f9fb9272f4a21f55b9973582b46ca9cb6b4738c451a6cccdd3706101c36c73a54a80c09f05965aff343fc602f46045beef8fd1096e64899e347b1d38e800ebcd2dd1fa6fd915987360ec6ce5911f555b1b3b690ccd0e4b6d73c41f66dba3b43a131db3e6e5c1cb3cce2519c0ecac493de36e9bc3b68c0e04036ec13c52ad69371dde91e94042fe4aa7fceb4668f0f70f8e9e064493efc2fb1bdcf4f2a9569c2fa9aa1309d7d8cd97e6b25f1b451e0012156c7520eedd2513a81e8e2145a00197d8495b491b74bfcf752610052d9888b9622a4e74178fdca1bea84733f5e13b0f32f85912dee4259e4d51d7f7b71e569ce15318e88137aa1342f806358f96c8038084d499c435c12d4cadf82993c6990be1bf412696374e352a2dcf01c45b6d77247ee4fb482fd618877550b98df65171c8191ad90688bc8d04fbfbfc501f9bb09b8c25e398e0a45d4dde21d757b5c8221387075ffc282b1938d5e1c56506cdf05ea72e99b4fa69a3796c31e61e36b55ece2e7de172fd218a2383ea3611e574a7da31c59a4c858c3083be2ed1386696aa3ace9c83354cf02d88537fed635d3e3daf9066f33da23f69ba1f86e6d71bc9d89df47d56102604d02bd47dc7957c2aa92e789292b46cad0e8e31af03ef274c820cf79cbe1c3e5e4ebcaeb5b695896e79abcfdbed06d9b02cab09062524b95ee61f8cc23aeeadd49d29f19b86709ca0b6a971b32b66771d3ca8212a42328d10254ee6004a5d61b55d1be63cd2b0f41a41a249a97963d7c715d46d16d4987df1f7c05f074d81f655e96c78ceb24b4f2f33e338adcfa19b415e860a7397170bab387e991b6c3be7e7808c14404a1cb218c22da5fa0c021b8de4a07e58a6321ed22937877b804071b83d23ea6e054281dbffdf9ecd8387ddec65b9e996de9667a46437bb3b340ed623b0bba0e706d22423c47c253e6598ddc05119f539110cc8b8497908ad23f1891fb32dc986628a9b45dce651eb5317eb62d2f535956a73eeaa0e17ba3c592ec270a07d5f7e01a1586e5a60aed0dd011a88f64ba7e52ea78c98ed17b2047fdcc9d4cc09affbaf7bb0d8f8902296aa13bc45cb5f891ce0a470aec6232e9292089b9ab54b36427fe24424e87e9a3f2bbf0d313a832beb5a6b39bd8c7be0bdc109308975ce1b911cb5c37d34f01961d621a794a33b347075c0a1dc0086fc212f075bbe84469c40032ddf1f3bbd5332df920d05243e744de410b5be0a716ecc90335050b8127f702d019f8606a82c82c3a0169a4fb27493fbfba403a408fa77c41c345af151b5e5f6ee22183fe05d9ed424a333719edd883ebcaa56474b83853a9dc3f6f9370bbaae17dab906e097a2621e5b3c891f5faf94993fea140b64336e4049759656df6bb74fe886843fed5488eebaf2f45e9c20b66847f29928fd221629f1481159bb95588bd5ca388d7ea532220c339eeb8086d2cb459976ed0d88b6d0188c61afcd50b25ccf19dd3ec5b1470eb59a28e6fa3a31973ec621d00b484b6a0d5bedd938d270d3c9b3594c57ddc4aab96d347ec430b5c604b99cc1c25450840644cea4d6cae102715875823a2797a6148856b570de82903e045e21cd9d8041475a210a6b46fed82af760442ae830680a6625152944089af3975655af6a04ca060ff6c87126ef3b1ad7e6dcb6ba196f5d82e0fbd54cfcf2996a86d90bc9dabc0c23bf85df1794e0d57c73ed358f87561bb8a7679fb1ecbcf9f3e09e6c17e2d3d69850737d64f226753fc9a2d8f7bb3c3caf2f7ffdbe021ee45cbe4f6b11535f027bbe9535a302da9c1c7ebe6762caf3ea52520692cc9221341f33313aa296cb31cf516861f3117e01228fc8d860a09232fb81973527c490f6cd31977b1ee0097f56177864fbeb89f58936c0b0e84955e3039785ce678a0d6cb6db0b40c7aa9e8f8566d47a73bc76af0d59cf586c680cc9c19447b1b76f51b1377b9414dc302340c9d38d07e0c0c6b52672e850e94c9d8271ed4cf5b5b22895a7734101fbe170f1702440b64609dc0838876fb7858bac5ea94b2b38f6e781172b6ee30de5c1651de1d97d3bd87adc01d517ea1beb5bd7c1305233c3b3384aaedffde2b9d5c2e7a6c3cb16e7bcb38c42f0ac1d113fc7f97e165ac5076950962a1948b42a9d03ff872e00e555e4ac3437244d1bee4f360692740a8c2d746fad20d357f233a2008eeae3896dc130e46cda4b0fdad39cc0e1f7cadeb117f68c5168152df3fc36b0ea07c9426102fc77bd278b0d1eebf3fd9b0c73a4a3a91b64238c8eb223f2d7024a9e045d531b16e35fc7954449a082f9b6c22e60f76b5d3ef20015fa67480f4c80992b6161a874142e7b8e6631556beae5cd69b0ddb73987ff9ce7067e309c5349e9605b262f76998bebfef3cb1ed696aade25fef8817c1c0e95950a49b4180981e11d4e11e61a0958d98cada90a958bd5fd64a74a5bbe68b8d06ff6d5779c2ca321e24abd8ac29b53420f2418cafa4dcd4ddbe8f45ae047b72399464b7715f9cdf974decbfbf6a47b7e00f5ff7e340c61826819d62252e7459ece0d48d5b8fb422a4209e9a3b2553529a4c09d81caf81c47825b192fbdedee60cae96be2b670978a483e5c161a2d018121c7f6ebb762ed993749401f151b5c09e5ca78204f52f006cb18ea46abf5f0300b4d2996bddafc9cf00ae01fbd38277f0ad67efc475e2b761386c2ea7ccb40249fdec2c7e8a17f7c1ac2a6896d150afbad15d14045756a3bd4d215d992c37d88c3b7c76679f2464d70f6198da973f642b6fa4492c965262044fa697c3de2bb1bef5452b62c24d35385650fd9557bba905520c2754ac8cc9fc0e1af3b2c752ddf535847ceb439af250f3f30733cfb310ab5503614ac6b3f3d721c9f3a54cc4fffaaf90dd102c2587744a017c2d387bb96dce3f3d53fa91a535be555ae9d2ef91aa6a819243180cc728c75cd9cdc0d041517878a6344a2aee012a932c5d33a20df0cd7faabaabffebdd51d45b566a0471ad9d5e293ffa6ea1b9a1caf34cb49427046f1b8b76645e5741147365ea65926c3980d80cb974cc5d0165ddc11042a12727ed5ba1bbd3945e654c49eb976ce23554283daf978c2b948ce7bd5a2f12a3c95f8bc01d54dd071dde0887b313dc6500c4af7aaae68b4804aaac4113071094b9b8700aad78c803744813c55c6ab3ff2d106469c61f2acbdfeb4e70d73ed73f748f686862e60209636509ea8e8b31c1204e5d188e411fe131f70356ea70cb8d7200e807f1cab5749553c7a9e0b566351e4f9f4bd15ea84a375c5569631cc3c61484475fe996115968efaa6411417460f59117c1fb550e4b2bebd39f080383f4f0349304274a101f08ac90704230d9a6dca25584f109578b9639ca1093c69d22e5800c95416a051295235604ef21c00e8008d9fd761b2a870377dfafaf8b3eb72cb94258f5bc3b384582b3f7d8a0ef29add5beac8708c44b39e14a0eaa8d6785f551d496f925c666bf0920e9aeabe5d24126060ec51384de74cf6cadf27273e065b59648e5879655170559ae3de78a878467205fce225b8064acb4426d291eb5482bfd91e85137218c8c16b707a88f87f946ed7c6cb93ca6c7b0866683bac30a4d5bcbd3802d6584b941589b3082af2fb9e1a43233871c1778e5fa5e6dbfe117f31395caad93abdd838dac53febad76ccb67906fb49522da56770a9e16d89452552a1593ac3ef0009c1edfdbd3d7b694a04538f44feefd04f7297684158ef5d8a08b3332941d2fdfffe13a463dcc415790b4c04ae93cfbaa485478b1eec21052b8ea896b418e27f2afcbd4b97c6f5b8009a431e98c40e729396f15df550c43fc197a5568673308b0298ab5a6641592d93292b0fed5f394681f60d3133563400dd7b14191842a71db1f8842d2985704df19e58da2025953f3567de21abf7f88b1af72c2c11ba2b7bae5b1f6a0dada0b540a7169ac29747cccae744970e7194c59e685060bd14ac15985cf38397a601fc4cefcd575ba0c756a2e65826ba3411769e829ec51abfc8a915f8cab56c921bf0e28587d5bead75f8ac9d1fe8492d6f94cfc33cff255b69e863f6061982a489ab4a1b242a4d5cc2021f89f74ca4b9f652894894c29bf05629357bed357397cc3142740d705913d68663b554a9d62019256dbd814a9e0fa96649af3b989f3632205e3d0ac85c150da52de836bddbc00634bb59ca959339d5fefd6cadf58102eb21f9e6fff4672bebe9ee9f39a496c0238785a3e28f268db062a8b7665c334f671c115b0afb7adafb17552ff38f15dd60f31995c3d825e3d9298760a75babbaea935876e1e4acae0edf09b2fc0a12e425f00a6df0762d2f0da3bd5ce5df71cccec8e7fec94cc1e55293529f27c2aaced4084796445bbfd50618d6f8714c0532dc99cd00989bb74067cef3e14cf187fe8d7083a25ea65ac21f9eb16df88052d225df392eab03cab915d6636c6c6e452ee52e70f6c86c3d13b50d962513ba54dfbcf1e0a39bb80b1dc1cda79521d41171a94b728bd0b84983c1bebf3e8a949583a6e5dbd6c47c83f03d5ecdba491cf6287b67830f96458c4b1517671bd5e3eb472940391ed91f94731a257184d4ff5e6060752abd2a29464a19dbe80243ad815ae5ac82c1a88112e64864f7f04275386454829ac9f1cf146d5a1614027b8b560b85718d6ca45cac24667cc088ce9cbc6ffabc2b0dcd7857dd290177a51d624b7c11b929356dedd566758fa9ca9e2925a5cd9c440c07e18f6903048be6bc41482b1cd5a6a060747155143b80b51a2d440dbdf780e93caa45d2bc061a134b5a9f38b3ce179a4d213da29eea760604f701f797b437999f581876cebe2356f00414472b220e4e5e240cf47a57f3fe5bddee66464b748f78b667c3c6d7c6724a8e662d729bc10a518f55bf8c7e4bdf26c3b1f51866b918d5e9d7fde89154c3c3dbb17fc3b572b739d3924e4d34916e688aadd1a9b288cde1750fea9c5fa15eca58971aa1a2f9382d733d1cd08d914cac19cdaa70435a141c4690bc5c82142388e1bb6a84a2bfa5824dd4121277fe4ab0474b5c4040cb58023796822353e97e7e4fafa781e4a32b0224a443c71790a149a4227ef3975d1bb4946b95c92e470016d1789cb1def75f0782bc8a8058347f65d22eb91e266b6a8896585a7eabac2810b5e82e91166e62ddd95854b1b5c9161d6e3ec528ce3c18106a504b564c376bd576c3c0c08fa300d6513d7b0a114d4b29aac2e85f72c8529a0df9031d5150754a5100baf0035c0d1b2ff6df92cab91363d28ce39df64e1fa0bc51755e4dec446f89a5e7c45195541ca0a2fdc44c0db132190a969e44bc3b1366f7575be359b518bd5a5ac38a561485ec82c1b843e4c322dbca4066242ec9e06706fedb8fbc1bd1319d74805c1a1e909036ce0b1a3c5d308f0a26c217a255eb1e88e9297993d43eab9e749c895f947796bab0a794e8be6ddcb0001cbca1cd44487ebe2faf19d44ecb0f081b8669059cd77ab3fac12e89854f35cd1f5ca8e91e1bf00690946aa00abbeda42aab831fc724cabec74f246ac4cd25d2dabc142beb25a68156295ad67868da507e41f3a9f5f5c0c5cb0016d5850b2c816d048bbaf265ca4", 0x1000, r1}, 0x68) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x6, 0x10810, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000001740)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000001680)=[@clear_death={0x400c630f, 0x3, 0x1}, @reply={0x40406301, {0x1, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f00000004c0), 0x0, 0x2, 0x3d}, @ptr={0x70742a85, 0x1, &(0x7f0000000500), 0x0, 0x3, 0x3b}], &(0x7f00000005c0)=[0x78, 0x0, 0x30, 0x38]}}, @decrefs={0x40046307, 0x4}, @free_buffer={0x40086303, r2}, @request_death={0x400c630e, 0x3, 0x2}], 0xb8, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000005e870000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 18:18:57 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x2, 0x1) 18:18:57 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000"], 0x3, 0x1) 18:18:57 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x2, 0x1) 18:18:57 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) 18:18:57 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:18:57 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000"], 0x3, 0x1) [ 245.283106] binder: 12142:12145 ioctl c018620b 20001740 returned -14 [ 245.291921] binder: 12142:12145 ioctl c0306201 20000000 returned -14 [ 245.298970] binder: 12142:12145 got transaction to context manager from process owning it [ 245.307581] binder: 12142:12145 transaction failed 29201/-22, size 34654-0 line 3003 18:18:57 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x2, 0x1) [ 245.326416] binder_alloc: binder_alloc_mmap_handler: 12142 20001000-20004000 already mapped failed -16 [ 245.342882] binder: BINDER_SET_CONTEXT_MGR already set [ 245.348184] binder: 12142:12151 ioctl 40046207 0 returned -16 18:18:57 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) [ 245.379623] binder: 12142:12151 ioctl c018620b 20001740 returned -14 [ 245.408882] binder: 12142:12145 ioctl c0306201 20000000 returned -14 [ 245.415663] binder_alloc: 12142: binder_alloc_buf, no vma 18:18:57 executing program 0: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x4000000000003, 0x0, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$binfmt_script(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) recvmmsg(0xffffffffffffff9c, &(0x7f0000004400)=[{{0x0, 0x0, &(0x7f0000002800)=[{&(0x7f0000001700)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmsg$IPVS_CMD_FLUSH(0xffffffffffffffff, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x3c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) setsockopt$packet_tx_ring(r0, 0x107, 0xd, 0x0, 0x51e) r3 = memfd_create(&(0x7f00000000c0)='-}{usermime_type\x00', 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) sendmmsg(r2, &(0x7f0000001300)=[{{0x0, 0x0, &(0x7f0000001180), 0x240, &(0x7f00000011c0)}}], 0x249, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000280)='gretap0\x00', 0x10) perf_event_open$cgroup(0x0, r0, 0xe, 0xffffffffffffffff, 0x6) mmap(&(0x7f0000556000/0x3000)=nil, 0x3000, 0x2, 0x10, 0xffffffffffffffff, 0x0) r4 = creat(&(0x7f0000000700)='./bus\x00', 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r3, 0x0, 0x0}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000540), 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0xa, 0x30, &(0x7f00000007c0)=ANY=[@ANYBLOB="00000100000000000000020000fffffffffffffeffff74009606080000009500060000000000000035320173d9ff3406f5ecd4e458431edbb0624558e03b474321fa03fa70f199b0dc5520705ef2d6bdc003f1eb7aea8982fcad4c6d0afb4edb7fccb1636fa3df5f182875bb8ab21cf0ea1e1c41865110f792abf9555f2640e33c3f5e7e7b3245c17e9f7b1b87cee9985172191b4d51e206e3107b8b2d9024b098ada7b1e51d7bb3e7ecbbbe4d846b126410011398985a354c4b0014e2d343faa6f4a96bdff05dc4fc8e76d141734934ed502aea0e186ce95b2c9dce2af4721083951d4d3c029d94cba01c289a25e72a05291277c848132456a93062dc8e75fd73f9841153be6e83c7fe460dbcb5d5fe0b9a91453bfc3a87bb4786dfd60423a2005fba7f6cfd3c8bc0464c8a98d65058d1febba859a0f7a5f216e168c8f51fa2d49760c5f39aefc7388c649b1723b29e1d457d07430d1baf3997d634956608b76aff0e2fa1159db8b31e79163e8872c4e8ec17a513d1f68763aea5dafd60099e9c604d54d7"], 0x0, 0x6, 0x0, 0x0, 0x41000, 0x1, [], 0x0, 0x1}, 0x48) ftruncate(r4, 0x208200) r5 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x200, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/status\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r5, 0x0) pipe(&(0x7f00000002c0)) 18:18:57 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) 18:18:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x40000, 0x0) write$P9_RRENAME(r1, &(0x7f00000000c0)={0x7, 0x15, 0x1}, 0x7) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) write$P9_RREAD(r1, &(0x7f00000001c0)={0xe5, 0x75, 0x2, {0xda, "c49399af52c268ed1355d85d1dfd536376030cef7dccd079b80f5db65942b0572fb9ee1726c253675678bd22224ed49bfeb678c22732db685caa4b7548a7b2c021e6e82fb7f1b7f6a748154694b2b6ecf4d991cb2db197f99b3036440d0fa9fb915865b129b957cdccab74b094d71af3dc580df03641029d96f559f893927d099ee3d20cd459ae4465d97abe94cdef018911bedc3754b644cfd4675f297b396b66704b5437cb52484809f46490a1f37403a2fa79b12df2e6e67fcb5bbb9b6387b555216c96a57aa754264b4a09b0c95f174930ff266f02d0d1f4"}}, 0xe5) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 18:18:58 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) [ 245.429481] binder: 12142:12151 transaction failed 29189/-3, size 34654-0 line 3135 [ 245.454345] binder: undelivered TRANSACTION_ERROR: 29189 [ 245.460184] binder: undelivered TRANSACTION_ERROR: 29201 18:18:58 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:18:58 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="040007000000000010000200000000002000010000"], 0x3, 0x1) 18:18:58 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000"], 0x1, 0x1) [ 245.517812] binder: 12176:12177 got new transaction with bad transaction stack, transaction 310 has target 12176:0 [ 245.531594] binder: 12176:12177 transaction failed 29201/-71, size 0-0 line 3039 [ 245.541118] binder_alloc: binder_alloc_mmap_handler: 12176 20001000-20004000 already mapped failed -16 [ 245.550867] binder: BINDER_SET_CONTEXT_MGR already set [ 245.556288] binder: 12176:12178 ioctl 40046207 0 returned -16 18:18:58 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB], 0x1, 0x1) 18:18:58 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) [ 245.596242] binder_alloc: 12176: binder_alloc_buf, no vma [ 245.604794] binder: 12176:12177 transaction failed 29189/-3, size 0-0 line 3135 [ 245.617184] binder_alloc: 12176: binder_alloc_buf, no vma 18:18:58 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000"], 0x1, 0x1) 18:18:58 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x3, 0x1) 18:18:58 executing program 0: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) socketpair$unix(0x1, 0x4000000000003, 0x0, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$binfmt_script(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) recvmmsg(0xffffffffffffff9c, &(0x7f0000004400)=[{{0x0, 0x0, &(0x7f0000002800)=[{&(0x7f0000001700)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmsg$IPVS_CMD_FLUSH(0xffffffffffffffff, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x3c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) setsockopt$packet_tx_ring(r0, 0x107, 0xd, 0x0, 0x51e) r3 = memfd_create(&(0x7f00000000c0)='-}{usermime_type\x00', 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) sendmmsg(r2, &(0x7f0000001300)=[{{0x0, 0x0, &(0x7f0000001180), 0x240, &(0x7f00000011c0)}}], 0x249, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000280)='gretap0\x00', 0x10) perf_event_open$cgroup(0x0, r0, 0xe, 0xffffffffffffffff, 0x6) mmap(&(0x7f0000556000/0x3000)=nil, 0x3000, 0x2, 0x10, 0xffffffffffffffff, 0x0) r4 = creat(&(0x7f0000000700)='./bus\x00', 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r3, 0x0, 0x0}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000540), 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0xa, 0x30, &(0x7f00000007c0)=ANY=[@ANYBLOB="00000100000000000000020000fffffffffffffeffff74009606080000009500060000000000000035320173d9ff3406f5ecd4e458431edbb0624558e03b474321fa03fa70f199b0dc5520705ef2d6bdc003f1eb7aea8982fcad4c6d0afb4edb7fccb1636fa3df5f182875bb8ab21cf0ea1e1c41865110f792abf9555f2640e33c3f5e7e7b3245c17e9f7b1b87cee9985172191b4d51e206e3107b8b2d9024b098ada7b1e51d7bb3e7ecbbbe4d846b126410011398985a354c4b0014e2d343faa6f4a96bdff05dc4fc8e76d141734934ed502aea0e186ce95b2c9dce2af4721083951d4d3c029d94cba01c289a25e72a05291277c848132456a93062dc8e75fd73f9841153be6e83c7fe460dbcb5d5fe0b9a91453bfc3a87bb4786dfd60423a2005fba7f6cfd3c8bc0464c8a98d65058d1febba859a0f7a5f216e168c8f51fa2d49760c5f39aefc7388c649b1723b29e1d457d07430d1baf3997d634956608b76aff0e2fa1159db8b31e79163e8872c4e8ec17a513d1f68763aea5dafd60099e9c604d54d7"], 0x0, 0x6, 0x0, 0x0, 0x41000, 0x1, [], 0x0, 0x1}, 0x48) ftruncate(r4, 0x208200) r5 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x200, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/status\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r5, 0x0) pipe(&(0x7f00000002c0)) [ 245.643221] binder: send failed reply for transaction 310 to 12176:12177 [ 245.650849] binder: undelivered TRANSACTION_COMPLETE [ 245.656241] binder: 12176:12186 transaction failed 29189/-3, size 0-0 line 3135 [ 245.658819] binder: undelivered TRANSACTION_ERROR: 29201 [ 245.658823] binder: undelivered TRANSACTION_ERROR: 29189 18:18:58 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB], 0x1, 0x1) 18:18:58 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:18:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$input_event(r2, &(0x7f00000000c0)={{}, 0x17, 0x9d, 0x9}, 0x18) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 18:18:58 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000"], 0x1, 0x1) [ 245.733534] binder: undelivered TRANSACTION_ERROR: 29189 [ 245.739035] binder: undelivered TRANSACTION_ERROR: 29189 18:18:58 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB], 0x1, 0x1) 18:18:58 executing program 0: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:18:58 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x0) 18:18:58 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB], 0x1, 0x1) [ 245.819197] binder: 12211:12214 got new transaction with bad transaction stack, transaction 315 has target 12211:0 [ 245.841986] binder: 12211:12214 transaction failed 29201/-71, size 0-0 line 3039 [ 245.856063] binder_alloc: binder_alloc_mmap_handler: 12211 20001000-20004000 already mapped failed -16 18:18:58 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x3, 0x1) 18:18:58 executing program 0: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) [ 245.865879] binder: BINDER_SET_CONTEXT_MGR already set [ 245.871462] binder: 12211:12214 ioctl 40046207 0 returned -16 [ 245.878150] binder_alloc: 12211: binder_alloc_buf, no vma 18:18:58 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200"], 0x1, 0x1) [ 245.913033] binder_alloc: 12211: binder_alloc_buf, no vma [ 245.913049] binder: 12211:12219 transaction failed 29189/-3, size 0-0 line 3135 [ 245.928787] binder: send failed reply for transaction 315 to 12211:12214 [ 245.939826] binder: undelivered TRANSACTION_COMPLETE [ 245.946990] binder: 12211:12214 transaction failed 29189/-3, size 0-0 line 3135 18:18:58 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x0) 18:18:58 executing program 0: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:18:58 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB], 0x1, 0x1) [ 245.962486] binder: undelivered TRANSACTION_ERROR: 29201 [ 245.976421] binder: undelivered TRANSACTION_ERROR: 29189 [ 245.998323] binder: undelivered TRANSACTION_ERROR: 29189 18:18:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f00000000c0)={{0x2, 0x4e21, @broadcast}, {0x306}, 0x0, {0x2, 0x4e23, @local}, 'veth1_to_bridge\x00'}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000091eb786ae861076cc279749387b9cc40e895a0878d935e518fe790eb61d2823804b954fca06c636973a863d347463ed40542fce1e5b663207544b931e80858787f0edde700fff48fe2515830f9d5e79863a12b8680ff64c2ae511d3bad62512505b16c57113b2cc72f0f3a9dc47ce279ad2d3bcf8fe9a59526e16166788d5ae5cfe3cece09ae267651785a87b0d1c4bb5ed31d2f"], 0x0, 0x0, 0x0}) 18:18:58 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200"], 0x1, 0x1) [ 246.011706] binder: undelivered TRANSACTION_ERROR: 29189 18:18:58 executing program 0: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) 18:18:58 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYRES32, @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x3, 0x1) 18:18:58 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x0) 18:18:58 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB], 0x1, 0x1) 18:18:58 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200"], 0x1, 0x1) 18:18:58 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0/file0\x00', 0x4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr(0xffffffffffffffff, &(0x7f0000000380)=@random={'osx.', 'ramfs\x00'}, 0x0, 0x0, 0x1) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000140)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@dev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@loopback}}, &(0x7f0000001c00)=0xffffffffffffff81) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001c40)={'veth1_to_team\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001c80)={{{@in=@broadcast, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast2}}, &(0x7f0000001d80)=0xe8) getpeername$packet(r0, &(0x7f0000001dc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000001e00)=0x14) getpeername$packet(r0, &(0x7f0000002300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000002340)=0x14) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000002440)={@dev, 0x0}, &(0x7f0000002480)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000024c0)={{{@in6=@mcast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@local}}, &(0x7f00000025c0)=0xe8) getsockname(r1, &(0x7f0000002600)=@can={0x1d, 0x0}, &(0x7f0000002680)=0x80) getsockname$packet(r0, &(0x7f0000003d40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000003d80)=0x14) accept$packet(r0, &(0x7f0000003dc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000003e00)=0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000003e40)={'vlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000003ec0)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000003f00)={'ifb0\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000007300)={{{@in, @in6=@ipv4={[], [], @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@ipv4={[], [], @loopback}}}, &(0x7f0000007400)=0xe8) getsockname(0xffffffffffffffff, &(0x7f0000007440)=@hci={0x1f, 0x0}, &(0x7f00000074c0)=0x80) sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000007a40)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1040000}, 0xc, &(0x7f0000007a00)={&(0x7f0000007500)={0x4c8, r2, 0x109, 0x70bd2c, 0x25dfdbfb, {}, [{{0x8, 0x1, r3}, {0xc0, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r4}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r5}}}, {0x44, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x14, 0x4, [{0xec, 0x0, 0x3, 0x9}, {0x4, 0x8, 0x2, 0x1}]}}}]}}, {{0x8, 0x1, r6}, {0x44, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r7}}}]}}, {{0x8, 0x1, r8}, {0xf4, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r9}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xffffffffffffff01}}}]}}, {{0x8, 0x1, r11}, {0x170, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r13}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r14}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x80000001, 0x5944, 0x0, 0x7f}]}}}]}}, {{0x8, 0x1, r15}, {0x124, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x1ff}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0xcfff}}, {0x8, 0x6, r16}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r17}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}]}}]}, 0x4c8}}, 0x40010) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@bridge_getneigh={0x20, 0x1e, 0x303, 0x0, 0x0, {0xc00}}, 0x20}}, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x0) write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x7}, 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040), 0x0) [ 246.075753] binder: 12241:12249 got new transaction with bad transaction stack, transaction 320 has target 12241:0 [ 246.101445] binder: 12241:12249 transaction failed 29201/-71, size 0-0 line 3039 18:18:58 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x80, 0x10) ioctl$TIOCNOTTY(r0, 0x5422) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000000c0)=0x0) write$P9_RGETLOCK(r0, &(0x7f0000000100)={0x36, 0x37, 0x1, {0x2, 0x3f, 0x101, r1, 0x18, 'system.posix_acl_access\x00'}}, 0x36) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002f600000000200001e000000000"], 0x1, 0x1) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x80000001) r2 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r2, 0x6612) [ 246.134370] binder_alloc: binder_alloc_mmap_handler: 12241 20001000-20004000 already mapped failed -16 18:18:58 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2, 0x1) 18:18:58 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200"], 0x1, 0x1) 18:18:58 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000"], 0x1, 0x1) [ 246.179657] binder: BINDER_SET_CONTEXT_MGR already set [ 246.187566] binder_alloc: 12241: binder_alloc_buf, no vma [ 246.193628] binder: 12241:12249 ioctl 40046207 0 returned -16 [ 246.199869] binder: 12241:12257 transaction failed 29189/-3, size 0-0 line 3135 [ 246.214671] binder: undelivered TRANSACTION_ERROR: 29189 18:18:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x101000, 0x0) ioctl$TUNGETFEATURES(r2, 0x800454cf, &(0x7f00000000c0)) 18:18:58 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400f8a16f25000010000200000000002000010000000000"], 0x1, 0x1) [ 246.225135] binder: send failed reply for transaction 320 to 12241:12249 [ 246.242216] binder: undelivered TRANSACTION_COMPLETE [ 246.247416] binder: undelivered TRANSACTION_ERROR: 29201 [ 246.263480] binder: undelivered TRANSACTION_ERROR: 29189 18:18:58 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200"], 0x1, 0x1) 18:18:58 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000"], 0x1, 0x1) 18:18:58 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2, 0x1) [ 246.296348] binder: 12280:12285 got transaction to context manager from process owning it [ 246.306036] binder: 12280:12285 transaction failed 29201/-22, size 0-0 line 3003 [ 246.326490] binder_alloc: binder_alloc_mmap_handler: 12280 20001000-20004000 already mapped failed -16 [ 246.338294] binder: BINDER_SET_CONTEXT_MGR already set 18:18:58 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200"], 0x1, 0x1) [ 246.348831] binder: 12280:12285 ioctl 40046207 0 returned -16 [ 246.364403] binder_alloc: 12280: binder_alloc_buf, no vma [ 246.367284] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=12275 comm=syz-executor0 [ 246.367566] netlink: 4 bytes leftover after parsing attributes in process `syz-executor0'. [ 246.367600] netlink: 4 bytes leftover after parsing attributes in process `syz-executor0'. 18:18:58 executing program 2: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) [ 246.405983] binder: undelivered TRANSACTION_ERROR: 29201 [ 246.418397] binder_alloc: 12280: binder_alloc_buf, no vma [ 246.424783] binder: 12280:12290 transaction failed 29189/-3, size 0-0 line 3135 [ 246.438135] binder: 12280:12301 transaction failed 29189/-3, size 0-0 line 3135 [ 246.445867] binder: undelivered TRANSACTION_ERROR: 29189 [ 246.451494] binder: undelivered TRANSACTION_ERROR: 29189 18:18:59 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$VT_OPENQRY(r1, 0x5600, &(0x7f0000000080)) fcntl$getownex(r0, 0x10, &(0x7f0000000140)={0x0, 0x0}) syz_open_procfs(r2, &(0x7f00000001c0)='net/netlink\x00') ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r3 = open(&(0x7f00000000c0)='./bus\x00', 0x40, 0x40) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) madvise(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1e) lsetxattr$security_selinux(&(0x7f0000000180)='./bus\x00', &(0x7f0000000240)='security.selinux\x00', &(0x7f0000000100)='system_u:object_r:mount_exec_t:s0\x00', 0x22, 0x0) execve(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) dup(r3) 18:18:59 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000"], 0x1, 0x1) 18:18:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x400002, 0x8) fcntl$F_SET_RW_HINT(r2, 0x40c, &(0x7f00000000c0)=0x5) 18:18:59 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) pivot_root(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00') r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x8000, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x1428) 18:18:59 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000"], 0x1, 0x1) 18:18:59 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000000000"], 0x2, 0x1) [ 246.526144] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=12263 comm=syz-executor0 [ 246.528149] netlink: 4 bytes leftover after parsing attributes in process `syz-executor0'. [ 246.528540] netlink: 4 bytes leftover after parsing attributes in process `syz-executor0'. 18:18:59 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000"], 0x1, 0x1) 18:18:59 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) 18:18:59 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB], 0x2, 0x1) [ 246.590270] binder: 12324:12328 got new transaction with bad transaction stack, transaction 328 has target 12324:0 [ 246.615469] binder: 12324:12328 transaction failed 29201/-71, size 0-0 line 3039 18:18:59 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x401000000001, 0x0) close(r1) r2 = socket$unix(0x1, 0x801, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f0000003000)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) listen(r3, 0x0) connect(r2, &(0x7f0000931ff4)=@un=@file={0x1, "e91f7189591e9233614b00"}, 0xc) r4 = open(&(0x7f0000000400)='./bus\x00', 0x1141042, 0x0) ftruncate(r4, 0x2007fff) ioctl$ION_IOC_HEAP_QUERY(r4, 0xc0184908, &(0x7f0000000040)={0x34}) sendfile(r1, r4, 0x0, 0x8000fffffffe) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FICLONE(r2, 0x40049409, r0) syslog(0x0, 0xffffffffffffffff, 0xffffffffffffff2c) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000e80)={{{@in=@local, @in6=@local}}, {{@in=@broadcast}, 0x0, @in=@dev}}, &(0x7f0000000f80)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000005040)={{{@in, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@dev}}, &(0x7f0000005140)=0xe8) [ 246.633211] audit: type=1401 audit(1544897939.129:86): op=security_bounded_transition seresult=denied oldcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 newcontext=unconfined_u:system_r:mount_t:s0-s0:c0.c1023 [ 246.654128] binder_alloc: binder_alloc_mmap_handler: 12324 20001000-20004000 already mapped failed -16 [ 246.661333] audit: type=1401 audit(1544897939.149:87): op=security_bounded_transition seresult=denied oldcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 newcontext=unconfined_u:system_r:mount_t:s0-s0:c0.c1023 18:18:59 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000080)={{{@in=@multicast2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f00000001c0)=0xe8) lsetxattr$trusted_overlay_upper(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.upper\x00', &(0x7f00000003c0)={0x0, 0xfb, 0x98, 0x3, 0x6, "9e541410d516491d3c12c3b9cc678cbd", "cea407f24894ab82b1023184d54f6ff43708958641f3205efe9b3d90195c8b25503e752398d7d99970ab67a6dc00cbd29c8d0f9f10ff127b5501bcc1af84244f0f609b10c03f3f0ae071f2cfa62fc13b150059b11f33ff4ea0f1bfaad35af06ccd7eb4fbf37a7d405e52c0d23fa5c109588e322ebc8c170e53c681945b7fd291bb55d4"}, 0x98, 0x3) fstat(0xffffffffffffff9c, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) chown(&(0x7f0000000000)='./file0/file0\x00', r0, r1) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:18:59 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000"], 0x1, 0x1) [ 246.698057] binder: BINDER_SET_CONTEXT_MGR already set [ 246.707681] binder: 12324:12328 ioctl 40046207 0 returned -16 18:18:59 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) [ 246.766042] binder_alloc: 12324: binder_alloc_buf, no vma [ 246.798505] binder: 12324:12360 transaction failed 29189/-3, size 0-0 line 3135 18:18:59 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB], 0x2, 0x1) 18:18:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="11634840000000000000000000ff070000000000000000000000000000000000400000000000000000000000000000000000000000000000000000002000000000000000000000a9446ced00"], 0x0, 0x0, 0x0}) 18:18:59 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) 18:18:59 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) 18:18:59 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) [ 246.809763] binder: send failed reply for transaction 328 to 12324:12328 [ 246.823929] binder: undelivered TRANSACTION_COMPLETE [ 246.840657] binder: undelivered TRANSACTION_ERROR: 29201 [ 246.854107] binder: undelivered TRANSACTION_ERROR: 29189 18:18:59 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr$security_smack_transmute(r1, &(0x7f0000000340)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000380)='TRUE', 0x4, 0x0) openat$keychord(0xffffffffffffff9c, &(0x7f0000000200)='/dev/keychord\x00', 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80002288}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=@getneightbl={0x14, 0x42, 0x400, 0x70bd26, 0x25dfdbff, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4011}, 0x40c0) sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) [ 246.861350] binder: undelivered TRANSACTION_ERROR: 29189 [ 246.880137] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 246.910651] binder: 12371:12376 got new transaction with bad transaction stack, transaction 332 has target 12371:0 [ 246.942364] binder: 12371:12376 transaction failed 29201/-71, size 0-0 line 3039 18:18:59 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) 18:18:59 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x14) socket(0x4, 0xf, 0x8) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000001c000101000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="0e200cd4a36c0326aaf59b6808e5faaef5c0be291018d2496f09000000e1000000000000eb97ef9b7214f71d4e2596acfa23ce8e1934bf14472770707b3097f5631430a19d745e7819d5902f07bb84a4ba0f5ecb46fc45d355358fe5e9874321a273f1e11e7f4f391288ea50c2431ebdc9cb456e6bb9ab12d69c341f7d49e617629cd51644cce9537cb9dc9c73a8d3b41ada5124e6aa93c31114b150585f0447aea54f153c76d8b705e257f32050a840de5e117cc68279b759ddbe158a06547c655995c513964255794145070163cebac3c5274b089efff81a3f55bb72313f1ac6f9d2ab6739e901a14e32e6d319747a4a4c949b547eef647ce5ff47fd6dec556551d2"], 0x1c}}, 0x0) 18:18:59 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000"], 0x1, 0x1) [ 246.953402] binder_alloc: binder_alloc_mmap_handler: 12371 20001000-20004000 already mapped failed -16 [ 246.965643] binder: BINDER_SET_CONTEXT_MGR already set [ 246.978354] binder: 12371:12376 ioctl 40046207 0 returned -16 [ 246.979666] audit: type=1400 audit(1544897939.469:88): avc: denied { create } for pid=12390 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_rdma_socket permissive=1 18:18:59 executing program 0: ioctl$sock_ifreq(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) r1 = dup2(r0, r0) fremovexattr(r1, &(0x7f0000000040)=@known='system.sockprotoname\x00') close(r1) 18:18:59 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB], 0x2, 0x1) 18:18:59 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) 18:18:59 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="04000700000000001000020000000000200001000000000008182e3b0105877eb6fe932c3fb55813772fe3eb42ae69059df2f6610d1b8f5c9779ff3295f6ee340dae91092da674c501a7ecb205cfaa7f688a34b9f2bb7f6383a493dcc4d6300cf4ccd9bbe33a1fdb384934d64d8dcc1e02bdd3acad4090ae78f56596e6ee47608b9b218e36a88e6d420c9d1e2b1d715044dcf1d0ce76938e542f7c81010ee0881d25b1e9fd160c79c510f818e2f558c84dbf45d48cd4c6fcf502e06fe3b04f3ca47ece3d3390d333cb934a64fa0c897cab73b77c375ec43030225a25fe0291317a49e50f6b07e2abead41fda18a5aa9595ebcaf4675becd2e6c2b6ef1856fb57d5cdc5e843a188131c109e098d91"], 0x1, 0x1) 18:18:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) epoll_create(0x8) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket(0xa, 0x5, 0x7) getsockname$unix(r2, &(0x7f0000000080), &(0x7f0000000100)=0x6e) getxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000002c0)=@random={'trusted.', '/dev/binder#\x00'}, &(0x7f0000000300)=""/36, 0x24) r3 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000340)=[@enter_looper, @acquire_done={0x40106309, r3, 0x3}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0}) [ 246.985550] binder_alloc: 12371: binder_alloc_buf, no vma [ 246.985575] binder: 12371:12388 transaction failed 29189/-3, size 0-0 line 3135 [ 246.985984] binder: undelivered TRANSACTION_ERROR: 29189 [ 246.986025] binder: send failed reply for transaction 332 to 12371:12376 [ 247.018886] binder: undelivered TRANSACTION_COMPLETE [ 247.018908] binder: undelivered TRANSACTION_ERROR: 29201 [ 247.018911] binder: undelivered TRANSACTION_ERROR: 29189 18:18:59 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000"], 0x1, 0x1) 18:18:59 executing program 0: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) 18:18:59 executing program 0: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) 18:18:59 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000"], 0x1, 0x1) 18:18:59 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000"], 0x1, 0x1) 18:18:59 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200"], 0x2, 0x1) 18:18:59 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)="6eb1b83907", 0x12, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002e7000000002000010000000000"], 0x1, 0x1) lsetxattr$trusted_overlay_redirect(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.redirect\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x2) [ 247.180330] binder: 12405:12412 BC_ACQUIRE_DONE u0000000000000000 no match [ 247.194019] binder_alloc: binder_alloc_mmap_handler: 12405 20001000-20004000 already mapped failed -16 [ 247.195155] binder: BINDER_SET_CONTEXT_MGR already set [ 247.195165] binder: 12405:12426 ioctl 40046207 0 returned -16 18:18:59 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000"], 0x1, 0x1) 18:18:59 executing program 0: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) 18:18:59 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x0) 18:18:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x80000) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0xe38d4e6944e932c0, &(0x7f0000000080)={@loopback, 0x0}, &(0x7f00000000c0)=0x14) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000100)={r3, 0x1, 0x6, @remote}, 0x10) 18:18:59 executing program 0: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000040)) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x4, &(0x7f0000000100)=0x0) r4 = epoll_create(0xffff) pipe(&(0x7f0000000080)) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r5, &(0x7f0000000180)='net/connector\x00') r6 = dup2(r4, r4) io_submit(r3, 0x2, &(0x7f0000001680)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0}, &(0x7f0000001380)={0x0, 0x0, 0x0, 0x800001, 0x0, r6, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff9c}]) [ 247.265768] binder: 12405:12412 BC_ACQUIRE_DONE u0000000000000000 no match 18:18:59 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200"], 0x2, 0x1) 18:18:59 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x0) 18:18:59 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) openat$cgroup_subtree(r0, &(0x7f0000000100)='cgroup.subtree_control\x00', 0x2, 0x0) futimesat(r0, &(0x7f0000000080)='./file1\x00', &(0x7f00000000c0)={{}, {0x77359400}}) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)="11d0736163636573730000000000000000f4000000000000", &(0x7f0000000940)=ANY=[], 0x0, 0x1) ioctl$KIOCSOUND(r0, 0x4b2f, 0x200) ioctl$VT_RELDISP(r0, 0x5605) fchmodat(r0, &(0x7f0000000140)='./file0\x00', 0x80) 18:18:59 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000"], 0x1, 0x1) [ 247.355004] binder_alloc: binder_alloc_mmap_handler: 12444 20001000-20004000 already mapped failed -16 [ 247.374854] binder_alloc: 12444: binder_alloc_buf, no vma [ 247.374912] binder: BINDER_SET_CONTEXT_MGR already set [ 247.374921] binder: 12444:12453 ioctl 40046207 0 returned -16 [ 247.392192] binder: 12444:12457 transaction failed 29189/-3, size 0-0 line 3135 18:18:59 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) r0 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000000)={0xa, 0x0, 0x0, @local}, &(0x7f0000000080)=0x1c) open(&(0x7f0000000140)='./file0\x00', 0x10000, 0x154) fsetxattr$security_selinux(r0, &(0x7f00000000c0)='security.selinux\x00', &(0x7f0000000100)='system_u:object_r:urandom_device_t:s0\x00', 0x26, 0x2) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:18:59 executing program 0: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000"], 0x1, 0x1) 18:18:59 executing program 5: getcwd(&(0x7f0000000080)=""/137, 0x89) r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 247.400318] binder: undelivered TRANSACTION_ERROR: 29189 [ 247.405811] binder: send failed reply for transaction 337 to 12444:12453 [ 247.417455] binder: undelivered TRANSACTION_COMPLETE [ 247.422768] binder: undelivered TRANSACTION_ERROR: 29189 18:18:59 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x0) 18:19:00 executing program 0: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000"], 0x1, 0x1) 18:19:00 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200"], 0x2, 0x1) 18:19:00 executing program 2: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/mls\x00', 0x0, 0x0) connect$unix(r0, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) r1 = accept4$unix(0xffffffffffffff9c, &(0x7f0000000080), &(0x7f0000000000)=0x6e, 0x800) bind$unix(r1, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e21}, 0x6e) 18:19:00 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x0) 18:19:00 executing program 0: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000"], 0x1, 0x1) [ 247.505372] binder: 12471:12476 transaction failed 29189/-22, size 0-0 line 3012 [ 247.526557] binder_alloc: binder_alloc_mmap_handler: 12471 20001000-20004000 already mapped failed -16 [ 247.536394] binder_alloc: 12471: binder_alloc_buf, no vma 18:19:00 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) [ 247.552782] binder: 12471:12481 transaction failed 29189/-3, size 0-0 line 3135 18:19:00 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x24) r1 = memfd_create(0x0, 0x7) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) ioctl$SNDRV_TIMER_IOCTL_STOP(r1, 0x54a1) accept$packet(r1, 0x0, &(0x7f0000000000)=0xfffffdb6) sendmmsg(r0, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="3284e6ccb268d61dd61e8892aa6b8f2d327afa8a1b8787cdb3b0946d795b8ac25fc0e83289c12851ecf4122ad30f36c55f7892ea234568df260ba1fa47d94cbfa0a7c45ff5efe5832a23ead6a8f0be27bc"}, {&(0x7f0000000400)="5a02ac4866a9a9b8fa72ec70ae1019467ee449228d76f1f131d13c891c89a0e263d122c5663f6430c9b3c26d9d65140c72bf2a550200000009ad86a592241747ccdf2b524a437e7ed28d0453c16b4f917ae65cd896d66c52bb23c83978b6139ca47c6569b96fdfb73b3b6eb55d70ddee33e0bf4399dcd3dcc7a859ce8b8eb64da83c628cccd515fb83e0a744228f44e7cfad81e2ffedcb1d28396f346c93b7"}], 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x1000000000000237, &(0x7f0000000140), 0xfffffffffffffdfd}, 0xfffffffffffffffe}], 0x199, 0x0) socket$netlink(0x10, 0x3, 0x3fffffffff) accept4$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x8, 0x800) openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/validatetrans\x00', 0x1, 0x0) 18:19:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="116348400000000000000000000000000000000018f9337b4a23cf3a00000000000000000000000000000000000000000000000000e6a3000000000000"], 0x0, 0x0, 0x0}) [ 247.580350] binder_alloc: 12471: binder_alloc_buf, no vma [ 247.586359] binder: undelivered TRANSACTION_ERROR: 29189 [ 247.592212] binder: 12471:12476 transaction failed 29189/-3, size 0-0 line 3135 [ 247.606839] binder: undelivered TRANSACTION_ERROR: 29189 [ 247.619824] binder: undelivered TRANSACTION_ERROR: 29189 18:19:00 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x0) 18:19:00 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) r0 = socket$inet_udplite(0x2, 0x2, 0x88) fdatasync(r0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000240)='/dev/keychord\x00', 0x0, 0x0) ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000080)=""/241) ioctl$UI_GET_VERSION(r1, 0x8004552d, &(0x7f0000000000)) 18:19:00 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x28, &(0x7f00000000c0)=0x8, 0x4) recvmsg(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) syz_emit_ethernet(0x43f, &(0x7f0000000700)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff91001e008100170086dd60c22df704011100fe800000000000000000000000000000fe8000000000000000000000000000aa00004e2004019078000087ae00ca83452b00b32def4f1142b6793bb530f9b20e90aa25d5c2b9431efd840a07c1922833b2c789aefbbaee9f63cbab38a8acfb8dba0595ecb683e74ea2bc44a7aee9c52e18ca01c06a5c354712b8b1ff75f45ba55a3487c83849023d37e037d2d3e3e842e9ba099e9ed8775d1173d8e78335aa65d58f54c1d78d4fce897cfefa24b7f268f90be76c7f4e1bfe4d84a869353e931c3732afea55697618a1318ecb657b34172b93fd59d7988d43630cf81e976a0ea01fd8b2547ab593bc605c985f56664b84ed3c9f90ffb666e030c794e2d2d5070af38d83dc275da88cfe6910b2ded59f6c418af5d247237eceb14857c1d7c3ee32e729d9793040f8f4e432eb875a89fe31cbed117f0e76643797169fba3dac3f377d145ce97980ba626da7a279e698a9e040a22d63c535f0ee06adb59e9e06ad7295e6601f3a5fe9b581975993c6c775734212bccb26288d42a672c965d40e80d0e1908f04425a60a08241378ec7ff88315de073b64c5f9647e51732be34988e0948f12e6c560bedbece811bca501d4389dbfe20e4df5160cd7324c0670c7b3e8980b061e31b1c8461d6f7a63f9e9fd24326924c076e01631a0b9703a6106accfaa064075fa1f16e16c5171b6a324e8642b2ab76618b824110c312ab12d9f65d6a980634a6a7cba8bf89e01a91259f446232476a1c490982636b78d1300befab1a2f6e8261e07336c5692db37bb7d3cebf4a942b62f2fa6cceb7e488aa02b2e52c6f82bd3792845fff41cce52e0469d14821ce11491864860c11421a92dae3152eb2310687c679d2b1f0a9809b56abdcf893f9531508f24e64ec911fd8e8b3c8fd2291f1a7b910222c38533d4caadac9acd194be7e53549c1719bdf668887a0e19db83b5356f8f7d93cbef1ef3505dcc40d0d2a02a2745ab518979b9c3774babfe8e70ead767c7a00289b8cc6e51d1a957548270cb3f5064961a88f61b34f9442d78ae5a8551713f9afb4269d689f9adb6b4a902a637184f7f899efe9fa0ddb45cd1076c4eeeda51ca8dc20dcfc9cc5f56768073b3f4c2c9f543324a4fd0b8bc7b95e232bf85bf222394fa4336ab4007d7ad2dc85afa6eb79ad2624c4be6c674ee98fce9a51786b7cc2b5044de114d36d2690e13bcedf96590c7d5aeb8040b74c4d6a5aa38a7c1f0857522f4f968795056b9a7034dc3444784f9486b575e44dec3216d72845500e63297d7197961e7e593ea3411001d1d47ba42d70e7af8e91246c02d7e37ff0eb60abebc37dd00315b4fbb09e77a6b5f7e8441818ebcfafecf622731f1db8a11fa2de8e30d808bedbfee104b3b1100f5094675521da07dd2a28be7e486b325a0f0e6d75116be1bbc2aa20deb64a6e4e7b824b12d009e6f1802f5a8e31559b125d71d00a5684fbde4668f5af1eb4ca04fa7c4ef4d2a194b0856e0076263085f59ecbd428dac3a44ba1509b45c4a26c5837ff6ce581ab778c56dcda955e854b80cf09a069c9552c8fc7e068bfd532aedb33b43ec7f9c755552f72f99852d98c7eaa6698af958098bbf243519ba0b17560ecf375dd4f0ff8ba7bb400e320c3969e8669cfccca97c4fa19048c41291f34b50ae65ffbce9bacfb8c195c10a7eb47f69f9c56c6571f595375bd30a04cd44efc8fd"], 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) 18:19:00 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000f9aa06ff7615a562f557982548977ab85417e11427d2c92ef9d5353e35c42a489595e4212cd650a9a5951034257b519bb0f9d76015d31fa8ac88ad917e209c2f4b225d482cc93a46d2f3a7c568e90869f1d855c4c077f0067d3f8ff4252972c38722cb531101a751f18990599f465ca773eba4f05858b710ed"], 0x1, 0x1) 18:19:00 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000"], 0x2, 0x1) 18:19:00 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x0) [ 247.686690] binder: 12502:12506 got new transaction with bad transaction stack, transaction 345 has target 12502:0 [ 247.711273] binder: 12502:12506 transaction failed 29201/-71, size 0-0 line 3039 [ 247.720770] binder_alloc: binder_alloc_mmap_handler: 12502 20001000-20004000 already mapped failed -16 [ 247.730636] binder: BINDER_SET_CONTEXT_MGR already set 18:19:00 executing program 0: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='net/udp6\x00') ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000000c0)=0x0) perf_event_open(&(0x7f0000000040)={0x3, 0x70, 0x3f, 0x91, 0x400, 0x5, 0x0, 0x0, 0x18000, 0x7, 0x33d304f0, 0x4, 0x7, 0x0, 0x1, 0xa2cc, 0xffff, 0x40, 0xff, 0xfffffffffffffffc, 0x1ff, 0xdf0e, 0x7, 0x8000, 0x80000000, 0x9, 0x1, 0x0, 0x101, 0x6, 0x0, 0x1, 0x3ff, 0xd1a, 0x4, 0x9af, 0x0, 0xffff, 0x0, 0x5, 0x5, @perf_bp={&(0x7f0000000000), 0x8}, 0x4008, 0x9, 0x6600, 0x9, 0x0, 0x4d4, 0x73af}, r2, 0x10, r0, 0x1) [ 247.730661] binder_alloc: 12502: binder_alloc_buf, no vma [ 247.730685] binder: 12502:12512 transaction failed 29189/-3, size 0-0 line 3135 [ 247.749041] binder: 12502:12506 ioctl 40046207 0 returned -16 [ 247.749044] binder: undelivered TRANSACTION_ERROR: 29189 [ 247.749088] binder: send failed reply for transaction 345 to 12502:12506 [ 247.755366] binder: undelivered TRANSACTION_COMPLETE [ 247.755375] binder: undelivered TRANSACTION_ERROR: 29201 [ 247.755378] binder: undelivered TRANSACTION_ERROR: 29189 18:19:00 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007003db90a7fb0aba5e7000000002000010000000000"], 0x1, 0x1) r0 = geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) chown(&(0x7f0000000000)='./file0\x00', r0, r1) 18:19:00 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x5) ptrace$cont(0x18, r1, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x1, 0x0, 0x0, 0x3}) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x480000, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000080), &(0x7f0000000140)=0xc) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x3) 18:19:00 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) 18:19:00 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bind(r0, &(0x7f0000000080)=@vsock={0x28, 0x0, 0x2710, @my=0x1}, 0x80) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040000100002000000000020000100e60000000000000000"], 0x1, 0x1) 18:19:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x0, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f00000003c0)=@req3={0x0, 0x3, 0x9, 0x7, 0x6, 0x1, 0x4}, 0x1c) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f00000000c0)={'filter\x00', 0x4}, 0x68) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r2, &(0x7f00000002c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x44, r4, 0x208, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x800}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x14}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2000000000000}]}, 0x44}, 0x1, 0x0, 0x0, 0x40041}, 0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000400)=0xffffffffffffffff, 0x4) 18:19:00 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x0, 0x0) r1 = accept4$inet(0xffffffffffffff9c, 0x0, &(0x7f00000000c0), 0x80000) getsockopt$ARPT_SO_GET_ENTRIES(r1, 0x0, 0x61, &(0x7f0000000140)={'filter\x00', 0x9a, "24c231cde208f9767bbc3bbae53e2f66cda53a95f715a2bccc5f7c01a72a896962a88b4931aae1bb0f23f99f437d112c93d6456b07d6ee937c04a243e84936ef1da4949b080b077c182f7a627605d8b5bb870161f7e319557c911424cde331e15d5a4fd6a9759a06984b7e8f6d221a803b10e505ff645a5cd7e5d1e85606bfcb3b9237bbd369c0afb263da5ec056c670358586a7d7fd0cd20b76"}, &(0x7f0000000200)=0xbe) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000000)={{}, 'syz0\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, &(0x7f0000000080)) 18:19:00 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000"], 0x2, 0x1) 18:19:00 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) pwritev(r0, &(0x7f00000025c0)=[{&(0x7f0000000000)="1a856535a4ceff441dacbeea79e6a333e29a9390f687932e5b659c6fc4ac7c9bfec419cc1701bebd3dac4bc0ae6119f1a0806da611a7072bd5ea1cb87cc5fe323e41997e690c1f5491456440d843e39f18fcb884cb7443eca10d14b5448a2980357ed5b726fe3278b0a198773eb27ce648e57b1cd97482f2494463d5e51dfeeffc3894e5ee644b96942042b40244d064cca805fe84e6c428ef187e07c819fd0eb9141b10a7ba77a28530ab8dcfa5d463d6f3ecc9898825dcfa5e6f1123e31f673dd5899f4282", 0xc6}, {&(0x7f0000000100)="64295d54acd037123752e8654d2bfeb2053424ba60b8106ae8d93d9a531b4cf4f86737b14f6c138d2029f8ba898bcfbb90e44b1e32c5ef646d76932b5b2e9182eedf6fa381e113471593dd53c027fb13802a992fa31774d9f3ca0f71a48cc691362700be7bb192533dec65e9d6721fcc440e4582ca5a3c9157273aba956084c59245ce098a1eefd76868b3ff433007a6164d554dd4caab28a525fc2931d2ba0188c314eab3d87b9c8d14c8a19f0b91c632145cb1b32b9a6da920ec896a79dc7adaec3f19dfc4d0954197f67d69af1f5f946e77fbccd2e2833ee7d0ac177532", 0xdf}, {&(0x7f00000002c0)="e1e08d697cb20aaf40d2d88759aa7fa7264a0a60b9a1055ab96ec41d1cf19d1b3c709fe5c691c63fec48cdcbd9acc12039814e4b13b52364e6beaab933d4a199b0295da3a15aa1d8f6e22fef2457fb7580672bb2e21865d6e47fbbeb82b2d5e560dc325792d2964ed3ed7a32d7061cf478bb22104e366195ceed38c527606ddd027f008b6e7b99be06a1a8605f2f51e5da6399da72e919ae22ea6f7d4a1cd9171abb9489e3a8f4205ffb1a6ac7685f0c8b3a2a5139743d9e0c82ff874db36401c73cf007ad45bb351b84bc602e1f9ef887c0674fd740b6592bc95f5c493d12f2c2becaa4cc1adb4f32949096", 0xec}, {&(0x7f00000003c0)="936805181203122fc000039dbe4064c3d446badf6beade3cc3b345ef031640f3f7306c0a0d9efb87c1d53e045138fb42f6e6d9c7f0a89f1d22342ef1b76760547300596e8fe1fe26ac2d5194635ffaee76227e51b317bcbb22e8cc82d2a94b52a862c9266c5cb675b17fb059d17455038944263b8f88d6052f606da497e6e122e60844fc9994685c369055957c113c307a49248b5a2286", 0x97}, {&(0x7f0000000480)="1c1836782d949297623811f65654d65959bdf555589789962acfac6792121268ac763f38da0024354d8084ed511f884bbb29acedb547ceb00c1c3d994e081bf1ccaafa9bcedefe316a5465e1a00fcaa7c01082f165479eb70372f9a3152d1b42013c7e298e4c57758c1807362342160ac8f4155ce10c659df32407ea6c7ae3bf4433a46457b119221b858a938f0338ece517aa059f0308e2e44586aa2b0f5063744a96176a0f9fa79905615e52bf09ac9fa8cd32424d948ce01e3f2423961d299700b3c3f3686572ef50343656a38bcf0042b5b2eb383389ef32a31e6765b5845837b37cf3fd29d34f86f5318e31bf9d248bc08983fd5f56a82ac32b5ba7487e5e216e28d35c6afb976f9f0f46eb6f08a5d64c0b19c645bbf506d96b972f4bb98849e14d50cd17f0c2dcb2c5cd69f7922497f8f10dbf610168a41256849ff276c6ed00b309aabf89d21c6b74fbe4d7082a92d25a09ace07d32f6c2e07a5f166c502070b2434a220150dde4e3bdc34f06b27f879b02a566120a16fcb02b44a2112533bb7dbbee97a0c7455d7c270a8765bfcb8157c9587855122232cf4fc51fbda94546c9a3978bc849341cc660853a1ac2d194d42a5dd15d723ed17c3aa1f29d3d36f693c9d6b59aa5f3215253e39720c655411787c8af20515a3b13731a57d0be0458f5a5e368a093fdd19ea6293bf489a96fafbfeae3039a402f944eb165ee8fdcf221def6fdb8c5370cc25207d49913c1806816497ee84c4a875bca69d33c8b787f975dc2290ee2616290e149aefc1359bd3750da123d2c516588cbfcc96437bb7dda14f4c8a6fd01387bb2ba30480c42ff3ce383f3e3152d3ff1fd45dff421610affef9b4443b543ec183551b8702a4575c84acce14dd1fd4477f5d02bfc7df1b8619c27dab3938e044dcfb3905d3ad22071c5899ea3bc05deac8542fc5410b9665036c88ae2a97704d3df1a6ce0cd2c37ab11424e8e3b43d732f37cc73c5741fa222182d25e767974f5be50abba925292d7a02f73a9beaddd8dcd37a3db536bba98c8a0eacaa5dceecb17ac073ce86909f7f9adc54de519a7fdadf78cb03f20c1dabf5e927d08fc9f8154585d05965c0e356f7383ded7055c2f586f306b9ac68574d17cbb6d398181ddff5638d47e402b6bcf914b18418580caf597ce0634c6d6b1347aad61c42182f4b98a9aeeeff84501d7734b70d0c12d9322fb398f697a6ad2984e7e8b53b53c86dc6d4e85cb6d6c24c6345739498faf8447800a41b90c93c69562bda32a83c312e0ed62509376e3c621fe284257a6e588edc129564b3a852a1b841371c02779da905c4b26e7e2146ffc1745bcd86b587e32f687bd003ddf7af634439f6c202695f5438379bbdeddfdc78795dc7573299f3a6161d1ee4ed04dc637cf3aee1c290598559c62a7d5c383f141f6fdedd8ac3e903769b0822f32ad8e85760f8101e00882e8114f81d3f4eb3791bc04bbda79d92346f69a3b8cf0d80b250d28d1f858af13f090f7c1dbdd0c3d819c0dc87594f5f85726f7d8d636d04e3831df16132427f3318c57afa476959b177e48a1f3b5d1a61f7829cae21a24f8d52c10a8dd83809af7954c51eae3811b1637cbd5da1107f0b0a9d9fd4a04cae6ef42399bac1f91cdf67d1d9b7643e4a0a7a0e9f5900b8e0ea951990b1150f7bae9a42644902197431e0a35994b7769ae0e68299e0019771f70516d88f2e1030b405afb00c5848dcfeb66b10376052947d781149db1971c65213f006b733f7924a23b286b79c1f853cbbf9ca30ebf95d764db8b3fcdc9ae4894aaac1c0e25f94b7b239f74f1ac8c59fd1737ddbada44efdd14b2525933d3844a2468907bf6156e0af0327d2fcf382acf0188edcd6490077fceccd5af8625e7b7cce4627b74a6ac274c42e9b740aba1ff940f60e2ce307e138516f9be10d11e7fe1cb78707e36f32d9486444175092903250e85d81789977bb30316040ddcf0cb623012d65fb5fdd784704d57b8115d2985281a28b5d45c320884bf1b7615299bfdb1e47127775e4e08640a7884c519a99741915113286b055a75e7722443937dad73b0031d0fb72d9abbdedb86f6e46df51cdbf416a8386279a48bb049cc0dd92d1fbd963d9b8b047aac9860c37809c771d3764e3960774ce493ce5002aeba7c210ad62839da19ebd69bb3b9a75a0b94ba918f317e21109138fc0bcc70df82e0ba1875bc35d079337c80d279ee291608c3e0476e78be9d03e765a5a7cf0a998ba0efd6bd1b2ac7d7babde9ffb41e7a841973b925ff65e7a224391b95f5d1e20bb0173e938f5db5f5230718d9c693ba30ce629f6c5cb6c7b0325060be1a9850209e609b75b123aea5a485fc6eb420cc80c3240bf0e29c379ae44ce5e14cb06884205eff51f9040c8d111e97e3436946b5f3ac555a06c38fdc96aa58c0492ae591d26223ac760bfd971602526af2bf3a28c9fe5e94853926eef86f95efe276a78e47f367dfbffd987a9c1450ab4116c28af7c895007ade422cee703ca4eed2225b617de4c746f44a1c722923f0e845cdc4b2ba554e92e7e98114759bcc30c7ca5d014284703589616b8d38c190593fcbe891bd8f7ae57da7fb4719316995544a55082e5487e79c60d82b52de66a022d5582843fe9552f38fa263f98bb2aefdb224303681de1f4be10b42992bc7224ecefa428dd218d87e3acaa775614cac4bdddf995fde9682cac0b7e2af8030f6446751a88b2e0005b9a27d727a3482949bd7986425a080968ec483ddce03258deeaffd938140cd81781892a40bdca8b561e927816b1dd491faf02363dbebcdca732e0aa0583b3b350e86b19a2c065f47e28a9d58dcd4bd4a8310aa5f46c74d003f9f2cb6611c1db41b2fa0ff5b30c7c06bb2bf3cdb3abd78d92c4b90f9e8c069077bba9cf3cff7efb1f9a4915a9b47347bc27b3863be735e4914833df25022c21435bf79dc379a196decdb1018e80b5c6719f8074f54cc16718122a7e07af5e29f1bbc287f7d8de85fe9456bfaa2e1155b9ff763ff6c37706cde663e16b3330cba916db6bf67ff0030dd19074d669ba7a42f8912b74907e951b1b74a79ee5076c353a1bfe0cd57541fcea71d88574f3a8fd007417f494a2acd905c3b5b79e9a10e1ff10c1d4ba0e57e31e9bdf863f9f670f95f14d215cf2b376d3b99bde4a33b6f92b88a21d87a8a58aa2274c49906661a93cc6a3bceec5ee4b32b36979bba8013634ec264cdb75a811df5f7442713fe69c4c08ab6b31521c0a941bf963e74300721a66c9136418007b6c3f6e9b932eb4e994d1cc09f4503ed480fa6e4c58e066ea48c7996f843ad84380df3d2e2339969a37cb3e1bcf798b1e888f060c429221ff211c19d4fceaa589d7092e38469c704fb7d390d46c382327b5c6e8fea8b26e32052b2b94dfe1e5aeef3dbdae2e3fad61792b03a309c89629c6a51c9ddbfdb728cc046a1322f84914df9d17ce384a4c1185cd01367b5f3b4f7faf9fceff7720fe7f84b3f159c3dba6ff356c60d28e6543350278dfc6bebc7897382e9c08548c56a3cede6ebee4e660114b0fb0a91ee194e2b1868b75a454b108dd2f4f58f4bce6c3c58993bd3a5016126a56b1a2f5557acc77462e463451e05fac3fb6ab501ad665742ca83348d39524d4c9c3ef4d51a2fa2128a66c73b712b199fe2b784a5195839a657fbd4538a9ee33cac430c71910cfd684e5442c6bd2f9753ba20e27339955adecffe7012c752e7e421288595d5df2eecfb5bc7a8d7a42e697ba4ed7142be9870090536747bd60db60ad71e06e95e58b5702cab4833de2be52cfca4f82f96916fe8d54a09763eac833ad43a27f56a94109b6e48a106b3f4da4c71c523bf7d41db4da14f15ddf963f49cdd055312064bf8b77785081c20ae0a0af91ae277c2ea108f8dfd9bc9e190c1e885672a774e7df436eed440001e4b8d9f4b805442ba0d0ce5bf0b7913f22d162a432f1f1bd6adbba2e366a1365e9c811f55bb3e7449b8e5bf02cae27608c2f327f46125fb0d7a2a589aaf6cfb74ec0b313f7a6367d2b9c4ea05f020e6949fde39e81d9f39e6c37574445ab807b5d57ad767c320d4dfcf623605afc4e4b327dc7bce1e4b37fa201091e52031bb08127d2295588cb67b4cbf223cdccf5e9b9a1723ad903c0a90db580f4e0823bd8b7df17b99de8dab76d8efadb4d9308140d1fec75f950e9bab49722bdf6dfcf2fe2f0d4864f65919062c325f6a19a13f7646d85eb538ca1e3cb74e22102382913968f3df2704e97364b80445b695e0f60ffc88ecedf3f0fa0a7324402c17603734325a9ea860dab738951f276672658dfaf0c87123ef426d9e8a21739bb3c0710dec2a0622b63f071421edd13e2021112ab4628f483b1071c57146e22aee926bea8aacb3ad3c279038fa601546e9156d0f25e815c22e93b193ea217b454a3b30746693d3c933eb0b763f5cb148ea5c1a2d5b409406bc1bcc9c533146994bcdc9df76224730d0ccb18f3cea94c6735a830955aebc166b73bb588ed626ea784dfa773a7ccfa753aa9544363254e4a192c1a0c72934870a709aa8de2744f07b975f18938c1eaad3cfa3f68a19719cf1354ed9e25035cdf9cb3947f3278e2712f0466ee0c17c4c267b88b7adc05458859f589eef72cafe2eed47cc192931f1fec8be22f5288591e623878b795bfa8b368d9ee3b86d2ed9d056454c48308d7008791981d43c393747afc0af79d7c2c3b190b9d40289070c75c846520dd96457473c41bf34be5ca92ab3d35cd500d4dfc6b773fcab73311bd7b4750e2c314ee986e933b99dc4339617704dbf9fd0e087be5e2e5e8b90d703e84fc2b932e24018e920bab7af7b955044316485811334117cc2d58cd29e16a956cbd92cb9958543326ece701486ed367ad345751c78db160a5ee199567365ed478d9059b9ab76af9da947961a9e90f8a8df50690b142cf3b4604b86f50e5b3df60ac9c4061bfe92cdad3e605705e68e59af47850716636af6708be086036e0d88300b630fbc0f5c7b422ad5906b0ba98cda631fbbc7de0b217f089020bd881b9f82cfd1fea53a6887288ccdf000d12533e95c717ea89aa61147f0605a33f1710166ec77fe9ce8e64642c921c8e2b10cf5e82dff575290fa373e4c3d4821ac509a25bd4681162dec3ffdeba6564a1c92f58eec0b2d5397c14f14e423810ee823d9850ed7e1136c9447306c1a8891b28d43f064e3a603206039fa4b6e1a3fc3d160b6f6d5cc633e22a3e7ac6038854b53d0e703d38dcedb6e58a07df4582a491cca2c66309698be26523ad3482c293c98d95303d0b66bf3610bb7d6a3d7afa44d13747ba49b51ae78c17d3fc1a93c3e2b09a79906af9ae171ec51b6930f141c51011507d55c2d00dcb7f1e8c65d55abc1b71e75429664a0b1ee3de2f1ffc5f316192783424700b759a381989c1d3f675bea437859ea70412c9dd6026f1e25cdcaf16c3050980dd0ac9758b5d021d77f18ec891d993852f46d859fe1b99492e1dffa3cb4472988438fc3f5604166cdb2927322b037a17ba16379dee1a3138523ece83adb353bbac3a03b6996b960ba4530d3993488afa4d71d2401046fa3909d2856894271bd0b5a679d7aba802d76e8ee843412cbd6a04204da16e458d46aa0220746f53005dcb862588c591ab98cc1618c17ec060077207d8481995ed8032d25e89b0c35b2f683dd81c56e861e6dffe97e77fafcb7cf632b3a970a115fbfe695f7e3d4539b34de14dfbbc1cb1afd4b9725468b244e38440a3a998a3e3ac242f24e48772eed0d13", 0x1000}, {&(0x7f0000001480)="d4fd8f90bd9bf569908e5774f36bbaee088eaa787c5e66b3077f75e8020fd9db37597504b4277939f23866fc77c71d23383cd390e40748f8ed2d5647ae70b0af7571259f3b6eba5e5c700e0794640fcb8681feeee8521543f3afdddbe3288c06abd1a4e4ab57d545ab5addd661d5e72bc9f0ec512c4796c0103224988a1d5fee23cd51559c931083899ac44d0591a6e9b802a1dac68313427a93e1038c8202c5bc3aa3f0fc96b1f35122849c9d08763db0db29a1af9ae69aefcd196c0b68adf09b22f08b9170154c7eb339d356bcd8cd3488c5e23e609f754dc660f6f20612e7f84397ab12b67cfbb7612177a337b45daf1af6631915c38b7721bd0c5f97450ee1b668775b1b4552182d99e16e1ef530daabac34ddd110700d2ce006ecb4e9f9b0b1cbe9a4860600b9b619565aee608f6f466d9156b53d810e4f6566d82fb805ea96917e529b26be3a8491f7f89dad92a0743618b555953da1a370c66137e5a768a3c06649d2958d9cdd201f0881fe8e75caf771ae9cc306954467ad83f92d9dfbeac76b6919d0b45a498419060fbc41a8b75f333496cfc5cab22307dcc887062b1ed0546d3aa5c47a1b0f83670660e369d0bfc7dde5d08c298ddd473dd8710df610966fd183331b239f71f08a3069b25f3fb28db3e7fa58be3bbe933bf437924d61feaed1c394b2412367a3facc1df640ccad38ce1afd712cbc3ddadafcc30e7868a6b7c5a52caf917799de89e318de6cb9ba959d43b65288cb231dbef0e363b6f919ac1d5c490b6dc5fc4331274cf40b1070b17f9c6ada5355eaf76a39a9225b8943b9287bfcc8a65d87aa7113c842442459d370a0e39dec2892a43452d481903005f4b4abbe26cbf91764321b26ed36131c3dc4af869c0d11c6222ee15c36e8eaceab9827d5b63ffb40de75a01d66d9ce7bab73b211bee1b0913389b6bf31b2cd579ba1eef52c36d9b9b76ceb940d87290cb8a6827d997457f7f3abf40d0cb50db46a1eb32a7be706643f1d24033afde262c3b66843444d4737fb0eea1e8d7fb1944f21c46b83f28289c325e1def095ef3cc531e5060e462326f425fd92da31e3bdaace800e4f94b059dae2513973e9a10a5652ab401c7dabe4a54637d4b4005c454c06b2903505c19e7ad996be18ec7cdc580cbdd296d2cdbbee4a440f4438a3bb8368fb98213b75cc8e2e1e97593d51ed5dceec0773ea646ae741b721a9f9ac9cb4efb6f3fcca860a01c32a83ae2d3d64e2c6c51ccb52abff04191c15d69f01fcc1c4cab04053266820118f71cb7c567c2561d5a9e405a562190d2da607fd6b4dcd4799704c4372a78ad1374960a6e9e60df0362c96d0a79f1bef5293fcb1488f568b3b1019769477ff74aa8382d6ad7f6307e2babfc04eb4e7384bc2ff25c54eccdc871c9d8dd2603d0bcb2bc744dee4c9e6f1893635158a658bade8090e6543a9ffd7aa812a56a68efb86e0fcabf1aa9a8f9f0d37dd71f796b3535e2f838011dcd986c663bbee9c6fd5b0e933f4b3eaf834000b4f71c455d96e11290b7aeb2aad1ca16f13b93971b6ba683b4f10e5dc899e656dc4de784fa68af22d0fc2e408b202fb9c99eb8342f3ca59958e63b44239f8a5087bc7eea4c8f1a78e3aa847e9823f0fd089914eef312b651021e60fb27b5d2ea403953e1ed35abbb2cc55c00fa5a05d9e4f418d4fd32cd570ea2b563fbd6e2a365d75d517dcdca5b8d990abde9bb8af5cf78fe80bd1361540c90fcd86540611d81d2b3db7a6e1d1e16b6da559178bdd98f9bb002c298855b29ccda070c17eee46fd4e1f06eaf4cbfdde949c7a86b8db1dbf0fefcdf75020bb70331b1eea2b7c701ed9224952820892960a5f5cc84db91bf43d41b115bbb78e5b12e543c7441dca14abf3eaaa59f43d68e589020bbc9f83fdd2fa887bbb4d01bffbb6b15c9223b0b637e02d96b34d436d33cd90ab0aacb50174375331f7c36616b0cc3a5b5e42171944d028882a9e0d96eaa80048eb89db0e3d66687e5fb0bf7ab6849ff63f11a5a2574c3d39763baa48c4a2931b77f550df7862cc4df2f114f01d421dde91a7d188b3ab74908a4e7f6a97c70b2e74612701e47fd6da076054e616f58ea460d47bafa38fec25ed4cebdfca0c8e4a1eb6512c44945dc836529d5dc2eacabaed34c19d9e1d1a3a572e5daf081a6db85bef3b8970f6a9d7213d2ba3c77ba96bbce471ee66af0abc49e31c6cb8c272a9263c96e7b35021befd058b694389c263ab0779db42f229e9607eb6b32061b1204f61ba58e60c31f67584bb8247c952e9fc46d5b9135d601428a35610243f5fb0333da4da0cde6e291d9449ee5edd681f4a17e392736ccd078456f3e997c2a914e125a6d308e03ffe3914d2024ad5a13449f6d94cd29240d78f89bb3966e031bc97af255fdbc802f7a1b28aba2ea02c3180e4b92e58c70956401f00d6d426f520d92d41bc0bf59f3fea20dce21eda0004d47cddeeef8848c881959bfc2e0077cdb4305e0cfe92c0188bfe6dd2ef7c87ec79c2bae66a6367b883e81ef21ed28f6b188b83032beef14610c719890647d8dbe3924db05f87d2867dda16bc4fa616621a19dc00d6728141d18aad2c3a3e1779baff5ac2256af6028fde71f90e9ca14d40430135dc6f1cb13f131a84549122300e955f0877edf625c172624f1ec1500bc41a06e5a8e054b034e413892c42298b2da45b7dfc5530f131af2a534dbaa6b5d9650b21d3248189be12b106cfda8aed31ac3951c7f38b98f2777cb78b4de15ed4ccf4ab475b0efb259148b7ef173dc4df47655c40095fb644e51fbd88be4b36dd35e62e66abf9011aa636b1a30e815363f146858c347ecadef8b7c78b1f23ec8daf8b1a545807a77841105180cdf6b6df5ad3b6583bcb3753354732748397ffe1c9a2324836b059a998d93b353cb02013e91437afa07e7c958f32b15111754c3d0a9332303662dae6d2c02db1dd4b763795c97f90c3976f8dbc6a7738c98935300b2b9e5683322d552c3c33e3d9578e8202e19f53f6a973e09cc2229fc2497e20491fcffe21c41762ed162acbc82c0cf036086d94b39c9e945050cc4c9feb4fc8c48c0ece1e132ef6bc196edc101e51bd53404d13fc0ee20775c6d26781fad94feb05205ef9e9011cadf9c381de36dda4aa860808a76f369f7ba26df64fc871018322713bae327c4a8ed37e9bf0de964dc1c8599a34b37d570d90cd734c23637809c54f66cb32b7deb0fa019d2c546ce367fc5ead95309631347a7632b2898e6604baaf7f5a336de9def075d2a1b418e39bf8fbfa528df179aa6fad612a5c894e54a51f2d4edf699c7172508b51154ac91af983bb78ffe46f81cfee2e29abffa795a1c71151dc226dfb8f59f4c0b502f8eaf29501be3bb615731f5a0672446f1a05050c8d453cba3bfa25c869779d2d106efa7f57d1a741f179a965d0e12a4626cc37dfdf15f46d29427c8b0b6318a64e2286b278c521a30c68b5270b7d5e5f95be881cbc30ae4df521f91b648ab2096faef47d0d541eab747efd1885d1e9faf8ab8f2fe85d58a31bb305ceb01fdaf5165d011fc76b9f642c75e1203842a6b7fb59e29b7e1cbd719008145fa7fd3a540fb25b8c42f163252e5b67854f7e8a2839d81243b9bb90552879ec6a8e6f7769d6cb61fab9de117852099c78341ed7924ecaca5ea7f353a797af5b12bce37ebf7a94d93154ab19bd615439fd70ae3ea3fa54344edcc22078257fd34fbc25e08a5a7a4cf903dd882f58b42d04dc8cbf97cc9a1d3bccb218e54eefaf5596b69357582e3db5ac0cc1d2496eab76dadfc4da37a4a02ab6b9ab8e14b2a75b431b5861dbf04bc7a27784822a93b9b454949948b17ac1dd35abf276d0489c9901620ce062765edc1266a48feab84498ddae08d3528e7df39ed26c81998aa9c8e0b1deda31001823e285fcecf36c80526d9b6fa3b9a36ccf3ddb9a962145e3be315794640a3ba6f6988cfec4e757db7ce1a2d7894014d2b9852cf280d2281ee963855b2fd3bfe01bea28f130d1cae6e2b956e178ecf83d9ca8ec5b5b062687386912b42553162364925a71aab5277ccf5fdf46f7c940e440fd8763f86d5c56d629c41b220af6b2e1e30c5951ada0f6060246b3468f142acb54364a720e482a00a591a5a333c496178d59a3918fbd9c1180f240e1abfd4e6a048c755e43bcbe36c8f02a8df430275ca3b59e1b0fe3a1d584ee1bfff77db75d187e9af27dbaecae7509979133a30fc29b706108eaf0a3a20b45d127e66783ec214f20e0891080ae107adb19414d0ed5c445145efb43f079a90bf805a668dff839d7f3252e70f78bb68642bec54055e5955f7ea6fed76def3c8fb629229358632646daf4e6e1723f0694ac46373491e00ea4d766ffcf41a3ba4d8054da62eec97943cb0de3d7999602944cf7d6ee170408485088d1e847c07a0fc9b07e36b2a18050cc01b3c98724cd993456a925cc263160ac9254d5e1a554b4ed54fa1d3a6c9c736281ca990a847679af8a11f10ee3a965ae9d7baac05e1e7c23f46dfd233d0be0003b40ebd058f4feb2bb75852fa3161d49d7b27db92fe5079324e2297e041ec32ec39ae3335efa6479757a4376ba3aa0aef2a7aabec93a34a0632c50dfdb75b455b0f799453a589e9d2a56231c30f8e2216a4e34875b8ed45512bde277c48f70d32810a29e3395016dd4f5f22f826fbd591db8e8254b204fcff338861e8a9087d54eef9a706f51496f18a0816f6bc9cad6c5ac2a7a4fed0f67ffd4b5282fb27a2671f1a89722559927b154f386d14e7530bf79632907327237069a43bd55dfa2df72ceb5a678170f74d4ec242c4a2e7e14b3598e4569c7a423746a7bde525224e17eba72bf452bb0e4c014db3925948ea3334bb17bc3db57f29c824f8eb7cf05c1b5c403e22a71d3a1770b9161b6977c8bb662bdbb2f383bf57bfb59c62c2a7916b7330954e3f300299e1b940a61117714db6390ea35a5aeab0889a40ecbf08513bc3ad1aa635adfd7d428c2686c351945e56d93aac52d997f4928a58e20bc6e4165260d6b504bb8624a43e53e1a7a2d8be30bb2782322b1016451ad4f470109b0d6d8a5969a55b7e102974849bafbf290bf3e933d7cb523705580236d90baeaaa5fd52dd98acac828a94ce28bed75c6d821b4e121412d4e9ece1934ebbfa8419a5f3070efe08d7431fd47ef2853b45e49dd493ca4e308ce399668448853910873fa95cbce4cfd73ea5aa9fc5bedf72a8be04dfc167a93ab04bf2303a4b368609b870ae5487e58274ec98a9a5396ff208d939d0bc35d3a3b8320aebd32e106637e3e7feae288c96c919ea0c780f88dd60c6a8d15aea898e15524bc5601a7d573f8df746d1560af5438bcf99888b8309f228f67fb30c9e07ed345d14bff734c355486d03eec9fc3df54f5cf5748a43e0646f3e3df3c5157dfdd4473c2e95ddea8f126c73e1173889b267ca7c86789e8b0fc5781966ed1cff51b0d527624be6e50a2875984cd961a524ec7799d546673dc54f8945d88675f1fdbe68bc4a71a5d48eee9c45215b7429a2294c049b75a7d015f524756bb0f305d6869836579b9db8aad3978b9abf62c77e7d917d7af521d68cd1f250f1bbb5c6572bf10d12b0d671d9b7d88e51e6c13ba5d59b2a9d4f328982014ea34ec7af0902ee80c48f03339de925b484483db6dae0f7045da0861601b17d7cdc553a92dece0fc1a7f1ad21c6e55c6dd4c5bd9597ca269fff67b953579a64491f031f1b7a2f1bb0c874f57bdf254e6924a25a19d82f6ded6320297efd8ecb6448b6d24", 0x1000}, {&(0x7f0000000200)="4f4f9584721d55be7afd37c33051817df8d97e24fad4f28354b7b174b62233a3b021b693580ffb6c37282bfac9b0a7c943d0bae359d7b436101b0349fa2f9a9c766c07be11d4b4417a0600aed420c16a1fcbcade2148e92bf99c3d", 0x5b}, {&(0x7f0000002480)="44ff73411090b8642dd837f8def010c7115f00b2cd1f74ab6b4aeccdb636601a9dcd67fd85686a3cc8c7a34dff9ae584850ebfa29bbea0d4403f4f5fa9264bbab289768e9d697c34c3f75084d9147aef228d75d8349ba49183bcdb97ed278ba9a64577b4cd2d9a69", 0x68}, {&(0x7f0000002500)="a39b12501d18478af8766d11fca84fa3c2f4c6ef855e3bc56ca4a9e4f6d100b02ad96f8a18066b7b565f1e4e774b85f2f256a760dd21a2a49c081408fb6e166ba0261437906c58fc17cf8d124929c04b90abdf5b11a7a63a4fda26fa6dcdd2f8c2cc11230b5bf09d48a96ec4f8328bd43259f5db4884ec9b8fd02e308f2c3a064e07a30dda83906bceb5abfd171ba8245a425106b3fd06dee1b527bcc93910f238adb0fed38fc1a63ba89a79", 0xac}], 0x9, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) [ 247.896410] binder: 12535:12539 got new transaction with bad transaction stack, transaction 349 has target 12535:0 [ 247.916823] binder: 12535:12539 transaction failed 29201/-71, size 0-0 line 3039 18:19:00 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="0400070000d891e63000830200000051392b000020007139dbe20a19361313d1117728dc0c05010000000000"], 0x1, 0x1) 18:19:00 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000"], 0x2, 0x1) 18:19:00 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) r0 = signalfd4(0xffffffffffffff9c, &(0x7f0000000100)={0x3f}, 0x8, 0x80000) fcntl$setlease(r0, 0x400, 0x1) lsetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)=@random={'system.', '(mime_typenodev+.vmnet1md5sum^:*(GPL]\x00'}, &(0x7f00000000c0)="2370726f634047504c05757365722e232621237472757374656400", 0x1b, 0x1) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:00 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="699507008000000000fd70123780b7aac3010000000000"], 0x1, 0x1) getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000080)=0xc) [ 247.954856] binder_alloc: binder_alloc_mmap_handler: 12535 20001000-20004000 already mapped failed -16 [ 247.955863] binder: BINDER_SET_CONTEXT_MGR already set [ 247.955872] binder: 12535:12555 ioctl 40046207 0 returned -16 [ 247.960252] binder_alloc: 12535: binder_alloc_buf, no vma [ 247.960276] binder: 12535:12555 transaction failed 29189/-3, size 0-0 line 3135 [ 247.995189] binder_alloc: 12535: binder_alloc_buf, no vma 18:19:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x24, r3, 0x408, 0x70bd2d, 0x25dfdbfb, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0xb0b}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 248.005939] binder: 12535:12560 transaction failed 29189/-3, size 0-0 line 3135 [ 248.014755] binder: undelivered TRANSACTION_ERROR: 29189 [ 248.020447] binder: undelivered TRANSACTION_ERROR: 29189 [ 248.033559] binder: send failed reply for transaction 349 to 12535:12539 [ 248.042945] binder: undelivered TRANSACTION_COMPLETE 18:19:00 executing program 0: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/status\x00', 0x0, 0x0) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000000100)) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000000)={{{@in, @in=@multicast1}}, {{@in6=@ipv4={[], [], @loopback}}, 0x0, @in=@dev}}, &(0x7f0000000140)=0xe8) 18:19:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000001000)=ANY=[@ANYRES64], 0xffffff8a) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x800000000}) mkdir(&(0x7f0000000080)='./file0\x00', 0x5) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f00000001c0)=ANY=[], 0x0, 0x1) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$UI_SET_MSCBIT(r2, 0x40045568, 0x3b) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) syz_open_procfs(r3, &(0x7f00000000c0)='net/arp\x00') [ 248.055556] binder: undelivered TRANSACTION_ERROR: 29201 18:19:00 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000"], 0x2, 0x1) 18:19:00 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='cgroup\x00') mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) [ 248.083391] binder: undelivered TRANSACTION_ERROR: 29189 [ 248.111712] binder: 12567:12574 got new transaction with bad transaction stack, transaction 354 has target 12567:0 [ 248.123017] binder: 12567:12574 transaction failed 29201/-71, size 0-0 line 3039 18:19:00 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f0000000000)='tmpfs\x00', 0x1) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f0000000080)=""/70) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) r1 = getpid() wait4(r1, &(0x7f0000000100), 0xc, &(0x7f0000000340)) 18:19:00 executing program 0: ioctl$sock_netdev_private(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000601000/0x2000)=nil, 0x2000, 0x10, 0x10, 0xffffffffffffffff, 0xffffffffffffffff) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x0, &(0x7f0000130000/0x800000)=nil) open(&(0x7f0000000100)='./file0/file1\x00', 0x0, 0x40) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000340)={{{@in=@local, @in=@local}}, {{@in=@dev}}}, 0x0) mremap(&(0x7f00008da000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000cd5000/0x4000)=nil) munlockall() fsetxattr$trusted_overlay_upper(0xffffffffffffffff, &(0x7f00000000c0)='trusted.overlay.upper\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="00fbc700038fc8e15043b096a87918e1b83f540f9dfdc6eaeb76a25955f41484bb71eb98e264a73592070f6b1f258961dacf0a8790191513dbe523db17a6fbe53ec00f85e73298f1f3bdb23e7d82244ff915cdd3427205ba9f7944cb7560d11f699a06de31ea3a76901421ea73d68593f2ad84490f1aea663db3810caf5f029de9a2072c8a611f96df9918e4540390805cc46d382b9c105aa2f8a9b834ca1f787fe7c413c22cad86f8e4f055ce3d4639dd454942b9127a328d08a0f540ade440b7bcd0e70999f36767f1b57efe"], 0xc7, 0x1) socket$inet_udp(0x2, 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) r2 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000240)=ANY=[], 0x35b) ioctl$TCSETSF(r2, 0x5412, &(0x7f0000000040)={0x17}) 18:19:00 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000"], 0x2, 0x1) [ 248.149009] binder_alloc: binder_alloc_mmap_handler: 12567 20001000-20004000 already mapped failed -16 [ 248.167451] binder: BINDER_SET_CONTEXT_MGR already set [ 248.173059] binder: 12567:12586 ioctl 40046207 0 returned -16 [ 248.179081] binder_alloc: 12567: binder_alloc_buf, no vma [ 248.184708] binder: 12567:12574 transaction failed 29189/-3, size 0-0 line 3135 [ 248.185056] binder_alloc: 12567: binder_alloc_buf, no vma 18:19:00 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) time(&(0x7f0000000000)) 18:19:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x804) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@nl=@proc, &(0x7f0000000100)=0x80) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000140)='tls\x00', 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:19:00 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f00000001c0)=0xb9) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) ioctl$UI_END_FF_UPLOAD(r3, 0x406855c9, &(0x7f0000000200)={0x4, 0x0, {0x0, 0x101, 0x81, {0x3f, 0xf59}, {0xffff, 0x5}, @period={0x59, 0x0, 0xafd, 0x3, 0x0, {0xfffffffffffffff5, 0x100e, 0x81, 0x7}, 0x2, &(0x7f0000000100)=[0x7b7, 0x75]}}, {0x57, 0xdcb1, 0x3, {0x8, 0x1ff}, {0x5, 0x20}, @cond=[{0x4, 0x8000, 0x5, 0x800, 0x9, 0x1}, {0xec0, 0xffffffffffffbb66, 0xc000000000000000, 0x3, 0x5, 0xffffffffffff8001}]}}) keyctl$get_persistent(0x3, r2, 0x0) [ 248.185082] binder: 12567:12586 transaction failed 29189/-3, size 0-0 line 3135 [ 248.187109] binder: send failed reply for transaction 354 to 12567:12574 [ 248.192253] binder: undelivered TRANSACTION_COMPLETE [ 248.192262] binder: undelivered TRANSACTION_ERROR: 29201 [ 248.192266] binder: undelivered TRANSACTION_ERROR: 29189 [ 248.228311] binder: undelivered TRANSACTION_ERROR: 29189 [ 248.234205] binder: undelivered TRANSACTION_ERROR: 29189 18:19:00 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="046d07000000000010000200000000000000370000000000"], 0x1, 0x1) 18:19:00 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) unlink(&(0x7f0000000080)='./file0\x00') openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x400000, 0x0) 18:19:00 executing program 0: socketpair$unix(0x1, 0x100000040000002, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = open(&(0x7f0000000000)='./file0\x00', 0x20000, 0x8) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000080)="f8ffffffffffffff00", 0xfffffffffffffda5) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$RNDGETENTCNT(r2, 0x80045200, &(0x7f0000000100)) getsockopt$inet6_tcp_int(r3, 0x6, 0x5, &(0x7f0000d11000), &(0x7f0000000180)=0x4) getsockopt(r0, 0x10001, 0xdd0c, &(0x7f00000001c0)=""/198, &(0x7f00000000c0)=0xc6) 18:19:00 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="040007000000000010000200000000002000010000"], 0x2, 0x1) [ 248.297029] binder: 12600:12607 got new transaction with bad transaction stack, transaction 359 has target 12600:0 [ 248.316793] binder: 12600:12607 transaction failed 29201/-71, size 0-0 line 3039 [ 248.330643] binder_alloc: binder_alloc_mmap_handler: 12600 20001000-20004000 already mapped failed -16 18:19:00 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="0400070000000000000000000000000000000000000000003d3cc35c714098e65f1de536c3cdd41714ff2e4c36b125da37c10d1e301896dbb431df323578c38d171477917202b1d1670f97859e32e3a81118674c51c96d61598fefb3cf5d073a2da1d39a66f70ac3f4"], 0x1, 0x1) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000340)={{0x0, @local, 0x4e22, 0x0, 'lc\x00', 0x1, 0x5, 0x6f}, {@broadcast, 0x4e24, 0x0, 0x7f, 0xff, 0xa5b}}, 0x44) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000), 0x4) fchdir(r1) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000140)=0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vga_arbiter\x00', 0x458c01, 0x0) perf_event_open(&(0x7f00000003c0)={0x3, 0x70, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x0, 0xd93d, 0x1200, 0xd, 0xffffffff, 0x3, 0xff, 0x9, 0x6fb0, 0x4, 0xb0, 0x48150ee5, 0x1ff, 0xff, 0x2, 0x0, 0x800, 0x7fffffff, 0x8001, 0x6, 0x9, 0x8000, 0x81, 0x1ff, 0x6, 0x0, 0x80000000, 0xff, 0x4, 0x40, 0x3, 0x4, 0x0, 0xe6, 0x2, @perf_bp={&(0x7f0000000100), 0x2}, 0x80, 0x7, 0x8, 0x1, 0x9, 0x39, 0xa91f}, r2, 0xffffffffffffffff, r3, 0x0) 18:19:00 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={"0000000000000000000000000200", 0x20000005001}) r1 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xffffffea) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) geteuid() getgid() ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000800)) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000840)={{{@in=@loopback, @in=@remote}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000940)=0xe8) getgroups(0x1, &(0x7f0000000980)=[0xee00]) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000009c0)) fstat(r1, &(0x7f0000000a00)) stat(&(0x7f0000000a80)='./file0\x00', &(0x7f0000000ac0)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000b80)={{{@in, @in=@dev}}, {{@in6=@mcast2}}}, &(0x7f0000000100)=0xffffffffffffffd2) getegid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000012c0)={{{@in=@remote, @in=@local}}, {{@in6=@mcast1}, 0x0, @in=@loopback}}, &(0x7f00000013c0)=0xe8) getgroups(0x2, &(0x7f0000001400)=[0x0, 0xee00]) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0xffffffffffffffff}, &(0x7f0000000180)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r5+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) fremovexattr(0xffffffffffffffff, 0x0) ioctl$BLKPBSZGET(r3, 0x127b, &(0x7f0000000480)) fremovexattr(r4, &(0x7f0000000340)=ANY=[@ANYBLOB="752402000006000000b09b75cc58589275eacf1569878ce8d41d9b243c60aab40eabae3e689b0eb996199ad61a6498207a81a0b2056c3bb0b4abd5f8420b3c757ba8d8b1fa7d33c357866dbe733779a7cb95f33985ed4f02e9bfe1ac2d2aa560aa5390b8991ebfa83cb4ef9b14831e0b7581a6dac7c545e861a53557bd76d203187775e9172f5291ae1c5239e611e4b0ba11d77452385bd39c102adf7432dce52e44527f956b441e39218ef81ec823020d01b64816394628b9923a73fb956942c88da5d25bbc00aec3145170e009857c503d8e7ba1ab679c88cf81c5ddaba0d8c449f69952ea5b319d3e3b55483564a52cbf29b866"]) add_key$keyring(&(0x7f0000000500)='keyring\x00', &(0x7f0000000540)={'syz'}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$link(0x8, 0x0, 0x0) [ 248.349989] binder: BINDER_SET_CONTEXT_MGR already set [ 248.355452] binder: 12600:12607 ioctl 40046207 0 returned -16 [ 248.361599] binder_alloc: 12600: binder_alloc_buf, no vma [ 248.370528] binder: 12600:12614 transaction failed 29189/-3, size 0-0 line 3135 18:19:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="11634840000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 248.404098] binder: send failed reply for transaction 359 to 12600:12607 [ 248.414788] binder: undelivered TRANSACTION_COMPLETE [ 248.419916] binder: undelivered TRANSACTION_ERROR: 29201 18:19:00 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000083002000010000000000"], 0x1, 0x1) 18:19:00 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x2, 0x1) 18:19:00 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x14) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000100)=[@sack_perm, @timestamp], 0x2) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000080)='./file0\x00', &(0x7f0000000000)="73797374656d2e706f7369785fff63b4a76f4a6365737300", &(0x7f00000000c0)=ANY=[], 0x0, 0x1) [ 248.455265] binder: undelivered TRANSACTION_ERROR: 29189 [ 248.462258] binder: 12633:12635 got new transaction with bad transaction stack, transaction 363 has target 12633:0 [ 248.468939] binder: undelivered TRANSACTION_ERROR: 29189 [ 248.483296] binder: 12633:12635 transaction failed 29201/-71, size 0-0 line 3039 [ 248.493115] binder_alloc: binder_alloc_mmap_handler: 12633 20001000-20004000 already mapped failed -16 18:19:01 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) chdir(&(0x7f0000000080)='./file1\x00') mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[], 0x0, 0x3) chmod(&(0x7f00000000c0)='\x00', 0x0) [ 248.503166] binder: BINDER_SET_CONTEXT_MGR already set [ 248.508545] binder: 12633:12635 ioctl 40046207 0 returned -16 [ 248.514157] binder_alloc: 12633: binder_alloc_buf, no vma [ 248.514182] binder: 12633:12637 transaction failed 29189/-3, size 0-0 line 3135 [ 248.530477] binder: undelivered TRANSACTION_ERROR: 29189 [ 248.537178] binder: send failed reply for transaction 363 to 12633:12635 [ 248.547549] binder: undelivered TRANSACTION_COMPLETE 18:19:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev}, &(0x7f00000000c0)=0x1c) setsockopt$inet6_tcp_buf(r2, 0x6, 0x1c, &(0x7f00000001c0)="a336d40345872092340ebb467eb14f322e77b726c33b809e3288a924d4f5e76d344ec3987d6b1a14cd440fce2d3ac7aa7cbb486def243c5569a5c9d1d8fb2e05bbe04eed29b7ddfe7638ee068f400ed428423f256b684f1e1c1cbd59f850692a8d1d264c5ec6df4d069fb5f9e9ad1844724c2f3d019e22386fc8b352a74686dfa43473c197081237649bdba21ada10797541a1a3f25cd1365c67e91207f9448a3f448906e77b", 0xa6) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1163484000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000ed00000000000000000000000000000002000000000000"], 0x0, 0x0, 0x0}) [ 248.556292] binder: undelivered TRANSACTION_ERROR: 29201 [ 248.569940] binder: undelivered TRANSACTION_ERROR: 29189 18:19:01 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x2, 0x1) 18:19:01 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RREADDIR(r0, &(0x7f0000000340)={0xe4, 0x29, 0x1, {0x5, [{{0x9, 0x2, 0x4}, 0xfffffffffffffff9, 0xfffffffffffffffa, 0x7, './file0'}, {{0x30, 0x0, 0x7}, 0x0, 0x80000000, 0x7, './file0'}, {{0x2, 0x4, 0x3}, 0x7, 0x3, 0x7, './file0'}, {{0x4, 0x4, 0x2}, 0x7, 0x9, 0x7, './file0'}, {{0x10, 0x2, 0x1}, 0x8, 0x5, 0x7, './file0'}, {{0x4, 0x3, 0x2}, 0x9, 0x6, 0x7, './file0'}, {{0x4, 0x1, 0x3}, 0x3, 0x7, 0x7, './file0'}]}}, 0xe4) chdir(&(0x7f0000000000)='./file0\x00') lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="792407000000000010000200001767872023e6cbbd000000ff00000000"], 0x1, 0x1) 18:19:01 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)={0x0, 0x0}) ptrace$getregset(0x4204, r0, 0x5, &(0x7f0000000080)={&(0x7f0000000980)=""/4096, 0x1000}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:01 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="040007000000006e787f109f28ad1777e33a00002000010000000000192eec5cc99aae886b66a037b3cbfca986a7257e8e956bfb773c68b63ce43e31637b0fdbd175943536b31f1dc452a81ed8f694573979e331104a1aa2f2e74cbb2865e78ca3041b8b439bfc8669f29290193416c9f720d6d12c93849827713ab4000000000000000000000000000000"], 0x1, 0x1) [ 248.619829] binder: 12647:12651 got new transaction with bad transaction stack, transaction 367 has target 12647:0 [ 248.652675] binder: 12647:12651 transaction failed 29201/-71, size 0-0 line 3039 18:19:01 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0200000001000000fbffffff01000000", @ANYBLOB="0400070000000000100002000000000020000100000000"], 0x2, 0x1) [ 248.683132] binder_alloc: binder_alloc_mmap_handler: 12647 20001000-20004000 already mapped failed -16 [ 248.706079] binder: BINDER_SET_CONTEXT_MGR already set [ 248.716889] binder_alloc: 12647: binder_alloc_buf, no vma [ 248.722778] binder: 12647:12657 ioctl 40046207 0 returned -16 [ 248.739109] binder: 12647:12662 transaction failed 29189/-3, size 0-0 line 3135 [ 248.756692] binder: send failed reply for transaction 367 to 12647:12651 [ 248.764006] binder: undelivered TRANSACTION_COMPLETE [ 248.779602] binder: undelivered TRANSACTION_ERROR: 29201 [ 248.800793] binder: undelivered TRANSACTION_ERROR: 29189 [ 248.821026] binder: undelivered TRANSACTION_ERROR: 29189 18:19:01 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) fcntl$setstatus(r0, 0x4, 0x4000) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x24, &(0x7f0000001000)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000080000007000000080000002d03011f00000000950000000000000071260000000000002506000002000000bf25000000000000070500000e000000ad650f0000000000bf5400000000000007040000040000003d4301000000000088000000000000006154000000000000bd250000000000000f65000000000000070500000e000000bf540000000000000704000b46259fa4d664b8926c7a330d0ce67d00040000003d4301000000000095000000000000006154000000000000bf25000000000000070500000e0000000f65000000000000070500000400ff0f0000000000000000bf540000000000000704000004000000bd3201000000000095000000000000004d54000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000200)={0x1, &(0x7f00000001c0)=[{}]}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0x80, 0x6a, &(0x7f00000002c0)="6063c18c4b4aaf9112e8e4d539a058fce73fc0b7654e23e4f37a661454d20adb4c4f13195056fd60690137e6e2f0db13c48c958aa778cc4e6ba1c8edccd940090000000000000033956fe5a4d5686ba56a8adb4b77c5d810353bb40703fa8205abb186be2774f5a4ff46c6791324ec937812eafefa1dfb6143098b11b33f6ce4", &(0x7f0000000140)=""/106, 0xb337}, 0x28) ioctl$EXT4_IOC_RESIZE_FS(r0, 0x40086610, &(0x7f0000000000)=0x8) 18:19:01 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x8000000000000) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="e86240400000000000000000000000000000aa9f37cb3b82b42b580a4ca1430b86e4f777ff7a4a53ebd11cb572b1df126b666544792afc7544dcc2b2216e0000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:19:01 executing program 3: ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000000)=0x0) wait4(r0, &(0x7f0000000080), 0x20000000, &(0x7f00000000c0)) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:01 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000340)=@raw={'raw\x00', 0x9, 0x3, 0x410, 0x1c0, 0x1c0, 0x0, 0x1c0, 0x1c0, 0x340, 0x340, 0x340, 0x340, 0x340, 0x3, &(0x7f0000000000), {[{{@ipv6={@loopback, @loopback, [0xffffff00, 0xff0000ff, 0xff, 0xffffffff], [0xff000000, 0xffffff00, 0xffffffff, 0xffffff00], 'bpq0\x00', 'teql0\x00', {0xff}, {0xff}, 0x3f, 0xffffffffffffffff, 0x2, 0x10}, 0x0, 0x180, 0x1c0, 0x0, {}, [@common=@srh1={0x90, 'srh\x00', 0x1, {0x0, 0x4, 0xfffffffffffffffa, 0x0, 0x7f, @loopback, @loopback, @mcast2, [0x0, 0xffffff00, 0xff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffff00, 0xffffffff], [0xffffff00, 0xff, 0xffffff00], 0x800, 0x800}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x5}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x48a2, 0x288, 0x9, 0x0, 0x1, 0x36c, 0x2, 0xfffffffffffffd9a]}}}, {{@uncond, 0x0, 0x118, 0x180, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0xd}}, @common=@hl={0x28, 'hl\x00', 0x0, {0x2, 0x400}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x12, 0x988, 0x0, 0x4, 'netbios-ns\x00', 'syz1\x00', 0x7ff}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x470) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000000000000000e7000000000000000000"], 0x1, 0x1) 18:19:01 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:01 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket(0x5, 0x800, 0x7f) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r0, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0xb4, r1, 0x400, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x94, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'dummy0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x0, @ipv4={[], [], @remote}, 0x2}}, {0x14, 0x2, @in={0x2, 0x4e23, @remote}}}}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x280000}]}]}, @TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3f}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) r2 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') r3 = fcntl$getown(r0, 0x9) sendmsg$FOU_CMD_ADD(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xbc0003a}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x20, r2, 0x604, 0x70bd27, 0x25dfdbfb, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x81}, 0x20008080) recvfrom(r0, &(0x7f0000000480)=""/163, 0xa3, 0x40002020, 0x0, 0x0) ustat(0x5, &(0x7f0000000540)) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r3, 0x9, &(0x7f0000000240)=""/21) 18:19:01 executing program 0: clone(0x802182001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) r0 = dup(0xffffffffffffff9c) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000a40)={'icmp6\x00'}, &(0x7f0000000a80)=0x1e) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) restart_syscall() ioctl$RTC_PIE_OFF(r0, 0x7006) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @remote, @broadcast}, &(0x7f0000000240)=0xc) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000340)={@ipv4={[], [], @broadcast}, @remote, @dev={0xfe, 0x80, [], 0x17}, 0x0, 0x1c000000000000, 0x8, 0x100, 0x5, 0x10000, r1}) fdatasync(r0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0x24, &(0x7f0000001000)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d030100000000009500000000000000712600000000000035060000ff000000bf25000000000000070500000e0000000f65000000000000bf5400000000000007040000040000003d4301000000000095000000000000006154000000000000bf250000000000000f65000000000000070500000e000000bf5400000000000007040000040000003d43010000000000950000000000000061540000000000006b25000000000000070500000e0000000f6500000000000027050000040000000f65000000000000bf5400000000000007040000040000003d3201000000000095000000000000004d54000000000000b7000000000000009500000000000000"], 0x0}, 0x48) io_setup(0x0, &(0x7f0000000280)) exit(0x40000000000000) open(&(0x7f0000000300)='./file0\x00', 0x0, 0x20) [ 249.324931] binder: 12684:12688 unknown command 1077961448 [ 249.337229] binder: 12684:12688 ioctl c0306201 20000000 returned -22 [ 249.359599] binder_alloc: binder_alloc_mmap_handler: 12684 20001000-20004000 already mapped failed -16 18:19:01 executing program 3: mkdir(&(0x7f00000000c0)='./file0\x00', 0x10000000) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:01 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x802, 0x0) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, &(0x7f0000000080)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400d5d149b4a9d51ea20200000000002000010000000000"], 0x1, 0x1) 18:19:01 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:01 executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0/bus\x00', &(0x7f0000000200)='ufs\x00', 0xfffffffffffffffe, 0x0) open$dir(&(0x7f00000001c0)='./file0/bus\x00', 0x40, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) truncate(&(0x7f0000000100)='./file0\x00', 0x7fff) mount(0x0, &(0x7f000000fff8)='./file0\x00', 0x0, 0x7ffbf, 0x0) creat(&(0x7f0000000000)='./file0/bus\x00', 0x0) [ 249.386787] binder: BINDER_SET_CONTEXT_MGR already set [ 249.392427] binder: 12684:12688 ioctl 40046207 0 returned -16 [ 249.398483] binder: 12684:12698 unknown command 1077961448 [ 249.404525] binder: 12684:12698 ioctl c0306201 20000000 returned -22 [ 249.411550] binder_alloc: 12684: binder_alloc_buf, no vma [ 249.417121] binder: 12684:12688 transaction failed 29189/-3, size 0-0 line 3135 [ 249.425298] binder: send failed reply for transaction 371 to 12684:12688 [ 249.433719] binder: undelivered TRANSACTION_COMPLETE [ 249.440299] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 249.440741] binder: undelivered TRANSACTION_ERROR: 29189 [ 249.441124] binder: undelivered TRANSACTION_ERROR: 29189 18:19:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xffffffffffffffa8, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1163484000000000000002000000000000000000000000000000000e000000000000000200000000000000008000000000000000000000000000000000000000000000000000b667dd1fc9f1bacba5fd000000000000"], 0x0, 0x0, 0x0}) openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x101000, 0x0) 18:19:02 executing program 0: socket$inet(0x2, 0x4000000000000001, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/rtc0\x00', 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vga_arbiter\x00', 0x0, 0x0) setpriority(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000000)='trusted.overlay.upper\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) recvmmsg(r3, &(0x7f0000003180)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f0000001040)={0x0, 0x1c9c380}) ioctl$KDSKBMETA(r0, 0x4b63, 0x0) r6 = dup2(r2, r3) inotify_init() write$P9_RLCREATE(r6, &(0x7f0000000040)={0x18}, 0x18) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r7+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) ioctl$TUNSETGROUP(r0, 0x400454ce, r8) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 18:19:02 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x50) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:02 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) connect$unix(r0, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e22}, 0x6e) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="1c76811a000000001000020000000000200001000000000052c08e794af00ea9b42f07504027ca77b281382b674bcebf50c1d1b1e4c8038971afe5ab4f176522cb8ee2ccf27ea3e64af29c263627b1e9f88f81f240691dc80afa6bcd57cb59940687bad4e8485083aa9030ce1306f7c053aa5bbe1ed60afc6f"], 0x1, 0x1) [ 249.541511] binder_alloc: 12718: binder_alloc_buf size -1024252404461862784 failed, no address space [ 249.565014] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 249.582493] binder: 12718:12722 transaction failed 29201/-28, size 0-128 line 3135 18:19:02 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) timer_create(0x1, &(0x7f0000000080)={0x0, 0x3c, 0x1, @thr={&(0x7f0000000980)="e1da3ab765f3ad28caefc02073eb6a306ec5efed84b7c3c150af59ef185e1b7d73f835642df00b8d2101c2a8f57bd657a14ef94366de7cb967c4fafd626726686cb16b720b42858d12f2fca0b9233a8743875df8e6e692aa6fe2d986a5480a5e8cc94e33de28491dbf043168846f8f5ada88e00f287f1d5a877628491717831a938944e70bdea12921ee2fd70d4abb3d60ea3290afecb6865438417a6f0acd705a73969eac731afbf086d165851ee7795ed2f1fd3da44fa2953160ded443221a33181c6bbbaec2dccba8a73daff1a9ea58d00b85e829e140341a714e45c56f316853c18aaedd2539a735098a551cbb8e1d5de52b7f495edfbcf02f11a974ce032d7e45e7d5c0fd9e77bb8e5415846f6d6bbcff498815fd66a8ba39e50473b3f38becf1039504769c4f0ba8c1e056155721a1473c33d40ae0cc229547b32b8b37fe9bd36d287261cf1552559c5fd82111273cee3e08e5e1e3faf88362e4580898e82b22e222d00b2d03ec94f8cc68221494c8a69d9e7b3b1003b919b4d9ad7374c25ec536eee0f3e38b00f3427792f9ec809492dd6c92f3b49ba3124d71cfc23f0127b9f3dd94c0c3a060836104d0f882fc862028dcbf3683a04aaada5b228ec755eeafa36314d0ec9f5da5d287ec8a2adb247434357a85be8ead343fc248be414c028948d2cc81e2bfcfb57a816e2819a10e1f8e137797d5ead62436ac3ccd67daae6928e7e8121c326466b4dcf5c1a861a138f0a17d3cce0915e092f54774dec67e1fae3f2231650ceefd18a18e1671f6d9e40da9aefbda4175c928455150eb8b30afe03132e40eecf48fc67fc5ce86a6e81ca5d60896616bc96d887106fe02eb62f35331b50eacd3bb19f74e4e89765dd818a699e5915cdd5ddcad56e8e5950cc92dd48eaa095d12c5620e2fb00514c3bca12c156a9a5aa885fe55aa9efb669eeb069e1ff11f05a79744cb71ac5706c65f1f9fd9703e2fa679e729a90e2e844c4ab9ff5125ddf587d1b22e49ea7c695036fdd722806e5763c7a6bcea0a061db3200b8013d6a3a6acbe85428a7e851e2c7e9339348852d51a014a24844fdf828c38adcb012d72885cbc3baa5494b62c3acbaba7cd368aa74e93433bf7ff10f5c17d0df49e645a0776b15390849e32ccaed10407d7216366807e3d42dd11c07fc5b76393ebcee7a20f4aff1e4401df6d49705c2f2a9011a1ff1c06393b4ec8fc04ebcff265d4a70e1cfa1e830de0736abfebab7b692f1bb6660da01d6b024214634fdcadaa1082e167851ebd036c3f0737540561a9988bd67fa70d1539bbe703b0962aca9e763aafacfd225e2ecbaf23a28d290e8400d51afd2bfa28247a443f31e841426fe59e411c3a72b491cb22c24df3e8587b8d36e1afa1858cdcbd5f3fc7166cebb81563fa58560a1e4fe3f786b146fd7712068b3e49bf0cf7114cbd8646e57170cdf44cf3369e624ef47cd2db09ad60898b38b112d2069696cce35c0b1aea6e0ebb9d232905f365ca278129eb1a35b1426e2322e9b5aaf015d842df7ecf3719d6d35903233535f8beb1062b618de446760b82a4d2783481ab5b1269b91bb39943183cac440666d1e22efcf62a9d3ddb7170a2a2b123fd8c13ca81be39e9de99ea9e9b9528a4642542ac827438ee485c855ba6ebc35631ad640e5358cb38e73437938ea777ca0e6d8cdb08418deccd3b00d235d8a679198694642dce9b8595e15bc392aca9d516234976adf1a218498fda2801427b9ef9e8c99c77612f8b7bc7760384ea48a711afb53ce1d222fb6943825652700b8056acb4bd4b4a9672b8e41c69320b32d68d8b7ea3685283e565854be10b24f26c1ec70c5d23011e26c2acb2af682e39e48535e081484cac4217c2918e2af586f1acb050d42d9fdc0b25b6c51911c9cfa73bed7a935d610bfc62714e5f262f1d247f5a7c0e9088b8993aaf47a47e0a008eb3ded640113ea384c75a667aa2e3fad749a1c9e23ef2b7a7aa317ad5caaa1962778d10b2fc4e6c0bede5710c010115a6e1a603546c0139f051dc47544348fb0e564ff265edc1a13c94165fc7a42fa694d047a9dba4044679bbbfa1d57943f4a0979c9474d7988e8730114a8adf4913b676348e4bb9c254f1f5f73aebaae3aa01bdb6eb35dc7f988391dc710e8e5a6aefb427e97124e583b92634e1f890011c09a2b5da806c6eec239bc6681d3f4c085ed0b5aff8e8a8836c27a7f5317f4d412cdfd259d87fe54f120e1b2840e54addda6a12119de18714c3ae037aa7f2244ddcfbca0033ccb45123099dc8cba44f128eb332fec750e4a7f16ed23e42ab1966bc87ce4ef9e06b9165fac43a805691dd06244aaab99c1d588ef3d616049dcce9ee3d13c84a0b2a0ced59ed9f9df8b35fc4538c6553927b1da425c4b9cb0f24364b9ea057097fcd8f1e36c7e7c9f815c02f8f02aa05cfa7dd54d5d82f9b74e8360d65b376a5d2cea183552c3043772b67f12cab67153311816c201bb0e51f08ed77dcb9e010bff1b09d4d7b52e0d66d3adbae21c43f8ea7b77fb8c86fffb50625785d4103f1b2b2d150f4270617d1367b368f361a074f08f38204f68afac9e8221e811a2c5de98ac1cdfb02cff773faec3a14a86ed039af71cada841eac2a2ef1ef8a1f4ff27003837e063059cd17fda4a489b0874b7e632609072507fbd6d626a01931d6671ad4ca0d77b9b44a679d868483932b71fbff925412ac73a3ae8f75633c05cbf306495f7050846440f923be959e8de8f6eae83632a41e06b166c75b9ab1cd20c3b59e787f157323dffa2d49b6a51bafe8923766cacd7e6c65d4f9a3740e6642bb43732ba4af3c52d17f6ec07fae2f95b4988a764cb5cf02faed918dde7f3d5d6463a01c6f529228b1e635aecf1ddf0d4c12f9e1017994d09529d17c902aa187b2002fe34c96178f132f5c9af6c0061ca7f6f92b8d1096fc805bc5d612d323abf1a0dd8f24944f816a43dc9f99520f65e51f3e7bb6c435ed7adb1dfbaaf100de4a50d13302a64b93ac07941da517739173d8f3bda9b2e829eacf3406475a6330f4b96a86c2d070424747df35f755c82abf0f9d40f1b56dea3398a8ca6556dc6bab574a11a06f3aec59ed8c6adf754da2ac7b1b0c0d73cb2c57654700b95f9ec1b5ab3c0b3fd06ce9aa0179560ecdb09571a75d90e65254b5cef860e9d084f4158f54249d608e08fec2f6b100c8beb920ded89c011f7ac540f09e685dfd937779a1dfa577cf39556cfbae4d56e06be491efe0804441330b5d37d61d814d7075e88c1aa11717c9615ec9abe9010b92d5a65659dd84b925c5b303fc656900aa36acee75987c80b940d974abc2b703be3b39df032149b0404435a17231547b52332025d7d0dcc9321716c4e715f9aacbb63f6cf20751eccb154a49b22c0d7ae71a654325a944b1d0b900fa204a6a967e746b80fdaded8bb95b6b0c2f6afdb61182251349d16b3cf485655e2e85e3df0dc5ada55ac814eb258ee71787df7bf4ffc44013b0fe99133ecc9944540aeb896ae7ea3f18d2451264d768c08127196f40a417af46726b07a0069f1d6c7ee56d64af66108ee678b00d02abac526c143ccd8aac2627380c52a4df053a145dfdfc8a7c6e648915d71bed4006d3c30ae807ae8ca8468e58005ab456ea57651fd327681f5e7bc4816ce59636c633c24e5e0f72d491e9c9858233f577973272bce5182f3feb4478ebe43150bc3bc70539a136401c9f9d7f1f919c4368f61cd62001725b5f80331fb8d2555e02ac3f9563a5234b5269409bd554e8045b2979a54d22cd8004c15b3d51365547cc395bc0f75d3eba2a660b5d8dd181db3ac5afe8cf0350c677674552c5872f72e1ff407b2a2fd4e0ec10fd768ecbbb37b83aeeaca5859368903718076da84cfc68b668785b5145ed9adca3aa9f951683a71eaf9fb61e6e386a63264d866320758a3a37c536e33b49cf5abd5ba087e8ebfa5c9938bc4b8a897037274134457f1dd0366b8114175d9b4b311aa09554a788d7ea074c1919b5b743fd4fa41e3e52af6a25e2b84ef0571b7dafb29f62e2faed94f8bde5c2171dc892b36a86cba5fdf83668369ad0ba7890a9e1cae9f0bb1e87bcb8ea145c190d1bd20c7f1dc461c4a7a09fcc39586e72e744ec9ad537d09cb7bccb5829976f37f9f2a9c21e208f79adb75f26df0f4ecc042df337f4b9d1f0962141e51e77fa1c79f309692da73d11c610dc37e13d4b5583e69d3f152e8eb94688a5e75575d4fa8a1f580205c87a96d18101ed1ab9206cadced45dc24c1f7805fc63d7b3e3f2d0ba581ad950972b4e71eeb34e199d6c30f15e7eacf7b8c257a6dae968bca816f101f674b5856f8cac76d312e478b4b14b4ec984e726db48844cb6148b756d9e8144858b4aece6a8b97ff0986b2f65895959cff343c10f25de584e8791619ebb5407818e3e991712effd98404b29f9fee5a875b9daa2921d49ddfe717c9398cc44f5fe0e6adfc10ca95e8d8f7bf4fc63c899c3199ad81d1e161b91f805ec0d7fd69246bfb11b411c66d27df08da688a6e10c8adc7348a05385f145e9d1e3c4287e0cef716c23d8eb21add2e8471ec0ad3b3819908989be43817abc2cb258e2afa7b5041abcf8e884ecbbf3c73b4bfb98204df360f4d859b07ef1fafba73b3d87a1706f2a11aef9a167453f5823cf1121acfa2064786622180689369d9c1e1dee33a759a4d1727fe73439a61a6492eb7cf6dd11f4eb43512bc364b1c1be89fd471adc86e28b55ce2744ed031f8de7c7b38b1b202835e981fd2b609da037224dd4c2c4bcf640ca25309b6993854dc744da0524623fe9de2000feea5a31790775848856df9dfa0fe8123b191469f290aaf568902719afff346895804994db940db11b0c9713bdb81770cd804074b153dd659b5441f85e13fd3c09fbcb3bd550bea56f74bff4623eed9e4bbb597b84a29d3db828edb95b5ddef772de65bcfda338cdc80e4499ae4dea82ea211a89660bc65597eba19eeff3c9843ba9874bf1d2ba339212f7b67e1467d35e355021dab78a0a8bce64a71ecb80e937888724769ac92d9ba0048a911fa434de17656e7ed96972721a4598ba0001392ebddf8d70da67e607153613f9b4bde7fc44669fdc78a969f5e8b1e3a4d775472c4150dad270d9976de436f979cc15d06e1914ecbad58f7ec5214369eef98d7dd67552fb42f5dd36dbfc9917c5596bcc76d1fd3ea92db9c1d252dac7c3d6576d5ff12ea0de602f2b3aed1b710596a7ede78618b5c3411e670bebffdbd5ccdef6c91b08d1d54f0f326c1de280927626ed39a23c1664cf4ea34ee52d9a97f55b367b4a2dd60f1c6fe232b73658991c698855006ee0b1f90700678b27de71cc6c009e7c1a1f76738b9de7ddab52ba30103056b99914f279799c3f1cee6aff1f68ecc5a31f22049fdf09167a3fd0caf7b7a2970971ce4336480565b4318d134f6325ae9b4418c76188102776340290a284eef521851ad86b728734fb762beb53643cd9f7400edb1a004bda6513c3929d79dc8d6b9973aae49286928e48af609be51c5aa5b7b10ad7c3c2261ec515dc6de0c2b77c8fb78e2e72d314ecf0855b16842e312893bcc8a775d39d5934651c91fd9c5a6211bc87a514ba475a16505b8793d34d852650d71115e02cc8e140a5fafc795f5ca155991a2a1556ce5ccc5fb27625d893d3b51eda53d7f92d8228a97f07965090b32066b912d77259d0e658cd85ff089e944a75bfab220cfe9fe496883d3981def0cc7353d826f229d60966b86c192b21f46e64b01fe911ff1151a8ecbdb4", &(0x7f0000000000)="a3c4a2dc983104349b2da9ee2a80fdc66e717b041113a94de0dbfdd24e46"}}, &(0x7f00000000c0)=0x0) timer_gettime(r0, &(0x7f0000000100)) 18:19:02 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) getitimer(0x1, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 249.593171] binder_alloc: binder_alloc_mmap_handler: 12718 20001000-20004000 already mapped failed -16 [ 249.605568] binder: BINDER_SET_CONTEXT_MGR already set [ 249.611365] binder: 12718:12722 ioctl 40046207 0 returned -16 [ 249.611531] binder: undelivered TRANSACTION_ERROR: 29201 [ 249.611568] binder: 12718:12732 transaction failed 29189/-22, size 0-128 line 3012 [ 249.613100] binder: undelivered TRANSACTION_ERROR: 29189 18:19:02 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='ppp0\x00'}, 0x10) fsetxattr$trusted_overlay_redirect(r0, &(0x7f00000000c0)='trusted.overlay.redirect\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x1) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:02 executing program 3: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$security_smack_transmute(&(0x7f0000000140)='./file0/file0\x00', &(0x7f00000001c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000240)='TRUE', 0x4, 0x1) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) mount(&(0x7f0000000000)=@nullb='/dev/nullb0\x00', &(0x7f00000000c0)='./file0/file0\x00', &(0x7f0000000100)='qnx4\x00', 0x201082, 0x0) [ 249.677493] binder: 12739:12744 got new transaction with bad transaction stack, transaction 377 has target 12739:0 [ 249.712947] binder: 12739:12744 transaction failed 29201/-71, size 0-0 line 3039 18:19:02 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB], 0x1, 0x1) 18:19:02 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x10) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000340)={0x184, r1, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x38, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xff}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@dev={0xac, 0x14, 0x14, 0x15}}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}]}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x41}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x1d}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x100000000}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syzkaller0\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}]}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfff}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x10001}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x80}]}]}, 0x184}}, 0x800) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) [ 249.728937] binder_alloc: binder_alloc_mmap_handler: 12739 20001000-20004000 already mapped failed -16 [ 249.740298] binder: BINDER_SET_CONTEXT_MGR already set [ 249.746617] binder: 12739:12752 ioctl 40046207 0 returned -16 [ 249.752958] binder_alloc: 12739: binder_alloc_buf, no vma [ 249.758606] binder_alloc: 12739: binder_alloc_buf, no vma [ 249.758616] binder: 12739:12752 transaction failed 29189/-3, size 0-0 line 3135 [ 249.759017] binder: send failed reply for transaction 377 to 12739:12744 18:19:02 executing program 2: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$inet_tcp_buf(r0, 0x6, 0x1f, &(0x7f00000000c0)="cd8fe96855a55c183ab14e7837c1340e4468b33b8adca4cec9c63bcf2a2c316f4ab87b3745782851f6c79924c34d27f03d89c94d186bc7e1075988ff2dfe143d24c1026f4dacc4fe1c35d617d803f28e7b22ca2fa40804bf40774349e7f9baf7b02587c78f982c36df051647bd1c50dd812e7f3afe5cf633128d2a17462f56094c9e38ab86b8326461098000da02887823440e232760ef637914f3f7b571f9cad3", 0xa1) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f00000001c0)={0xfffe00000, 0x7f, 0x40, 0x5, 0x9, 0xd9}) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) readahead(r0, 0x7ff, 0x4) creat(&(0x7f0000000000)='./file0\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:02 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB], 0x1, 0x1) 18:19:02 executing program 0: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x2, 0x0) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000100)={0x0, 0x26, &(0x7f0000000080)="063686d58acb32ee9d7043c82e9efe55f00b89c36201176b1c8db12a4744627b07fcee63885f"}) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x4) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000000)=0x6, 0x4) getsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000b67000), &(0x7f00000000c0)=0x16b) [ 249.759032] binder: undelivered TRANSACTION_COMPLETE [ 249.759041] binder: undelivered TRANSACTION_ERROR: 29201 [ 249.759045] binder: undelivered TRANSACTION_ERROR: 29189 [ 249.795446] binder: 12739:12744 transaction failed 29189/-3, size 0-0 line 3135 [ 249.806989] binder: undelivered TRANSACTION_ERROR: 29189 [ 249.817419] binder: undelivered TRANSACTION_ERROR: 29189 18:19:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x9) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) flock(r0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:19:02 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0/../file0\x00', 0x20000, 0x80) dup3(r0, r0, 0x80000) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="bb5eb250f08c48ef0400070700002000100091916a15bf1e5e6bd3ba876becc926139b779f2f6d48e81b637233119b828ba15db0d33c5124f68035b71b9c3d38ddba5a56b80cdc64"], 0x1, 0x1) 18:19:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) getitimer(0x1, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:19:02 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) clone(0x4140000, &(0x7f0000000080)="9f37e57063d49054a6aadb12d02e1e1511829f96349739c33493622573e130c1b5b7648ded80fc22c346ecbfaf14826f56a11730010fe20e5c872cca79f1af172bf9bf818a32e6e57c69f733ab69037dadd6ff8b20a25de59455524d81c28bd009fe7adf091dda9e0c0031abaf948f450c26feaef444368f14293411a0078e34b60783e005bd7e3bce93181f2e731c194f255b24ad1963108907080dbf026fed", &(0x7f0000000000), &(0x7f0000000140), &(0x7f0000000340)="5b83096796694f76955e872b832f9b429c4b11136e616d112498e7a75128a0e93c40b97f214c39aa1a6d18ce26f500cfbbbe7ed1f3868b7848fd7c2d2d1db206e185513a7e9e515c8ec6d8") lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:02 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB], 0x1, 0x1) 18:19:02 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='cpuset\x00') getpeername(r0, &(0x7f0000000640)=@rc, &(0x7f00000002c0)=0x80) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000080)=""/70, 0x46}, {&(0x7f0000000980)=""/4096, 0x1000}, {&(0x7f0000000340)=""/211, 0xd3}], 0x3, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) getpeername(r0, &(0x7f0000000100)=@ethernet={0x0, @local}, &(0x7f00000001c0)=0x80) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) getitimer(0x1, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 249.918807] binder: 12774:12780 ioctl 40086602 20000080 returned -22 [ 249.943091] binder: 12774:12780 got new transaction with bad transaction stack, transaction 382 has target 12774:0 [ 249.957330] binder: 12774:12780 transaction failed 29201/-71, size 0-0 line 3039 [ 249.974187] binder: 12774:12780 ioctl 40086602 20000080 returned -22 [ 249.994488] binder_alloc: binder_alloc_mmap_handler: 12774 20001000-20004000 already mapped failed -16 [ 250.008623] binder: BINDER_SET_CONTEXT_MGR already set 18:19:02 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)=@known='user.syz\x00', &(0x7f00000000c0)=""/32, 0x20) pivot_root(&(0x7f0000000100)='./file1\x00', &(0x7f0000000140)='\x00') r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x80c04, 0x0) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xffa2) lsetxattr$security_evm(&(0x7f00000008c0)='./file0\x00', 0x0, &(0x7f0000000940)=@md5={0x1, "882f8a6072432aec655375cb7a2c728a"}, 0x11, 0x1) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000640)) r1 = bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f00000003c0)={0x100, 0x0, 0x7, 0x6a7041d3, 0x0, 0x0, 0xfffffffffffffffb}) arch_prctl$ARCH_GET_CPUID(0x1011) ioctl$int_in(r1, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket(0x8, 0x8080f, 0x1000) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r2 = socket(0xa, 0x3, 0xff) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={0xffffffffffffffff, 0x0, 0x0, 0x3c, 0x0, &(0x7f0000000280)=""/60, 0x18d32c35}, 0x28) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$VT_SETMODE(0xffffffffffffffff, 0x5602, &(0x7f0000000180)={0xf8, 0x81, 0x401, 0x8000, 0xff}) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000007c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000000)) ioctl$PIO_CMAP(r0, 0x4b71, &(0x7f0000000880)={0x8, 0x1, 0x400, 0x0, 0x1, 0x7}) syz_mount_image$f2fs(&(0x7f0000000240)='f2fs\x00', &(0x7f0000000340)='./file0\x00', 0x20000000000000, 0x1, &(0x7f0000000200)=[{&(0x7f00000000c0)="1020f5f20100070009000000030000000c0000000900000001000000020000000000000000300000000000000e00000016000000020000000200000002000000020000000e000000000400000004000000080000000c00000010000000140000030000000100000002", 0x69, 0x1400}], 0x0, 0x0) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r2, 0x0, 0x61, &(0x7f0000000480)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000000000000d1000000d68efb113c00341064228a1e47c885f5305447d98c356f6f506b5061a8d3c181b62c3540abda62fed3841bbf7082c2351dc70f27d3db27536d124b85be5c1207eb59507a8c20fc460dd0a7a68306356bc7ce3c1b06796bb8ceb092aaec8831183d4bffb01bd23323850f491d6a3f84d8dd6d4e48593a98200bd98b8fed7b18ad2d212795150b5d3a21f521bb3b7b1d5b50ee30ade72ff07a12d0a524370bc28e0177bfdbddf7148ad95eb399e721a44c71a3cb3fc97859081b33d7b3ca3627ae52ea648f53cb9ddc50b9002371ee12ef19"], 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000840)={r3, 0x10, &(0x7f0000000800)={&(0x7f0000000680)=""/36, 0x24}}, 0x10) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:02 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) clock_settime(0x4, &(0x7f0000000140)={0x0, 0x989680}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) getitimer(0x1, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:19:02 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200"], 0x1, 0x1) 18:19:02 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mkdir(&(0x7f0000000000)='.\x00', 0x40) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) [ 250.037164] binder: 12774:12791 ioctl 40046207 0 returned -16 [ 250.039146] binder_alloc: 12774: binder_alloc_buf, no vma [ 250.039173] binder: 12774:12787 transaction failed 29189/-3, size 0-0 line 3135 [ 250.039510] binder: undelivered TRANSACTION_ERROR: 29189 [ 250.039555] binder: release 12774:12780 transaction 382 out, still active [ 250.039558] binder: undelivered TRANSACTION_COMPLETE [ 250.039566] binder: undelivered TRANSACTION_ERROR: 29201 18:19:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) close(r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x24a, 0x0, &(0x7f00000000c0)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:19:02 executing program 0: r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) fcntl$dupfd(r0, 0x0, r0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/net/pfkey\x00', 0x1, 0x0) pipe(&(0x7f00000002c0)) openat$full(0xffffffffffffff9c, &(0x7f0000000340)='/dev/full\x00', 0x400, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000380)='/dev/null\x00', 0x488040, 0x0) ioctl$UI_SET_KEYBIT(r2, 0x40045565, 0x91) mount(0x0, &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, &(0x7f0000000000)) r3 = socket$inet(0x2, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = getpid() open$dir(0x0, 0x80004, 0x109) sched_yield() r5 = creat(0x0, 0x0) ftruncate(r5, 0x2008200) r6 = open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0) sendfile(r6, r3, 0x0, 0x10000fffc) syz_open_dev$loop(0x0, 0x0, 0x0) sendmsg$IPVS_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, 0x0, 0x0) add_key(0x0, &(0x7f0000000200)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCDARP(r7, 0x8953, &(0x7f0000000000)={{0x2, 0x4e23, @remote}, {0x7, @dev={[], 0x1c}}, 0x10, {0x2, 0x4e22, @multicast1}, 'syz_tun\x00'}) r10 = dup(r8) ioctl$LOOP_CHANGE_FD(r10, 0x4c06, r8) getsockopt$sock_buf(r7, 0x1, 0x37, 0x0, &(0x7f0000000080)) bind$unix(r9, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e23}, 0x6e) keyctl$get_keyring_id(0x0, 0x0, 0x2800000) recvfrom$inet6(r1, 0x0, 0x0, 0x40010121, 0x0, 0xff4b) syz_open_procfs(r4, &(0x7f0000000400)='net/ptype\x00') [ 250.098324] binder: send failed reply for transaction 382, target dead [ 250.132537] binder: send failed reply for transaction 386 to 12808:12811 [ 250.139641] binder_alloc: 12808: binder_alloc_buf, no vma [ 250.188189] binder: 12808:12812 transaction failed 29189/-3, size 0-0 line 3135 [ 250.199752] binder: undelivered TRANSACTION_COMPLETE [ 250.205918] binder: undelivered TRANSACTION_ERROR: 29189 18:19:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800000000000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$IP_VS_SO_GET_SERVICES(r2, 0x0, 0x482, &(0x7f00000001c0)=""/147, &(0x7f0000000140)=0x93) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:19:02 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000006695781de7c8bfe8cf10e72db52b038db2a8a4137bb8e829b6fac7840e3d1af42f4f7e6ae611bd4b65f102754238a9f8b1158a919a2558ac397f5e3a11d7fc9d46c99a3bb83794512da7db"], 0x1, 0x1) 18:19:02 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) r0 = creat(&(0x7f0000000000)='./file0/../file0\x00', 0x10) lstat(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = getgid() fchownat(r0, &(0x7f0000000080)='./file1\x00', r1, r2, 0x400) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file1\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0408070014aa089a07a52a2300"], 0x1, 0x1) [ 250.236538] binder: undelivered TRANSACTION_ERROR: 29189 [ 250.274363] binder: BINDER_SET_CONTEXT_MGR already set 18:19:02 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200"], 0x1, 0x1) [ 250.286782] binder: 12834:12836 ioctl 40046207 0 returned -16 [ 250.301885] binder: 12834:12836 got transaction to context manager from process owning it [ 250.320555] binder: 12834:12836 transaction failed 29201/-22, size 0-0 line 3003 [ 250.356815] binder: 12834:12848 got transaction to context manager from process owning it 18:19:02 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200"], 0x1, 0x1) [ 250.400508] binder: 12834:12848 transaction failed 29201/-22, size 0-0 line 3003 [ 250.419599] binder_alloc: binder_alloc_mmap_handler: 12834 20001000-20004000 already mapped failed -16 18:19:02 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x2, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='system.posix_acl_default\x00', &(0x7f0000000940)=ANY=[], 0x0, 0x2) r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x101000, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000080)={r1, 0x0, 0x2, 0x7, 0x2}) 18:19:02 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f00000000c0)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000ff7f0000000000002900110000000000"], 0x1, 0xffffffffffffffff) 18:19:02 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040200000001002000010000000000"], 0x1, 0x1) [ 250.463811] binder: BINDER_SET_CONTEXT_MGR already set [ 250.477322] binder: BINDER_SET_CONTEXT_MGR already set [ 250.483047] binder: 12834:12836 ioctl 40046207 0 returned -16 [ 250.493005] binder: 12834:12848 ioctl 40046207 0 returned -16 18:19:03 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000"], 0x1, 0x1) [ 250.525045] binder_alloc: 12834: binder_alloc_buf, no vma [ 250.537244] binder_alloc: 12834: binder_alloc_buf, no vma [ 250.543234] binder: 12834:12848 transaction failed 29189/-3, size 0-0 line 3135 [ 250.551110] binder: 12834:12836 transaction failed 29189/-3, size 0-0 line 3135 [ 250.570672] binder: undelivered TRANSACTION_ERROR: 29201 [ 250.580779] binder: undelivered TRANSACTION_ERROR: 29201 18:19:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x40, 0x0) ioctl$BLKPBSZGET(r2, 0x127b, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 250.620466] binder: undelivered TRANSACTION_ERROR: 29189 [ 250.625978] binder: undelivered TRANSACTION_ERROR: 29189 18:19:03 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000000), 0x4) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) [ 250.706681] binder: 12877:12879 got new transaction with bad transaction stack, transaction 395 has target 12877:0 [ 250.726266] binder: 12877:12879 transaction failed 29201/-71, size 0-0 line 3039 [ 250.776404] binder_alloc: binder_alloc_mmap_handler: 12877 20001000-20004000 already mapped failed -16 [ 250.790816] binder: BINDER_SET_CONTEXT_MGR already set [ 250.799885] binder: 12877:12879 ioctl 40046207 0 returned -16 [ 250.812219] binder_alloc: 12877: binder_alloc_buf, no vma [ 250.817880] binder: 12877:12887 transaction failed 29189/-3, size 0-0 line 3135 [ 250.825698] binder_alloc: 12877: binder_alloc_buf, no vma [ 250.831872] binder: send failed reply for transaction 395 to 12877:12879 [ 250.838841] binder: 12877:12879 transaction failed 29189/-3, size 0-0 line 3135 [ 250.846557] binder: undelivered TRANSACTION_COMPLETE [ 250.851769] binder: undelivered TRANSACTION_ERROR: 29201 18:19:03 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='map_files\x00') getdents64(r0, &(0x7f0000000200)=""/116, 0x184) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000000), 0x4) 18:19:03 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x800) accept4$unix(r0, &(0x7f0000000340), &(0x7f0000000100)=0x6e, 0x800) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:03 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000"], 0x1, 0x1) 18:19:03 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="04000700f6ffffff0f000200000500000000000000000000"], 0x1, 0x1) 18:19:03 executing program 3: stat(&(0x7f00000000c0)='.\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000340)={{{@in=@empty, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@multicast2}}, &(0x7f00000001c0)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000440)={{{@in6=@mcast2, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000000240)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0}, &(0x7f0000000540)=0xc) stat(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000640)={{{@in6=@mcast2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000000740)=0xe8) getresuid(&(0x7f0000000780), &(0x7f00000007c0), &(0x7f0000000800)=0x0) syz_genetlink_get_family_id$fou(&(0x7f00000011c0)='fou\x00') getresuid(&(0x7f0000000840), &(0x7f0000000880), &(0x7f00000008c0)=0x0) r8 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000001200)='/selinux/mls\x00', 0x0, 0x0) fstat(r8, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000a00)={{{@in=@dev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}}}, &(0x7f0000000900)=0xe8) stat(&(0x7f0000000b00)='./file0\x00', &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000bc0), &(0x7f0000000c00)=0x0, &(0x7f0000000c40)) fstat(0xffffffffffffff9c, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000d00)={0x0, 0x0, 0x0}, &(0x7f0000000d40)=0xc) syz_mount_image$ext4(&(0x7f0000000f00)='ext4\x00', &(0x7f0000000f40)='./file1\x00', 0x100, 0x2, &(0x7f00000010c0)=[{&(0x7f0000000f80)="2614033a3bf268f7b913aafefa353b44563206c6dfe132fb9a57ea100262d516d03711cbaf86582c8b2c0a4cfc43d0bc1771bbaafb16eb818101a5e43a6d7b290cc8f6080a0c36c090f05a43f4504423cfff2c5ff675904700042513ecc56f2f6983c16f58c9a1d13ec97301542b87bf03080715d4515ca968c42753fa2f7ea1afd6f85dc213313973f0a4182236d2c5de119a104c50e55d744c7b5464bdbc09f22a3044334883300207bf08177c91b93b1a84e396d4714a", 0xb8, 0x7}, {&(0x7f0000001040)="eb9e3d8589037cd456bbb5d3ca357b53a78bd52bdac3fa090edda68dbe24c2601afef7202ad649ffa6a7d0c4ee25938f0496e65e8bcfd803c82ac2f271b22d8c518c52", 0x43, 0x80000000}], 0x220021, &(0x7f0000001100)={[{@barrier='barrier'}, {@auto_da_alloc='auto_da_alloc'}, {@nouid32='nouid32'}, {@data_ordered='data=ordered'}, {@data_err_ignore='data_err=ignore'}, {@acl='acl'}], [{@dont_appraise='dont_appraise'}, {@mask={'mask', 0x3d, 'MAY_APPEND'}}, {@obj_user={'obj_user', 0x3d, 'tmpfs\x00'}}, {@rootcontext={'rootcontext', 0x3d, 'system_u'}}]}) socket$inet_udp(0x2, 0x2, 0x0) lstat(&(0x7f0000000d80)='./file0\x00', &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r16 = getgid() lsetxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000e40)={{}, {0x1, 0x1}, [{0x2, 0x3, r0}, {0x2, 0x4, r1}, {0x2, 0x0, r2}, {0x2, 0x1, r3}, {0x2, 0x1, r4}, {0x2, 0x0, r5}, {0x2, 0x2, r6}, {0x2, 0x1, r7}, {0x2, 0x4, r9}, {0x2, 0x4, r10}], {0x4, 0x2}, [{0x8, 0x2, r11}, {0x8, 0x3, r12}, {0x8, 0x4, r13}, {0x8, 0x1, r14}, {0x8, 0x4}, {0x8, 0x4, r15}, {0x8, 0x4, r16}], {0x10, 0x5}, {0x20, 0x1}}, 0xac, 0x2) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010ad3b00000007002000010000000000"], 0x1, 0x1) 18:19:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0xffffffffffffff95, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 250.873696] binder: undelivered TRANSACTION_ERROR: 29189 [ 250.894969] binder: undelivered TRANSACTION_ERROR: 29189 [ 250.915821] binder: undelivered TRANSACTION_ERROR: 29189 18:19:03 executing program 0: write$binfmt_aout(0xffffffffffffffff, 0x0, 0xff92) fsetxattr$trusted_overlay_upper(0xffffffffffffffff, &(0x7f00000001c0)='trusted.overlay.upper\x00', 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x8001, @ipv4={[], [], @broadcast}, 0x3}, 0x1c) setsockopt(0xffffffffffffffff, 0x1f, 0x7ff, &(0x7f0000000200)="c0e32cf1578c471f84b113444568aef2ed3afa24cf8efbbd8756df683bb350aa087596d4434927957cc91003236ccaea5e2965c67920beacb24ac9e0568549709e438f76a45cc210a8bdbd9e28e2aa872a1eb314bb46fa71", 0x58) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x3) geteuid() close(r0) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) execve(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) socketpair$unix(0x1, 0xfffffffffffffffb, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) 18:19:03 executing program 2: r0 = getuid() r1 = getgid() chown(&(0x7f0000000080)='./file0\x00', r0, r1) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xa100, 0x0) 18:19:03 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000100)={{0x2, 0x4e21, @remote}, {0x7, @dev={[], 0x18}}, 0x14, {0x2, 0x4e21, @multicast2}, 'dummy0\x00'}) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f00000000c0)={0x0, @aes256}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x1, 0x0) statx(r1, &(0x7f0000000080)='./file0\x00', 0x6000, 0x4, &(0x7f0000000340)) [ 250.934427] binder: 12892:12901 ioctl c0306201 20000000 returned -14 [ 250.942737] binder: 12892:12901 got new transaction with bad transaction stack, transaction 400 has target 12892:0 [ 250.968064] binder: 12892:12901 transaction failed 29201/-71, size 0-0 line 3039 18:19:03 executing program 0: r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000280)='/dev/keychord\x00', 0x10000, 0x0) write$binfmt_aout(r0, 0x0, 0xff92) fsetxattr$trusted_overlay_upper(0xffffffffffffffff, &(0x7f00000001c0)='trusted.overlay.upper\x00', &(0x7f0000000380)=ANY=[], 0x0, 0x1) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000640)) ioctl$EXT4_IOC_RESIZE_FS(0xffffffffffffffff, 0x40086610, &(0x7f0000000000)) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000300)={&(0x7f0000000440)='./file0\x00'}, 0x10) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x2c, r3, 0x721, 0x70bd29, 0x25dfdbfd, {{}, 0x0, 0x4102, 0x0, {0x10, 0x13, @l2={'eth', 0x3a, 'bond0\x00'}}}, [""]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) socket$inet_udp(0x2, 0x2, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) fcntl$setlease(r0, 0x400, 0x1) splice(r1, 0x0, r2, &(0x7f0000000180), 0x0, 0x8) pipe(0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$selinux_create(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_mount_image$f2fs(&(0x7f0000000240)='f2fs\x00', &(0x7f0000000340)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f00000000c0)="1020f5f20100070009000000030000000c0000000900000001000000020000000000000000300000000000000e00000016000000020000000200000002000000020000000e000000000400000004000000080000000c00000010000000140000030000000100000002", 0x69, 0x1400}], 0x0, 0x0) bind(0xffffffffffffffff, &(0x7f0000000080)=@in={0x2, 0x4e20}, 0x7c) 18:19:03 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000"], 0x1, 0x1) 18:19:03 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) [ 250.988228] binder_alloc: binder_alloc_mmap_handler: 12892 20001000-20004000 already mapped failed -16 [ 251.004879] binder_alloc: 12892: binder_alloc_buf, no vma [ 251.006466] binder: BINDER_SET_CONTEXT_MGR already set [ 251.006476] binder: 12892:12901 ioctl 40046207 0 returned -16 18:19:03 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x100, 0x0) ioctl$RTC_WKALM_RD(r0, 0x80287010, &(0x7f0000000080)) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) [ 251.045927] binder: 12892:12909 transaction failed 29189/-3, size 0-0 line 3135 [ 251.053985] binder: send failed reply for transaction 400 to 12892:12901 [ 251.063665] binder: undelivered TRANSACTION_COMPLETE [ 251.069630] binder: 12892:12909 ioctl c0306201 20000000 returned -14 [ 251.079617] binder: undelivered TRANSACTION_ERROR: 29201 18:19:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:19:03 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000240)=0x2, 0x4) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x3}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x40000000000020f, 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000000c0)='ncpfs\x00', 0x2000000280001, 0x0) r3 = dup(0xffffffffffffffff) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x10, 0x1000) ioctl$RTC_VL_CLR(r3, 0x7014) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) [ 251.118092] binder: undelivered TRANSACTION_ERROR: 29189 [ 251.152659] binder: undelivered TRANSACTION_ERROR: 29189 18:19:03 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="0400000000100002000000000000000100040000f64a719ef55f5c749ec8249d0a452086b2f3ecca1862ff3abd9a2d75cad0b91d24a3fffd93d6069a0c8b66b671860ae6f92749da85eadaa4705d6d91c7baf9de36a3a730a3acd80e8f173346d89d6f4fd8ced1bb3a14cab2675c1bd7e1b613efbbc218f0e6d3d49b3aa766ef"], 0x1, 0x2) 18:19:03 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="04000700000000001000022809d5bd6f6fe00000000000200001000000000045cfc7df6889889b9b97082452f602ce4ba8e939b6e281959bb5d8b3d6e46a428ed23b59a0dad5b20be6f9638e76b1491f20f82357b082c952f39108749459c9461d1cd7333003af2b43bec8e8c84619b34b0b160ed3f56129961535dd30e1a8621fe26d9a23dd4b53912896a08b65e7e60474213eb2851efadd43f40ed827c2ffb9bf835152750aefd6cc1c6bbe746705949a2cb4fa98354210ef66f82f3413a753cd036a09f4e545d31eff40a039451bd2d944e707622d2e9a1079b3ea35d16a84f6adcd52f2277e406e6ed72ef03c30afcb269c5e7ce2285e694974b511ead6b6c9aecd302f6a314c1bb6e984b9112a1d00d24a1da750081c7dd691f1ed896ef662b63d8bc5f34fe67e4b5bebd8e7e60ddca6a1ebc0f32dd26b591258539a2800000000000006efff316874aa253b8ad0363847d2600b95a52bc2c25c8e8165357c496a71a31c31f14d9e1c7e5138be97a486c4eba6d2968f57d1728e56b4c8e62cbc38e3e0be34c928eab6218fc0afe36f9691e854ea2cda34b157231cded3b37fe642c876cf18c7fb1b6dd61e53863bf1e19c9535c2d523afe3822cf4508cf78865d96d64e008c50358f0c2d68215e2dc778c44a2910e2a475852e98ed9fb4b9397a122ffd8ed2e407a24aedc09df93081399d95ac987a282896e6e7342d609f1040adbd9ca4366592b90ca65265bd441eab005b5fded7912ef593d32912fde304d2d2d8d4c8488feba19618c16abe188b819f5df825fcad304cb4aa821542994a7cdd546b9ae37b74f36a8088517b9e4dc8e3e5107d9e084ddfe11cd1ae11046d2"], 0x1, 0x1) 18:19:03 executing program 0: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000"], 0x1, 0x1) 18:19:03 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) [ 251.177490] binder: 12943:12946 got new transaction with bad transaction stack, transaction 404 has target 12943:0 [ 251.189966] binder: 12943:12946 transaction failed 29201/-71, size 0-0 line 3039 [ 251.200929] binder_alloc: binder_alloc_mmap_handler: 12943 20001000-20004000 already mapped failed -16 [ 251.219617] binder: BINDER_SET_CONTEXT_MGR already set 18:19:03 executing program 0: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) getpid() rt_sigprocmask(0x2, &(0x7f0000000280)={0x26}, &(0x7f00000002c0), 0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="2321202e2f66696c653020000ab0782ecd5fc7c66f4e95e5b431d6766425fd53fab975a37a3e549d0aaa16b438030055e0ec6329c2c365c9937da1acb4b83d9eb85bf507436127e72d3e6041987d91694bd5554024fa74ea06fd7ad6ca43669da5c299dd40"], 0x65) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580)='/dev/zero\x00', 0x8000, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x63, &(0x7f0000000340)={'HL\x00'}, &(0x7f00000003c0)=0x1e) ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000380)={0x0, &(0x7f0000000340)}) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_ADD(r2, 0x4c80, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) r4 = socket$inet6(0xa, 0x80a, 0x5f7a) listen(r3, 0x80001000) ioctl$sock_inet_SIOCGIFDSTADDR(r4, 0x8917, &(0x7f0000000300)={'rose0\x00', {0x2, 0x4e24, @multicast2}}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x20000004, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) readv(r5, &(0x7f0000000700)=[{&(0x7f0000000440)=""/132, 0x84}], 0x1) r6 = accept4(r3, 0x0, 0x0, 0x0) pause() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) shutdown(r5, 0x1) sendto$inet6(r6, &(0x7f0000000180)="41465a39a172dd651d1f01fcdb315cb1fc1ea8470b32103a9a9ee1d40be9106bc3fedaf3e877113460132182cb1ecd0301db37f72e11b95aa592e5ada4368d91d5502919a4523d017b370f57eed68d0d2bf06798038d0d1e551ebe5b8583ae90b8d3daf27d656dcf5409fe52c6167c96e8cc0498db874c39c7e317ff08cbfe6e2888391c83288ca9ef54ce7231b42e923793cf99e68338f10fee42c601e2016ab984f67a3a285eecc4f670f486ce30db87f9b75852fdc7baab50cbdae084648e0a1750036d89b0a92dea89bb37a79bfc528201ec9a8bd4339ac312bd9b21a741d80dd0f935a1df37bf463ab376", 0xed, 0x0, 0x0, 0x0) [ 251.238516] binder: 12943:12946 ioctl 40046207 0 returned -16 [ 251.238883] binder_alloc: 12943: binder_alloc_buf, no vma [ 251.239025] binder: 12943:12949 transaction failed 29189/-3, size 0-0 line 3135 [ 251.257718] binder: release 12943:12946 transaction 404 out, still active [ 251.278653] binder: undelivered TRANSACTION_COMPLETE 18:19:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x10801, 0x0) getpeername$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000140)=0x14) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$LOOP_SET_FD(r3, 0x4c00, r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 251.297736] binder: undelivered TRANSACTION_ERROR: 29201 [ 251.316450] binder: undelivered TRANSACTION_ERROR: 29189 [ 251.330667] binder: send failed reply for transaction 404, target dead 18:19:03 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x41, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x6) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40021}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)={0xa0, r1, 0x100, 0x70bd2d, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_DEST={0x40, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7f}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x80000000}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xed}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast2}]}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_1\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3a}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x1}, 0x4001) socket$inet6(0xa, 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) 18:19:03 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) 18:19:03 executing program 2: flock(0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x202, 0x0) fcntl$getflags(r0, 0x409) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x20007fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = memfd_create(&(0x7f0000000e40)="0000000000007225f78380807dde5053601841a0d0f82b74374852b01f125997622dc4a5e71d2ce5ac32ff90824fa25e59073487cf36ad576e32926b04894da740f7e9c0ffb42c356a1f285bfc8f0b8c6f72ef151dab4c5c2a5a751f04bfc69ac5c3b5168a6d13d826b1ed0c7527d58f54adc12fca1f25c8fc2586ea4d90f84dabcdec291fb780a39a117d12b0893b182098dceed33b222a1d413709ae355d4d297fe42c5d4e9d8bbd9d0c709cae47e88f8aa22a505b3e995b501f0d3753cd3510e87436612b401305f316177f6d4d4c70fd9d2621c3707ad88da7852596d89a59cb74505e675ac6ebc03faa3ee99889176b571135031afc973c52c5f6437b8143002b30d8fb92011c4994cc024e40497b2daeb06ad5308af486d0178a418f6bdb6940f07dc6e5cf1a3c852b401e3ecec45d22fd687928411b83f68bf7be4b21fdf0033cf949b8a76aa65d68ad885967c2cc3c2d60ec74fcf5de162c94ffe3e15775c1a1cfd9818d4c17a2f8d0a7302538f079e7b128ef123c8bb909000000000000003814c2aea86c35fbf4244a64635d32ff12e4dcb3df56e5d5d3882a9984993f8a7fef72d875d21c1e3bb2bc3e6e79a2b6d322f710f0378abc2095d32139e39f3223db9961309295e4c3c8e1b0001dd757aa000000000000000000000000000008eca80c7b0c", 0x0) execveat(r2, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r3 = getpgid(0x0) r4 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r3, 0x0, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f0000000440)='-bdevprocselinux\\securityE)vmnet1vmnet0selfselfproc\'/securityuser\x00', 0x1) ioctl$int_in(r1, 0x5452, &(0x7f0000000b40)=0x6) ioctl$int_in(r4, 0x5452, &(0x7f0000000140)=0x5) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) getresuid(&(0x7f00000001c0), &(0x7f0000000240), &(0x7f00000002c0)) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000004e2595b8b5b1e07842dd5cfd044ab42552670c492c60e54d0249caab46b095e63c4e810b95e8a04cd1a818110c1841d59bc3de30c7f94fd17a2ba34eac82eb6c22a047c45d91b88a688116998a906203337bdbc22c8304612572cb419168db47b217c750936e967747923a5842e9dd9438aa58c2835cad97731c8ebe9f9ca5a2c329a8b38f14af4ed80c6c08076554df0c1691b1f65752810f3da32c343d5ce8e91e497a6340fb05321c78c9ecc867b15d2462d5412796b73e81c7c210b1c9fc1f1f82332ddb6654b2a8a0206460ff40d4cc0c39f973a127da3f44"], 0x1, 0x1) [ 251.362239] binder: 12968:12969 got new transaction with bad transaction stack, transaction 408 has target 12968:0 [ 251.374751] binder: 12968:12969 transaction failed 29201/-71, size 0-0 line 3039 [ 251.384999] binder_alloc: binder_alloc_mmap_handler: 12968 20001000-20004000 already mapped failed -16 [ 251.394670] binder: BINDER_SET_CONTEXT_MGR already set [ 251.400008] binder: 12968:12969 ioctl 40046207 0 returned -16 [ 251.421567] binder_alloc: 12968: binder_alloc_buf, no vma [ 251.427230] binder: 12968:12971 transaction failed 29189/-3, size 0-0 line 3135 [ 251.439060] binder_alloc: 12968: binder_alloc_buf, no vma [ 251.450643] binder: send failed reply for transaction 408 to 12968:12969 18:19:03 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000"], 0x1, 0x1) [ 251.458281] binder: undelivered TRANSACTION_COMPLETE [ 251.463945] binder: 12968:12969 transaction failed 29189/-3, size 0-0 line 3135 [ 251.482292] binder: undelivered TRANSACTION_ERROR: 29201 [ 251.498046] binder: undelivered TRANSACTION_ERROR: 29189 18:19:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x200000, 0x0) ioctl$PIO_FONT(r2, 0x4b61, &(0x7f0000000100)="ee003efc0379532c5f16f4d759a95ab9415e1d4181f708f091af9d2e6652a6b3b003ca8721") openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 251.508393] binder: undelivered TRANSACTION_ERROR: 29189 [ 251.517380] binder: undelivered TRANSACTION_ERROR: 29189 [ 251.548290] binder: 12989:12991 got new transaction with bad transaction stack, transaction 413 has target 12989:0 [ 251.570008] binder: 12989:12991 transaction failed 29201/-71, size 0-0 line 3039 [ 251.580000] binder_alloc: binder_alloc_mmap_handler: 12989 20001000-20004000 already mapped failed -16 [ 251.590626] binder: BINDER_SET_CONTEXT_MGR already set [ 251.596632] binder: 12989:12998 ioctl 40046207 0 returned -16 [ 251.603599] binder_alloc: 12989: binder_alloc_buf, no vma [ 251.609393] binder: 12989:12991 transaction failed 29189/-3, size 0-0 line 3135 [ 251.618271] binder: send failed reply for transaction 413 to 12989:12991 [ 251.632124] binder: undelivered TRANSACTION_COMPLETE [ 251.643998] binder: undelivered TRANSACTION_ERROR: 29201 [ 251.661121] binder: undelivered TRANSACTION_ERROR: 29189 [ 251.693412] binder: undelivered TRANSACTION_ERROR: 29189 18:19:04 executing program 4: mkdir(&(0x7f0000000080)='./file0\x00', 0x80) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="0400001000020000000000200001000000000200000000000000000000000000000000"], 0x1, 0x1) 18:19:04 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000"], 0x1, 0x1) 18:19:04 executing program 2: mount(0x0, &(0x7f00000002c0)='./file0/../file0\x00', &(0x7f0000000080)='bdev\x00', 0x4000000000000, 0x0) r0 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1}, &(0x7f00000001c0)=0x1c) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000240)) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='cpuset.effective_mems\x00', 0x0, 0x0) write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000100)={&(0x7f0000000000)='./file0\x00', 0x0, 0x18}, 0x10) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000017f00000000"], 0x1, 0x1) 18:19:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x5, 0x10, r1, 0x0) setxattr$security_evm(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='security.evm\x00', &(0x7f0000000380)=@v2={0x5, 0x3, 0x11, 0x9, 0xf3, "14a14b63255f3fce08ac42a720238c81bd2db95137aa2397c7c5435f2693f5853c03e1d7f2aa93ba29ef5dcccf7dd2765c4ea629753b658709e459be19fc5aa08d27dc80f18cccd077ae63239cf7e3ead9ca2f52d0086c85344d820caa130bf37762062b551c07bb46224e9ca650f0254e996a6267129f4e909bb22ac6d3ac6fa23e9dc8bc3902848f5b00180fe990f021cb18345aa71ccc946f7a52c53ee20c4bf1e80cd8be19c5b43558cdc36d2029216ed97745fc9baf979f0ccb4ecbfb2f648df355cf81085e8e61bb7dc72b27ca1e7551a0166673369ada813b67adccc272b65c6c064913e465541ed0f4d58eab96c91d"}, 0xfd, 0x3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x1c, 0x0, &(0x7f0000000080)=[@register_looper, @dead_binder_done, @free_buffer={0x40086303, r2}], 0x98, 0x0, &(0x7f00000000c0)="54688b6ff978ab0e40f6a107c58cefef5f6ed29e40d899712faf728f5df1aae643dea9b14094a53e3218ae4d4d24a6c15bf3f6aef8d4787af20e6295d55b07b3b771568235133e6ffff61c9fd87d95731c78c4c40ed4f032c90cdae5733255b8d4c9207421a4937bbf9389c87fcbd96e12fc08ef5c883e8738d0e97dfbefa1260414757166111d51c53d865a487c12428a6a3a9d42f1d52e"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:19:04 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) r0 = accept$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @multicast1}, &(0x7f0000000080)=0x10) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000340)=@filter={'filter\x00', 0xe, 0x4, 0x3a0, 0x0, 0xc0, 0xc0, 0xc0, 0x0, 0x308, 0x308, 0x308, 0x308, 0x308, 0x4, &(0x7f00000000c0), {[{{@uncond, 0x0, 0x98, 0xc0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x3}}}, {{@ip={@remote, @broadcast, 0xff, 0xffffffff, '\x00', 'bpq0\x00', {}, {0xff}, 0x29, 0x1, 0x1}, 0x0, 0xf0, 0x150, 0x0, {}, [@common=@icmp={0x28, 'icmp\x00', 0x0, {0x0, 0x23c9312, 0x7}}, @common=@addrtype={0x30, 'addrtype\x00', 0x0, {0x1, 0x4, 0x0, 0x1}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x5, [0xad, 0xffff, 0x4, 0x100, 0x4, 0xfff], 0x7f}, {0x3, [0x1, 0x1, 0x3f, 0x400, 0x100000000, 0x800], 0x4617af6f, 0x7}}}}, {{@uncond, 0x0, 0x98, 0xf8}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xc8, [0x9, 0x9, 0xffff, 0x2, 0x6, 0x2], 0xfff, 0x13}, {0x80000001, [0x7, 0x5, 0x6, 0x10001, 0x3, 0xfffffffffffffff7], 0xf, 0x8}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x400) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) socket$inet(0x2, 0x0, 0x1) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) readlink(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=""/63, 0x3f) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000100)=0x20400030) pipe2(&(0x7f0000000240)={0xffffffffffffffff}, 0x84800) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f00000002c0)={0x56b, 0x1, 0x1}) [ 251.870798] binder: 13015:13023 ERROR: BC_REGISTER_LOOPER called without request [ 251.878528] binder: 13015:13023 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 251.889009] binder: 13015:13023 BC_FREE_BUFFER u0000000000000000 no match [ 251.898117] binder: 13015:13023 got new transaction with bad transaction stack, transaction 417 has target 13015:13023 [ 251.909079] binder: 13015:13023 transaction failed 29201/-71, size 0-0 line 3039 [ 251.917773] binder_alloc: binder_alloc_mmap_handler: 13015 20001000-20004000 already mapped failed -16 [ 251.933197] binder: BINDER_SET_CONTEXT_MGR already set [ 251.938581] binder: 13015:13023 ioctl 40046207 0 returned -16 [ 251.944763] binder_alloc: 13015: binder_alloc_buf, no vma [ 251.950498] binder: 13015:13032 transaction failed 29189/-3, size 0-0 line 3135 [ 251.958220] binder: 13015:13023 ERROR: BC_REGISTER_LOOPER called without request [ 251.966562] binder: 13015:13023 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 251.974266] binder: undelivered TRANSACTION_ERROR: 29189 [ 251.974346] binder: 13015:13023 BC_FREE_BUFFER u0000000000000000 no match [ 251.986793] binder: release 13015:13023 transaction 417 in, still active [ 251.994638] binder: send failed reply for transaction 417 to 13015:13023 [ 252.001715] binder: undelivered TRANSACTION_COMPLETE [ 252.006820] binder: undelivered TRANSACTION_ERROR: 29201 [ 252.012315] binder: undelivered TRANSACTION_ERROR: 29189 18:19:04 executing program 0: socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x1, &(0x7f00000003c0)=ANY=[@ANYPTR], &(0x7f0000000180)="4550d4001f91eb2f57b73224433025039c3096b20c6b439348bf689c08608537d6223e63adc0624fbae2e109359dce6922324ccc13160b68cae6430697259dd52d1f73e16adc3592d02925dffae85e9cd2398c6c67c87fb5b12602f145b484be45912966e8b7e2f66069c56dd76c1dc112013c3a6b4de999cdcdc8855aee3437dcc87580cfbe546fbbfbc0eb56d8bbbea2904a7c73c2", 0x0, 0x0, 0x0, 0x40f00}, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) 18:19:04 executing program 1: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0400070000000000100002000000000020000100000000"], 0x1, 0x1) 18:19:04 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) 18:19:04 executing program 3: mkdir(&(0x7f0000000100)='./file0\x00', 0x3) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000edd506434f30e57fb46dc1c32f73e6652186beeda5b52459967194ea4069d5d06c3baf"], 0x1, 0x1) 18:19:04 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) mmap(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@multicast1}}, &(0x7f00000001c0)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000440)={{{@in, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000240)=0xe8) r3 = getuid() getresuid(&(0x7f00000002c0), &(0x7f0000000540)=0x0, &(0x7f0000000580)) mount$bpf(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x40000, &(0x7f00000005c0)={[{@mode={'mode', 0x3d, 0x1}}, {@mode={'mode', 0x3d, 0x200}}, {@mode={'mode', 0x3d, 0x1000}}, {@mode={'mode', 0x3d, 0x9}}, {@mode={'mode', 0x3d, 0x3}}, {@mode={'mode', 0x3d, 0x3}}, {@mode={'mode', 0x3d, 0xe076}}, {@mode={'mode', 0x3d, 0x5}}], [{@obj_type={'obj_type', 0x3d, 'vboxnet1'}}, {@uid_eq={'uid', 0x3d, r1}}, {@fowner_eq={'fowner', 0x3d, r2}}, {@smackfshat={'smackfshat', 0x3d, '/dev/ashmem\x00'}}, {@smackfsdef={'smackfsdef'}}, {@euid_eq={'euid', 0x3d, r3}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@subj_role={'subj_role', 0x3d, 'vmnet0)ppp1'}}, {@euid_lt={'euid<', r4}}]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) r5 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r6 = getuid() getgroups(0x8, &(0x7f00000000c0)=[0x0, 0xee01, 0xee01, 0xee00, 0xee00, 0xee00, 0x0, 0xffffffffffffffff]) fchownat(r5, &(0x7f0000000080)='./file0\x00', r6, r7, 0x1000) 18:19:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1163484000000100000000000000000000000000000000885f2a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 18:19:04 executing program 3: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="0451d9d0a224ce9dd2b8bd7dc5392e000700000000001000"], 0x1, 0x1) memfd_create(&(0x7f0000000000)='system.posix_acl_access\x00', 0x4) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r0) 18:19:04 executing program 0: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {0xfffffffffffffffe}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0xff}, 0xa, @in6, 0x0, 0x3, 0x0, 0xdffffffffffffffe}}, 0xe8) munlockall() sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x0) 18:19:04 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040000000000000000010200000000002000010000000000"], 0x1, 0x1) 18:19:04 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0xa0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)=ANY=[@ANYBLOB="040007000000000010000200000000002000010000000000"], 0x1, 0x1) [ 252.135294] binder: 13041:13045 got transaction to invalid handle [ 252.150758] binder: 13041:13045 transaction failed 29201/-22, size 0-0 line 3012 [ 252.174446] binder_alloc: binder_alloc_mmap_handler: 13041 20001000-20004000 already mapped failed -16 [ 252.186075] binder: BINDER_SET_CONTEXT_MGR already set [ 252.186929] ================================================================== [ 252.186967] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x27f9/0x2880 [ 252.186975] Read of size 4 at addr ffff88819e217680 by task syz-executor0/13056 [ 252.186977] [ 252.186987] CPU: 0 PID: 13056 Comm: syz-executor0 Not tainted 4.14.88+ #23 [ 252.186990] Call Trace: [ 252.187003] dump_stack+0xb9/0x11b [ 252.187022] print_address_description+0x60/0x22b [ 252.187038] kasan_report.cold.6+0x11b/0x2dd [ 252.187048] ? xfrm_state_find+0x27f9/0x2880 [ 252.187066] xfrm_state_find+0x27f9/0x2880 [ 252.187118] ? xfrm_state_afinfo_get_rcu+0xb0/0xb0 [ 252.187148] ? perf_trace_lock+0x11a/0x4c0 [ 252.187184] ? unwind_next_frame+0xea9/0x1930 [ 252.187206] xfrm_tmpl_resolve_one+0x1c6/0x7f0 [ 252.187238] ? xfrm_expand_policies.constprop.13+0x280/0x280 [ 252.187257] ? __lock_acquire+0x619/0x4320 [ 252.187270] ? kernel_text_address+0x10b/0x120 [ 252.187304] xfrm_resolve_and_create_bundle+0x21a/0x2550 [ 252.187329] ? check_preemption_disabled+0x34/0x1e0 [ 252.187346] ? perf_trace_lock+0x11a/0x4c0 [ 252.187354] ? __lock_acquire+0x619/0x4320 [ 252.187370] ? perf_trace_lock_acquire+0x4d0/0x4d0 [ 252.187387] ? xfrm_tmpl_resolve_one+0x7f0/0x7f0 [ 252.187405] ? trace_hardirqs_on+0x10/0x10 [ 252.187415] ? check_preemption_disabled+0x34/0x1e0 [ 252.187442] ? xfrm_sk_policy_lookup+0x2ae/0x3b0 [ 252.187455] ? lock_downgrade+0x560/0x560 [ 252.187465] ? lock_acquire+0x10f/0x380 [ 252.187477] ? check_preemption_disabled+0x34/0x1e0 [ 252.187490] ? check_preemption_disabled+0x34/0x1e0 [ 252.187510] ? xfrm_sk_policy_lookup+0x2d5/0x3b0 [ 252.187531] ? xfrm_lookup_with_ifid+0x246/0x1870 [ 252.187541] xfrm_lookup_with_ifid+0x246/0x1870 [ 252.187554] ? print_cfs_rq.cold.9+0x9f8/0xba1 [ 252.187574] ? xfrm_policy_lookup_bytype.constprop.15+0x1250/0x1250 [ 252.187591] ? trace_hardirqs_on_caller+0x381/0x520 [ 252.187605] ? rt_set_nexthop.constprop.14+0x242/0xc30 [ 252.187628] ? ip_route_output_key_hash+0x1c3/0x2d0 [ 252.187640] ? lock_downgrade+0x560/0x560 [ 252.187648] ? lock_acquire+0x10f/0x380 [ 252.187664] ? check_preemption_disabled+0x34/0x1e0 [ 252.187686] ? ip_route_output_key_hash+0x1ea/0x2d0 [ 252.187699] ? ip_route_output_key_hash_rcu+0x21a0/0x21a0 [ 252.187723] xfrm_lookup_route+0x37/0x1b0 [ 252.187740] ip_route_output_flow+0x86/0xa0 [ 252.187755] udp_sendmsg+0x1377/0x1da0 [ 252.187774] ? ip_reply_glue_bits+0xa0/0xa0 [ 252.187796] ? udp_v4_get_port+0xf0/0xf0 [ 252.187813] ? check_preemption_disabled+0x34/0x1e0 [ 252.187866] ? trace_hardirqs_on+0x10/0x10 [ 252.187885] udpv6_sendmsg+0x125f/0x2510 [ 252.187909] ? check_preemption_disabled+0x34/0x1e0 [ 252.187940] ? udp_v6_flush_pending_frames+0xd0/0xd0 [ 252.187949] ? perf_trace_lock+0x11a/0x4c0 [ 252.187980] ? reacquire_held_locks+0xb5/0x3e0 [ 252.187992] ? release_sock+0x1b/0x1b0 [ 252.188026] ? inet_autobind+0x121/0x180 [ 252.188039] ? lock_downgrade+0x560/0x560 [ 252.188058] ? __local_bh_enable_ip+0x65/0xb0 [ 252.188072] ? trace_hardirqs_on_caller+0x381/0x520 [ 252.188092] ? inet_sendmsg+0x168/0x540 [ 252.188100] inet_sendmsg+0x168/0x540 [ 252.188117] ? inet_recvmsg+0x560/0x560 [ 252.188128] sock_sendmsg+0xb5/0x100 [ 252.188144] ___sys_sendmsg+0x41d/0x890 [ 252.188157] ? drop_futex_key_refs.isra.3+0x17/0xa0 [ 252.188176] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 252.188189] ? futex_wait_restart+0x1f0/0x1f0 [ 252.188200] ? kmem_cache_alloc+0xe4/0x2b0 [ 252.188212] ? alloc_file+0x24/0x3b0 [ 252.188244] ? __fget+0x204/0x3a0 [ 252.188275] ? __fget+0x22b/0x3a0 [ 252.188297] ? __fget_light+0x192/0x1f0 [ 252.188318] __sys_sendmmsg+0x13d/0x360 [ 252.188337] ? SyS_sendmsg+0x40/0x40 [ 252.188352] ? __might_fault+0x104/0x1b0 [ 252.188366] ? lock_acquire+0x10f/0x380 [ 252.188376] ? __might_fault+0xd4/0x1b0 [ 252.188404] ? _copy_to_user+0x7f/0xc0 [ 252.188419] ? put_timespec64+0xb9/0x110 [ 252.188432] ? nsecs_to_jiffies+0x30/0x30 [ 252.188452] ? do_clock_gettime+0x30/0xb0 [ 252.188472] ? SyS_clock_gettime+0x7b/0xd0 [ 252.188485] ? do_clock_gettime+0xb0/0xb0 [ 252.188511] SyS_sendmmsg+0x2f/0x50 [ 252.188525] ? __sys_sendmmsg+0x360/0x360 [ 252.188536] do_syscall_64+0x19b/0x4b0 [ 252.188560] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 252.188568] RIP: 0033:0x457659 [ 252.188573] RSP: 002b:00007fbd51825c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 252.188585] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000457659 [ 252.188599] RDX: 0000000000000001 RSI: 0000000020000a80 RDI: 0000000000000004 [ 252.188605] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 252.188612] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbd518266d4 [ 252.188619] R13: 00000000004c3e14 R14: 00000000004d6c38 R15: 00000000ffffffff [ 252.188646] [ 252.188650] The buggy address belongs to the page: [ 252.188657] page:ffffea00067885c0 count:0 mapcount:0 mapping: (null) index:0x0 [ 252.188665] flags: 0x4000000000000000() [ 252.188679] raw: 4000000000000000 0000000000000000 0000000000000000 00000000ffffffff [ 252.188690] raw: 0000000000000000 ffffea00067885e0 0000000000000000 0000000000000000 [ 252.188694] page dumped because: kasan: bad access detected [ 252.188696] [ 252.188699] Memory state around the buggy address: [ 252.188706] ffff88819e217580: 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 f2 f2 f2 [ 252.188713] ffff88819e217600: f2 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 [ 252.188720] >ffff88819e217680: f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 f2 f2 [ 252.188724] ^ [ 252.188730] ffff88819e217700: f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 252.188737] ffff88819e217780: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 [ 252.188741] ================================================================== [ 252.188743] Disabling lock debugging due to kernel taint [ 252.188770] Kernel panic - not syncing: panic_on_warn set ... [ 252.188770] [ 252.188781] CPU: 0 PID: 13056 Comm: syz-executor0 Tainted: G B 4.14.88+ #23 [ 252.188784] Call Trace: [ 252.188795] dump_stack+0xb9/0x11b [ 252.188808] panic+0x1bf/0x3a4 [ 252.188819] ? add_taint.cold.4+0x16/0x16 [ 252.188847] kasan_end_report+0x43/0x49 [ 252.188858] kasan_report.cold.6+0x77/0x2dd [ 252.188867] ? xfrm_state_find+0x27f9/0x2880 [ 252.188889] xfrm_state_find+0x27f9/0x2880 [ 252.188943] ? xfrm_state_afinfo_get_rcu+0xb0/0xb0 [ 252.188964] ? perf_trace_lock+0x11a/0x4c0 [ 252.188993] ? unwind_next_frame+0xea9/0x1930 [ 252.189009] xfrm_tmpl_resolve_one+0x1c6/0x7f0 [ 252.189031] ? xfrm_expand_policies.constprop.13+0x280/0x280 [ 252.189054] ? __lock_acquire+0x619/0x4320 [ 252.189064] ? kernel_text_address+0x10b/0x120 [ 252.189080] xfrm_resolve_and_create_bundle+0x21a/0x2550 [ 252.189091] ? check_preemption_disabled+0x34/0x1e0 [ 252.189105] ? perf_trace_lock+0x11a/0x4c0 [ 252.189114] ? __lock_acquire+0x619/0x4320 [ 252.189130] ? perf_trace_lock_acquire+0x4d0/0x4d0 [ 252.189142] ? xfrm_tmpl_resolve_one+0x7f0/0x7f0 [ 252.189155] ? trace_hardirqs_on+0x10/0x10 [ 252.189165] ? check_preemption_disabled+0x34/0x1e0 [ 252.189179] ? xfrm_sk_policy_lookup+0x2ae/0x3b0 [ 252.189191] ? lock_downgrade+0x560/0x560 [ 252.189198] ? lock_acquire+0x10f/0x380 [ 252.189208] ? check_preemption_disabled+0x34/0x1e0 [ 252.189220] ? check_preemption_disabled+0x34/0x1e0 [ 252.189235] ? xfrm_sk_policy_lookup+0x2d5/0x3b0 [ 252.189249] ? xfrm_lookup_with_ifid+0x246/0x1870 [ 252.189258] xfrm_lookup_with_ifid+0x246/0x1870 [ 252.189268] ? print_cfs_rq.cold.9+0x9f8/0xba1 [ 252.189284] ? xfrm_policy_lookup_bytype.constprop.15+0x1250/0x1250 [ 252.189297] ? trace_hardirqs_on_caller+0x381/0x520 [ 252.189307] ? rt_set_nexthop.constprop.14+0x242/0xc30 [ 252.189322] ? ip_route_output_key_hash+0x1c3/0x2d0 [ 252.189332] ? lock_downgrade+0x560/0x560 [ 252.189339] ? lock_acquire+0x10f/0x380 [ 252.189352] ? check_preemption_disabled+0x34/0x1e0 [ 252.189367] ? ip_route_output_key_hash+0x1ea/0x2d0 [ 252.189378] ? ip_route_output_key_hash_rcu+0x21a0/0x21a0 [ 252.189395] xfrm_lookup_route+0x37/0x1b0 [ 252.189410] ip_route_output_flow+0x86/0xa0 [ 252.189423] udp_sendmsg+0x1377/0x1da0 [ 252.189438] ? ip_reply_glue_bits+0xa0/0xa0 [ 252.189456] ? udp_v4_get_port+0xf0/0xf0 [ 252.189471] ? check_preemption_disabled+0x34/0x1e0 [ 252.189506] ? trace_hardirqs_on+0x10/0x10 [ 252.189519] udpv6_sendmsg+0x125f/0x2510 [ 252.189532] ? check_preemption_disabled+0x34/0x1e0 [ 252.189551] ? udp_v6_flush_pending_frames+0xd0/0xd0 [ 252.189559] ? perf_trace_lock+0x11a/0x4c0 [ 252.189585] ? reacquire_held_locks+0xb5/0x3e0 [ 252.189594] ? release_sock+0x1b/0x1b0 [ 252.189615] ? inet_autobind+0x121/0x180 [ 252.189625] ? lock_downgrade+0x560/0x560 [ 252.189648] ? __local_bh_enable_ip+0x65/0xb0 [ 252.189659] ? trace_hardirqs_on_caller+0x381/0x520 [ 252.189672] ? inet_sendmsg+0x168/0x540 [ 252.189680] inet_sendmsg+0x168/0x540 [ 252.189692] ? inet_recvmsg+0x560/0x560 [ 252.189701] sock_sendmsg+0xb5/0x100 [ 252.189713] ___sys_sendmsg+0x41d/0x890 [ 252.189724] ? drop_futex_key_refs.isra.3+0x17/0xa0 [ 252.189739] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 252.189751] ? futex_wait_restart+0x1f0/0x1f0 [ 252.189758] ? kmem_cache_alloc+0xe4/0x2b0 [ 252.189768] ? alloc_file+0x24/0x3b0 [ 252.189787] ? __fget+0x204/0x3a0 [ 252.189811] ? __fget+0x22b/0x3a0 [ 252.189829] ? __fget_light+0x192/0x1f0 [ 252.189845] __sys_sendmmsg+0x13d/0x360 [ 252.189858] ? SyS_sendmsg+0x40/0x40 [ 252.189870] ? __might_fault+0x104/0x1b0 [ 252.189880] ? lock_acquire+0x10f/0x380 [ 252.189889] ? __might_fault+0xd4/0x1b0 [ 252.189917] ? _copy_to_user+0x7f/0xc0 [ 252.189941] ? put_timespec64+0xb9/0x110 [ 252.189969] ? nsecs_to_jiffies+0x30/0x30 [ 252.189986] ? do_clock_gettime+0x30/0xb0 [ 252.190000] ? SyS_clock_gettime+0x7b/0xd0 [ 252.190017] ? do_clock_gettime+0xb0/0xb0 [ 252.190033] SyS_sendmmsg+0x2f/0x50 [ 252.190043] ? __sys_sendmmsg+0x360/0x360 [ 252.190053] do_syscall_64+0x19b/0x4b0 [ 252.190071] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 252.190076] RIP: 0033:0x457659 [ 252.190082] RSP: 002b:00007fbd51825c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 252.190093] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000457659 [ 252.190099] RDX: 0000000000000001 RSI: 0000000020000a80 RDI: 0000000000000004 [ 252.190105] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 252.190111] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbd518266d4 [ 252.190117] R13: 00000000004c3e14 R14: 00000000004d6c38 R15: 00000000ffffffff [ 252.191685] Kernel Offset: 0x15800000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 253.184131] Rebooting in 86400 seconds..