2a37c52c9a0dd9655f20cadf01ad34bf1d9b790e872a75fdaf0896a9e5678a529d04f0cc000b69a661ea000cc8f95e1e3ff7887fd32aab6dc8a7d63ec2d69a3c00aa5b08b0dd8866524d9fe367f4719244b012e06d387e1afc3652de99bf365c2584149cf6a9f088228e034e15142002e810557a373468cc2eb9280d7ca6b78ccfb63c2c5e3d1f23772a26e2407b0eceef0e2e38fe3f5f9d34e8656644868b9445ff89a712bbfd5eea6fbfe0cd9b2c2e5f40c3c0ce9642b7d6a1c60cfc1bd99ab583d069cd7a4a759ad368db507e7bffd6f79aabacf6d4fd6a9ea6bbfa2e95b08b170716851b48c129e15fff6a2b671e3beebe05dc336fd0c992aacb6a02800cb55c7b4ac3911bbcf24f7cdb29ece0c61cb44b13ac3db79f6b74ac35b6b2e91dc2e832fa3744f20b1d858c252ee3d2f7dbdba44e64136c0f1bfe81bc44ce1303adef408e8a109725433fba857c12ee146c9156f59542f7cc3c95b130f1a8abb1b64e96bb75eb67c9bc0bdd015ef5a25150614927e42c70923895cfdefde5c7468b65ad2585641031e8ba09f165083aee035bc4ad3ffdc6d95d6d5d24b5ad8bcd4d9bd66072241afd935a6d9eba2034b498fb23d93b41f8f50e63456889f9e0fa540b701da833db8b0cd568544036eb553d97801a87b608e02b6d95750c2aa5c7249e93a9aa09e961e5ecd48da17483886de449847fa4631f85f8dc0114051b8ba18170f7f4ae8fca9ef923f98ee427526edddcdf40ca6171e886d559f73a483f263e4ba82747c1767d97ab8eab309d0936b27a2c93a1bbbc33b0929e5857ab6d02049b8f64d6370111457f585b5757090c879f294bbb25bf84c415de529b70194c31bef1036ea856ec0775b2dd2567c84c305c1ee6ebe816d152b5c369e8474055412e4a334dd3d27d38a197d85c04063e13e5805031d2d8d9bef8cbc7ff443b985f64748ac8631826fd51c4192640cf7e607b4399f13e1733e639075df17d5a38ac9819822bca1a8411b25a7ca9fbc80aa986a85111ff0a4435e2e4fbf7c3ba0c7ac4df58a6da7f0b5250d6f01af895d552d691e909a61d4a4b5218142c08c988f68c5b3f7d024d8e45d9aa9c40347bcc65413e8e3666666b65051f15687eddd53e46a9598a40fc45506226d7733a1e36c0e9f89ffc442c152353a5bc40e128213ec90048db62e59e92b0fdc9c075e75cc10978c2d3a60193bb11e95bdb630d6588d263ba6677180f01a03fca33628cce98456a2eba0e13ca983c2c64c6432ab17e2b9363d9f7069b5d78e3a63cdf221cfa8f925d9f5deed1fff5e666eb60b1f57fa27091e7561518934474deb614b1cdef55f9b78294a0aed72d426cc4d7f61d151cf12f00bafa2211e797fc0042cebc81d47c46f3be02af53f0b03f43f0862eb8cf0c0c6243e8c44e2748ed36e5c715d12704dc1e8038ed687705847be84630abb349b504073a78b7e90d3948e1a0c5accfc79d377311b1d3ad63a37c3b88873c82ea7169c2733bd4ba465600bdbc745559ce60626b6c6adbc56e507d3a5fbcca6a9401885d2a18e9b1f51a40c94e0d6ac248a5abfae8de7b94c403e54c1768cdb8fe26529d45fab7b4a0ce832dd1ea4167122e1cd8609fe55a977a127288cb19406db2f0318bab7526e75d02d07adc2babbe351f952ab62efbd13a52aae227b789f36895a16e345057503ebef56c3995a8ee2bb6a6dbda2d7296104ecf60e38be058675fd881a724890a68d48d23267a3402dc17168b4dd8d551804440980feacc07ca1ac53b3b51ebc80c434a2f9a13381f3ddf3a1ca7bc1aef4732727e267945b2cc3f37a6353f2d912bc44b67a7abef4c3af41b3b20b1bf47feb7a3194d5dc552f36751f723642d2a0c9f4546320de4d4fc717407a81eb9b53d19bbca363935b1753ae176bfbab1b68948120fb2935b539ea8a6a7756b02c6212209514499c601c6a8f9892db72530053761187caa0c46358db809aa00d7ca084c60021031ebc19d6e181eb0010b320ab531a948b511df69f71c46afff1be3273e2bf1b8a52cf39a970433bd662bc592b03906a3302f4cc70f973529453ab22ca1cb5af50cf86354a3cfb6dc7a6d3cc972db9ef829f50e137573a319e350eed1acfe3ea2520e98dbd31eb1e9c5bb7c8e60675c929f7d29a72708963b303852b46df53faf3d83c90694f452afeb31f8a65ce33f6d7c72fd3461e0e67e6381995602ba697dc39c1e4cf5ef3e4c0849bb4840855f9b21d90c45b16a014b13146d6efd2573fe0219f1363f5a3855d066a6ec23e0d09b5e3d11d0f573cfdf36bf3532718f43bb65dd1158a5e31f5f5f783b0f02c3cefd1461633839b9aa5cdb1ac9ad40c0e855ff957db0f700f3dd65462dcac608d5586aff4b2308db82f9766f5bb04514ed73b3491368c721343061f43624f18c385b7beed29f9580e2af512b2eabdec7a2d45c2f569e645492ecdee508355973b69c5d1f26802d036e9b3711e74f3cfaa6b73996a8ff44011f1940cbadf1a126da6a4e1043b771fed4e0e597f6ce38428e141b93e5bf49953ce792817610a9d92fd4582bae80ad6fcf802281414676bdc7ca4dd4da5c0de2870a086eea6de326e1e3b1c6793662813c16215ac9ff88d894496729a4260beda65337dc21b0b82dc086372157d0705b01f570c0aed85ea2074ae1110a51079ba90e0cc8ebfa7dd936efabb1170573e003d01ea677f3b21c102cc36754cb8a31dc0e89052768f386f3f63ad391ef24ffa911971b844685903f0e8d1b7486057f9a3dab2cf8a4c355c681cf07e7bb0f6f97a0322816582e42d1d1217cb47a981ead9ad48230660cf7444ce0a264e4566eff93c3a8ee55965c84e8871ebc95994bb46fa6691c9c80e5425bc919ff9f1b8bb11e3424f3ec1c92df809741aadbbca5bb3b0baa29a6073fe6bf44675af5567ebf822245ad18dc04cf3ccdbb80524f634c49ed5e4bb32214b5f0c05ce850d0b0fb6b5bf73f966b22c933f24aa24d54146a02d29ee82a66e56a34c691d1cb2ea128d78c89918ea6f8dcfd0a0028ebc5c30bec2768660abc9e0f84bdde466b31ee1a0c90a51eeeb4e756f98ccafe0cf5b12d0c19daeeb77911b83206cfac06368c7cf023f774258e6685f5102c09d0495c5579783d07a727562b9d4c9fec69f9d45ed1fde15f6a3306102c5ee05f8d9e2ecff6186e37191cfc40e63285b5ee33437a88b59e307126f54c43e25e535be44a4c64d9f072b45d6bb5eee7d342c5701c452adf021a61b16e58f6a5dc82c6c150bb12136b48e47854ee5a6f69e1405b9f540d673a56076eaa1342ee9b06bf4ae96a9d682a7b078c92a12c5bf43cad55beff835bd5ae87aec8cbef86685b2c51efc93c3609e8e1bd468c17443501134b29f44f99c86c206df5fa86c7ac511a616b89bb5803993a68d6cd3428b981d65b94442d6e69afdcc783685d58973a544db9f8227b7b13021596cb08c00501618e31c84f66e3da77900d5b1f5caaf5b8f4dcdfb3cd45a72d524eedbc1667fd7a2c4a52c53a261566492fa10caf56f0f405a2e26a99e8dbdd4469f5bcde76e6d26da2feed9d8f61ea352d29034d8751401f1052048edc0623f819eb8717734e775b8e5ce37f5e37f8449c79430a5c5947450a59f057d8a6ddb677ef27fd8c98913558f0ed3a2ac37627492610d724e3795e0839299098a063feb3f6f4e5527f5d2d497c2e4556801163107a294a1889d5f9092ea5ed77712f6cf1249408860877b8020efe602af504749cc72459ef10beb9076500fac26f746053b43fee21a1a89821eeab01061b763f37129af0a80bd13aa8de318cb91cd1f07d7429ba41e80a0449245419bb117f24decabd5362525576f8349aed4e0e415dfb4222b12d7624591db36c3c5ed44e252f4bf8bd3f52c23e3737792da030d20459b35eebf5c222e220af7310b7d690c49b638186dc82db849aae18c88c47dafcee602fd3f98d87cc9c0175fb0302948a7d0ffbb3204497d4b008d42087065f4f703ac6e2f6c5531ba3db56d1b743d9e4c7a34e085c1a36bf054f095b7243e073672f59968d1217bdd991efc7c009c7584bf6d85238ae64a779ae561fb80bdd7c19ff62fc8ddefaf13e340da707d9229dc5e7c9708a4cc9c773152269a90e6d5962f6378d3a2f6c5d0d14cc3a51cade1e7396a3daf5e0ec9103be56d67d0da809e0646e8e2c56608f392b39073a41ca9abb6cfa92166e3aface855b5d029ccfc6b1f50ef354769e7f6a48cd62596f7b36578109ce0248d790e3d80c6fd6983c24f26374b13e15ae578265a5e2dd7cf8556db70cf625490fdbda432bee24baeb278fa42487873d110c4ce915fca203d7e8570ebcd9c8b18164ac50cebba33054e378392663b09b70e2267542fa36ed508ff07de91dd3eacbf6fe0e753fac948743d98382c4ee2e87d9bef2ed99bc5c790d9d6b7de0e7cd32270fde20cccee402e144d30d4ca0b00af2045c2eb456b14f7af65c09be56d423044b2f8ce64ee5909a8dece456081c8222b860504c2d2036b77f73ce5b70b48e749737a564dbb4c99115677cf659520e350d3104ad568e71b98409af861802506abddf19b1796aadbbbf5075809a8d263d08cde6855206106b8ed54efe04132fa5e56b4390"}, 0x1019) ioctl$BLKDISCARD(r1, 0x1277, &(0x7f00000000c0)=0x8) 08:14:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1550.391535] binder: 12776:12782 ioctl c0306201 0 returned -14 [ 1550.406346] binder: undelivered TRANSACTION_COMPLETE [ 1550.427787] binder: release 12785:12786 transaction 1331 out, still active 08:14:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) mkdirat(r3, &(0x7f0000000080)='./file0\x00', 0x0) ftruncate(r1, 0x5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) r2 = fcntl$getown(r0, 0x9) sendmsg$netlink(r1, &(0x7f00000030c0)={&(0x7f0000000040)=@kern={0x10, 0x0, 0x0, 0x2c0}, 0xc, &(0x7f00000000c0)=[{&(0x7f0000000380)={0x40c, 0x33, 0x200, 0x70bd2b, 0x25dfdbfe, "", [@nested={0x3b8, 0x18, [@generic="4e02f81b5afdbbd200325bd4b7f9bb01f5e57b45e7631f25854c1029c0fc6fb545208fdee5a1a2ca0cc41aa9de879a1f181e114ad19c3f6b80a1fe8c0a609e0f4e1216c6e13493e39f511b4423830b45e4d35f9a3ae3562a1e1710b7fa86f7ae17d2c0c47ce488fdbe1c6f1614d95c5fc83ce0a7e7d58617fbbb696a0e454742695d6a0c9a66d5d57bd20215850ca267a6f18f7daff7b3d76b6ab64c08483f19ec5240fbd92ef8f48dd88c343513bbe5a6332e92c9c4d922cd140f3abd2b42c6b28fcfbab8ac54a0b2d4db2589b1020b8d90fb98ebc7879c69f63e94c93494c936bee30930f662c09d5ecdf9c9a3d0943a45c717", @generic="d163495d3447dddfbd2c4bc283939d2592cd27f450d396ea7ae7dad8529ffe892323f6affd9c6f13d4cbf8842ef70442cff3895e03588b905f6bafe0927a8df7b4405b82b66e66251e15cc3ffcb6f67d769148bc1b55ac6a455e17a17b97a7fc09d85baf3292a9f36045053a5b4837c7e969c9abdd6387fd79980b3a826d930192cc496e4ea04b0946df", @typed={0x14, 0x6f, @ipv6=@ipv4={[], [], @broadcast}}, @generic="76097bdd964bb36c9099251b43e71feda2ed3b5a587d3fceea1ad21342d3e4ef1fa364bb66e3dde051eccc0a4255ca14ed", @generic="806c4c195ea675a962656a9a82daa25b93a407be545537a62c8ef1fc446fac1c2c52cf2952bad4e63654dd64f48e52573a80a7cdd18e9b056d1854b5b80d172f8a65532efa3d521891", @generic="29dfd382dfa8e8903d1e2beadc6424e530c3a3e88c36c229bf9338a7bcfeb920bcafdb0d94563c9e1f4f09566692677d45ca7b95114a927683e6b3cffa4893145829ff9ed48252644d325002a490a0", @generic="32fb785379fd3c3430672b4eabe845c14a21bf675d4c367af36cdad33c429a28ea2024105e0e57e7f24cd63b6b2265f09977dfb1e2f4256a45eb72d3505a448dcf5c112a2f53beacde499e4f2c04c10187753dafa85e", @generic="cd993a81fbc2df68e0a0eee09bfcc002e0e39fb59350ce52551f068447d5c71184efaaa8d3f8ece73dc269798290566abdb3cef697eed4ec5b13df293a940906dd2f756ecab735892b86327435a65dc3d01828fefae9e79fe0f4648821420a771044d33c45dff89a8b2f33499b651843b59cde6fb1752c5b8fb014d22c1ffd2701dc51c8efde9fb80b03f617dafded48d2fa3727a2c30de123eb9c1cf6bfe11bfbacd905bf5f1bac933bf9151f8c418324998e0b889220a8d1fa02779df3ec32ccd63e2276e0caef4126013750d6947d4c", @generic="a7f17aba65ae1cc59e69da9e60b3fb5980eea5ec506d5d28743ce2869b98dd18ae71e60867030e3407af6ede70f392af7209"]}, @nested={0x44, 0x45, [@generic="07fc62d574a181ade46a0fa32cede594e2f610c5cc928bf100b5", @typed={0x8, 0x81, @fd=r0}, @typed={0x14, 0x0, @ipv6=@rand_addr="84292e45d952ae1454661c49b013658d"}, @typed={0x8, 0x5c, @ipv4=@broadcast}]}]}, 0x40c}, {&(0x7f0000000080)={0x24, 0x28, 0x713, 0x70bd25, 0x25dfdbfd, "", [@typed={0x14, 0x28, @ipv6=@ipv4={[], [], @remote}}]}, 0x24}, {&(0x7f00000007c0)={0x2408, 0x20, 0x14, 0x70bd2a, 0x25dfdbfc, "", [@generic="3b248a523eb72c5f88bd733b4b36093407bd2b36312c93eecb905fdf26bcd7839863a057a0dfebe4de60e778726c0fccb0409249851da998a9470fb2aaee43c1d2bfc175a68de52a2c39966005a4e181bb7d0c703cdfd509be9e7af533541d1c370a51cf8b1bfeb20990d94e43f11c87e6d2b0d894d7b7e5df970f4b857c6def77ae86b05b46a14c1a155620acacd0dca8b8c994b6fa0010fdd0d77d9a0c9f6cf481b194102633b583320f276dd6fc91def0fe0e8624534ba5db758eb9f7ab5027d28953add83ca3841d8165ac06bf1697a9b983f45b59723e3924c8880d7d5b670bb9d22eecd112d4c4846ef3075c7d2500e06b462c690adfea49d5c74fbb31d110600d21ab213e7fad84082739bfccc084bfef6b816cc83df86fe867a6c5b948d9e94b33592d704094803e7edfc8db7ab03d9d44e8b1e51b0602aa855490fb69cc37512aa0185671ae066fcd56817fbbe7df4eb62ab17eb837c12880ad76dc83321b005c6eacac48e1155bbf2396431e6e5b27640967f71d3b38cbc9fd56caa3ab7019b233376ae13818fdf072cdda4d9f22c393e2e2392933c4c706b514d4ebdcc07802946af4a2ad42e178f7db4c708c92d926e85b884c374c1624cfab70335f9de27996c77f398b705884cabd77e3b2c38a09871f019f603c5ed97684498c6db3d539660afd46fad2a8f2b75256ae15200d384a3682253a51f289e4f66ce037c602deae328fed1cd6ef2cf96f08734ff728c6d58697eded6da38a7b68ef02b222b08b2af1b05518ac900aaf2ea73886fecf4016b7832af651fe6f75d254863f98a736369f9d3407e6b185c2c1193a34e46a63254c89959adda6a26ae3bda3453a1d05e28a3a3c2c720c5f89e27e99af684c2cf05d783ca7c03c1897a72fa7bec5fb064fed455705b3ab38d9ca060b35f4f6365bcbe0b1f1ebc2eb33339f9a0e14c950780c0e72c093c96ce836d052f74cfc57d89e29931da2763695141257c25b1ef4259b64192686900840569242e33832b9307ba61748d6f5d5f1ba342669631ed0aad43a17f580e80ba9532d02550169cf3a7708ce1d776cb4912346d85faa30336c00b9b43462bfc88675d55cde464d2631fad76b63ab90e7d74996dafca2a40102790ab46e5319aa4a91ff98bc35170ce59d2fea79e0359d870a95b2f2592dbc11298b48af644405ccf2f75567aadfd39f417e887eddae0040f4922a9b4105168564cc3719a305df6237a3426334a59f72abc732ab14dab325432b5883fa9ba55a609d0cbde53f1be07222dfe55c09e4b835084c5ab039ffc8d433d342871f964fb13d8fb860b8196db3ee87795dcbf302f6c54633e81477e2c4b9026df7a96b0484e60aa879629acdd83281b3eabf285b1cb8a052f14f8d5f0bf93db3fcea66f19b5ddf3046c667a2cc07d3492df601b2e4fd6ddcbd869e1f7d3e09c2ce04fe3a2e1ab511ffef6390de94d36b38d1188ff54df0014b868e74f6a935fac1c0e3eeb13363dbbc2f5aa44f2c499d86ab2c2004186bf0cd2c902f931d6d4b916f7d16e3e329bc22d2ecefdeb9abd2ff9178f2944ec69aa2ee29fc38d32f1c69888e052f2e9b5e6e09a7704967e221c307da9c1c51b9a5bd2e8048523a556414c0d0902200dfdf3c1f89e1cc7bb256533ab25cde8b945ebb54b4ed34f961788c924084566a10320b35fbc0e20e67b7adeb44e3d846d86d5e0323fc2a5633c29762ae7e3d32f1b940489e5a605e686bb92499c87cc18dcbe491fa42fd80f146aff00f15a174be54fd29285765162f31aa334631d24d4ecaf332fa9a426616e8127e6e0ec157bd00a5296ed5efcf3556bf26dc9d64c1375888368477a336562f892cf6b4f40e73779153c7e506398c6d2d7bf15f94c87c39d1912114d87596acbc5756005a1c0eebd9d8d5e35c95736fb561a9f41eb101a128d7631036b618550233fe79ac488328596a749ed195b176698fba88dd9b9246ee55e0f106246384c6c40a53a7d1c00cbe68781248eaf68b7b20a56dc00c7ac014d9a694777e6e0b840f4cdbe8263bf8a3c020a7e489600b585f328102dee8ede00c76ef530ca9a8bcc470a8af10607c723e655a9f6cba686736d5594570de0693f36de185b8e163075f7efa66887e720aff716c64dd654d5094a9441eedce6e8dfdf2fc8a3959b6504082f86f6106ae830d9fad89cadf73b3068065d3078ba6151d0c338ff23d2dff2a2a61836f6ab1bb23035daa24e940efb188126d956065c61fb2d2df44ed8958936d8cbc74f9c2003833ee1cacbfc3a2be093bfec7f8cc7178f8532166584273b49bd80ed4c300908c6742a40a2151271bc2f3c69c49cfafe8df6b48079073364d7d6bbb40764e7649f9301e4fc2ea30f3e40f6c12c28d384e970c30b53687faf9378850eac99c9201c9854d22516d9dfc02e12aafc0dde7ccbc597a13a5c994e66561af9d3c56f6887cbf56352e6db097608df968b51daaf386b794f5d1ce2837c7f859254f1a251dd4395d380f359eb9bc5c86fae739c7bfeda665c556f2e09018ffaf2e20daa489bed40bf2f106a195235b3f48cf65b2a609ca04bc8c77d66284be98c5c0cbefb3776c91f85ef65198f3a622113a4f42b56500de9b6b9831fec729862bea5e8fef7618e90f7597bc9fc53fda0b3fecf4fbd375543294d14111cccb92bcc89df6e04de82357bc186850510099462d4c3615040b78fa39ab7e1dcfb7023a14db2276cde6a5d474bdee27ac1234387947df975ed2a5b4fc7f4187f33f2b7afd9b650e31f4a2a324ece8a4ed563a518bf173f611003b667854a19b75ae29aed719485c6b8eef2c890f584e6e42fc41e32bacd67983e4babaf431bbeb085fba7574852305cfa28a814deecea58705d4e664f4ccb24bb8cb439345eb95a482c1f38afae866d12fc5d1ae5112111ade971b01e61a7811e1b59aaeca123ed36c9fc441a31801a936be25f4adabbbca2e76cc53bf5c95fd25735b6555d093592fa184444fb421c9de43e9bb2cda43e6165599775b82ec015242c5c6d83e9734a1e0b9c2f994a85c4034a547d8c2769fd21d63ddbb0213dcda6084bb4392b1d46f04f7e86f3a73ae30613b285d06303d4c639fdafad548ad2a935dcd505cb469872dfa7a8012857a7e65789f3d4ac2f10723476f145d61535bfae698a0847cfc2afe521c7edb38b60a5db79f6f648f3c4b737d860128c8b3957f9fc05cd5ba2a82738f5974a60697d3a6a4eae716ca571a2147aec21d2f3584d9127b462557f572ce707866bd51006e0939e09047ccbf54439fda56b742e1e5d58e6594b673c1b81bee118963dacf460f224b452ba0373c22bd6f352ad0959f088d4e2c75a315f07e91f1719496f33534a8fa1e112c195416db4b043c5a878f3435ca4c44daf214372f3d011957f7f34348675cfc9ad77d70456b69035ead19ccab7ca95d800f6592e95291326fa5d43856d6543639d3e6a9533a9dd43b514a9bf96c27252fb76836c12fca70ee32bca02b1a6c159b8e74c61aef755388daac1237b9b0091655aecfc13d50614585aa17124ee8f1841643584a893182e7b0b1440936bd3f1b91775f4ea0fdcf0e6d870a3c8ee808e8ee62fcbb6ff1d278ac4bcf25e572db55f5d218bdadbdf412d1d9a9c5fb20347b9247fec0e46f78be8d66e65dda7c06f6f66d2b5de737c146310e6fe4e7b403f870039b469be802e7be89000353063033fff2b19642923af9722020557b1cd1fda8e9d6e385be23e04ebe78c8ede6b3b6afda47a1d5346b0d8a4d60e287dc5d5fb88a30381558792b38ad8ef1137a9acf067642b2e9836aad946c3ec159286528af8531e6a8af262f9419309daca6e79069756aeea2efbf9e1995345726476b0b460c02ae1db1b672407482670359044a3c6f2e8914831eafc90e525a0f7c27a9e87311ad7c3f643e20e52fd255e199c6f41a3a40bac4a5301712ec6d663ced7c68f5173a4875457c3901e5d88dea9c726f1c5d763b82774cf712c36f633034cd5d181988d10b1e476dccbf4165809d31a6909a1a3ebfa72ec8eb1e86cd3e0c424269eab25f0fff74dbb0ae2f40bd6e2e7be392f5bb41ef99ba652eebeb6ad1884e2039605960c16f7e4c339c9ca174c76f775a4f4a430f234e58f8595835b2730af37a22f78d764cf35fdcc6773e501e17d37941c17933487247cfda373f1ad20c2833b1e71453ff4d9df98dedcecc7b192e1723573d451964c8c22bbcbed300e48050b6f3de49472d4ecafea36b225e1f7e3b3faf3708ae6683bde9c300f3dbc8adb599f218e1ccc995b9cf046dfd360f7b5d633eafae0a12593c05268c1b6dad9e6e75de8efff67bb20c59948b6ca5e59fb74604b9637839d92c0045a3862be635374cec8e0a52f90a497d1f6c468a7b2dd956d93351a3f284df0d295704b474fedb244cc0a758df0cf455430d5a9ebaa1b78aaf2e1e6dfce6ed3c1749a55d91779e01e78dba9ce48a8b145dc6c0c65a67dee61d4e72934927112ebcd11d060f6d373ebec2019d8a35b6d2d55e2ba8e036506159b9d3a85b6244c37b7b36c021b31a152ac360f2d2734b23e168731ac4bdbf7643220ec6206df374a9becb7464ef129de17b1d94d8dd90b011707582db2c2125ea5eecd4948e3152db01cadbe94fb651982963405bf475d0645ed0fa520a609e1d5cc67638085713f76995adbc4061061265df432343f7e8ac0e1c84e2178c10649d2d198baf0a32a10096b3b1e74ed5f7bb2ba3ecbb40305949eec29a14bf4bd00b3ed4604c6459fa47162ffd8cdb55963d717189215735efc21ef9ceaf3f95e8f1f1be6acc795a91318ac293d1dcff00f5ab576ee2be7a27b4bb1579eeeed9835fdab2aea8f9ee4492931ddf74efaff23c96e05f086877ae5a02c497a98875fe66f1ca88a8bb8411e2a16d12cbe9af71592eaf5809918481e9a9b2a4b4a8d5571a5c1b57005e378db2f0c13afe1e18d605928c12530a8f161e863bebbf3f5ce0f19e6bedd036e8e5c4e48075554e18b361abdf347155a8902b20e1af639177cacb72d5882bcfac107e30dc2286bb48b3715c1313319544e1c3e5aedbd364b943587f430be56eb4a77f0f010432ce80efaee55b6756aead9dc35fb631ed27fd0c00699127a9a504304d25b6704faeb164b1d707691a1b68c6f77e25aa5af01905454784cbc5277ec10a30cb973c241d24e8e86c7177260ee6fed66f614a18e1b8636de4309ae2031eaddfa14bb03bda688eb1d4bcf726195b8b1c0e4ab8cac8e343e088643e1692cfb30e76c373cdd435a5bed0d67cfdff916b805b0fc95599de8fc62a964645a9ce26463b2943b6906312b641a5e314bcfd4d794a2919e43b674998dbb42482c760332495a823fdfe1ee28e29a1a4a30c47116dc4b6c6b7a8d2860906417834d124c7ec4194c978bc3b2bbd4548d44eb0148398f49ae2fcfe6ac2387d8007a63e03ac384a9eed70453460ec57219c957f241c01ea2d2558b9dedc8279ea98a889ae689e4806e83fbf277040c5869c7a0962004778c0d0eecb0e2a280f10c12d12d25ca43a660b61037fe4886ac7c2add38cde8e12e3244d89bb5202731b7baac70f7cb28856af1f0f9ce4075aa071ca3c4d0c7079b60afc0be6a76212202050206171ba1a9b250e610654b469aabc730555edacdd250209b6c62763299d50d78f311b2d132decc9568f8ae7350d54c16d5d893cc029181d3af03ec465ea9fd1594e916b58be18c9d777fd29f7e31d9b302162f8bc3e3198fb640fac16d15d28b4efe87f7f90a07529020036620fd3fd", @generic="7991f63d9fcfd698461546a70bdc630545d3f3b8fad303fc4f4ad08a96bc5c89e82409de4a5136d3ccda2858857b43089c77407c3e0b1a89bbb7ea404139b5ce4a4dac97600a8b9a45c9f056488a8893dc6afe7c18a23d6b3d3c40a5050fd6b70a800ecac5a45bfe289450367655539bdf9345b2a43d37a0ad69cac928488b6e33e4767dad2c1006762e034576fb8a73c2e0c964bb60bdbdafcc2d3c891718df9665758c3f13a74dd8802ed23a351085b9431a4a202d9eae93d4a0c35fbe8e088b8f5d45cd82b9fd6e18cfef58df", @generic="877065f385c9a113805d10b82de56ba0b61189e1ac1a58868e36faaf6ae42fd9bb2f0c06cea122e08393cf", @generic="6f448f48e63954b8c82bcca9557dcbdd0109a3d4adce03e18dd9ecf95b6309", @typed={0x8, 0x7d, @u32=0x10000}, @nested={0x6c, 0x3b, [@generic="cc8cb0cd533df8241092248ffd2f1f116600a210df1724549b3549df8d9d3f065d0e2087764cfb7a836475e8be43e7e408bc0e01a96e7f0ff90448554931e5b59b7154860db89d6b8219ba1a98027253d7b02ab739cdb53dd59c50cbfdca7e4ed8fbd2eb82"]}, @typed={0x8, 0x78, @pid=r2}, @nested={0x11a4, 0x29, [@generic="139e989d6767d3db7fa022af504a8b6e3b4191e13f7d556a66c1570f899a2ca6eb8bb6e1916c71d92d2cb434a1ad31199fa0863cdc1febe800cfc1304aaaff0458900dffbd38c3ccf5054c7ed36b5f8ed64d82717b113cc8dea0fd38216ac2da5519c233bbf1e8be41a6f2c48bcbb4b29b95350e87b6ae6b5f4694bb200a837359e83d5dc2e0024078dfdbcecba67f54b50b305df3b3212611c8879fd12cd5cc347a34071cb7f42a347c5f2535a91c6a6253f47a2f47cf7e7fb3c0b849daa34192a4320b87b8d0", @generic="237ea2b660f9a40dccc789f7a9860cd47105d844ac08a6fa7863d02dbfc86fe11abc531308d66bd83ceafeca596d35c8220d64936a25147d3e28c7367aebbd20c409d6b831f863f332dd4f0ca50a7c2d0aec78799217dd6e26075feca96570ddef5a54ff95b61aad6c7f454dcd2e96dcf9e1702bc44af83605fcc81b339235d94fef0285df0f8912d42749dd66617b89daed423329ee9661dce0b64993f6c54db8cd287a49dd1780a03299af77b16054264fd543f89a1e3b4b46986862c9c3e5d4cab5cf7567a333a36d6ac8afa4635963", @typed={0x8, 0x7f, @fd=r0}, @generic="9530f54ef8b3cd3e1d08b5ebbad6b70e68588098b24647b2c1e15222a9ec1b57b62f0b9bd194c2b1357a116321040ac93ea1490783edaa716109bfae083baa9cd2a025e9aaacabb6d98f8824c9f5124e6fb8fc5a7116f7f34f89e6794ebde21d8666f4489c26341527aca7d62f7f341369f5ee8c54a24dea01eb7bba8ebec597c50d5fcc50434194a7f3bd9cc146b63cdabad9a3d8918806301d3775175814639b873cc0873807123376d257da2bc2ee7991cca84cf3ae21af3c8f1cb9e6029d382a38cea2643027431b5e0bb3fab71d5c416754203468cd62319f0a88a4de1489c8fd065d973ba47727668450629885151f74b5d4cef7b03261a52d94a4a9afd836dafdb637ed466a168a7ff6e67aed75b69ab7284dcc9071d9fa9daafc7caad2f323354b4ddb7cc14897018e0833af13d7398f0e2b7d000ef75a14a39ae3e6970a48c95c38f9dacf54bde1d51904323ba3cdfbb5df26dfbef6467d4ffd717174a46118c4d46aeb6e7ed1b5f8cd71a3d6cf4098892fca6621ae64781cfc5057910bac4f85f8b019b18be224409a93369c9d520bd4f63db9f878217d653128d0f82dcee2794369c5f12fe891e24c203670001aa6e59bb5463bfaac4d43984b87f7504afda1b0e7e1fffe48342736130d8ab1a3cbe57fd2562fa208077023d7a778b141fd0b3be2d44ca77e6d381f81d7f5f9f3c25156cd40a140439a17863ce77418a454c55de0ccd87b3f0c8f102e839c1a6a04ec4d99c927205f1e76bc3432ba9e30e4953fce6cc30a88724f0a50a3faa7371bcf698927c25ab1f9cb52ed0879c8a6aff6b25e206e79bf09b806f446553532a9691f3194531382c5bbc456996230f1c6ae831d44e873e10054070cd9c9f43d145e0c872bcdc1a17ba2132527d2e26a112c4ce000e03211867c27c68ff8da132f3d306911237139ea60eb3665d7c186fcb780ad1748819dea72777f9788f58840f97137b94fd7a9364fc56aa69c6448b7cc19b1dcf2e3d0dccd77abb57ce6dc9ea0ef9ae8cc7ab9d7f2eccdd91be97df30e26147a49ed3eca4e265fb2625154198e934113f2841d96c54d821c5f31b97bfa596800b774971ec5d975b67941c1f147747f8f086798f8f291ad66add4e80c681c75dce5852c12192dd9917422f35119fd0d319d621411172d1eda6cf7ae94b30a0e014f28df025c63d70327ee7e7a7dee63908214a654ae61b6cc7d2f33e9e156669caadd9378ac35b2cb4ffce819147a138f1de2108cfcd1b1deccec2988623a88497464c32f83d5c338fe0c71793ca94deef73a47b521600d5e9941a46f67360a3966e0530e03641d7208a5bd3cdcde5f6b0e8fffece8e3e8f43ce90d4d14635da637208da204c0694176ddfcd2e69780d28b575bedd91ecf3dc12836629651094c73ae9ffa7285226a776df552ea4cdf0df26a6aa4fb76f658df3033ce5df8593243da1500e3e583f21c79d79f17b09fa4fa64c1dbb711606c06c33e62a12e557f8d509bbf2f069f371750a0ce8b3b72a57fee8d9c36f0d45142b51ffe8cfbd15ad91cd04d30980514d360baffea804baf4192c3f688984b4c1ccc4243d85dba3b0cc1203564dce452e7e73320367b208dbd0afc0935e0686c6980e07d59e3e6d699a6555f964d74ab850308f9f2eb624ba3255e8e8271dd3d01a5bb682c9acabb67b74400bb15a76293ccea0d8f99ca5e4ce9a60ed35afe80a3fa6b6bbff92247def09053f4f4bdb2e87afd6c599b8e2a67d99b2fb62ae73b23e1ee291fc69861059dddd814a0adc718d558739200622cbead99ffe5a9ebfa2cfe6aadd29764288e9055dc1b7b0e7f4d68712c3f95b1a80aec1164c64d8c20566531a4b9c88d9187cb408f5262c7dd53e262df523c1721f946288eabfddfba219444aef4a0b5bc92bdb9dbc395a236a297cfae92ce0fc4def6b2959ab2b564458ddbb45953810223d9b189cffe4ec48dddbd89b758ecc3a3a4ba12c712429227d0f49c3cac570613e91d15360e72dc8f5cd2f97b66148439aeb76c8db527e1a33498bb0400ecb1748227baf25975052b802038568f2b4cd00e0bf26272e22492c7b5cc63f636753be061524485264e7c8b147fe5d288402aef7c8c24a5d2899f12035fa7e2e4038e2a091f057962e647955b2ad36db58f9b4d52fe3822fe4708bc44c0aa9d3ac90d11bb9d64031bf49fe93a468b310372b78d7d3dc0046f4a695ab5858f9c3be9c8978f16242f8e03fd5338173c399b18e9e3b81aad21a089068945f8305b898acf98409a14ce67562716e72efbd4ada826fc62b551baed8267d6652ca6eb01529ff3f6957b1ea4d1de1d2df364f8f77c66e5b4689a306a5487cb405fb80cd77a143e63e91966495ae2c79e80d7af51d6f4a08653060b60b591ae5b5ef54dc1eda009fce80593c9fb415d34823c4fb02e443778b0533da591d16dc3f99511cb370ef04370ce46c4ca0cc6e7ec478483f37f38e99733acf290ce5d096e62cca822e67f4f12da9951588da70bf54b092d8828ecb98b91e3b6648c03fd87c59d291d47e04d0e14df859213f3cad45974fb87b2b31f8ff76283beee0a55f93fae79e16248e171327db758c566c70f211ec6a2c264c745400c6bb2e4ec7c58ded49aa1b5c6bbcdba5be9b85e5efdd7f99388473869982643ffc8945592c4b9c65ffc3c387cd97e305f393bebd802a5c158930b3fb058bde3073ffb370fc2e6bcf28a7e47a77507cb620dbe37eaaa929ccf2dd1c13ccd0fe6f8216bef277693208d6be494ad7b4ae9a942034c605ded2d05119fe3539e969abaf80f891d128dd5bd52d407f5c048aea101326f8ff77b5182d56edbc8030b8211d9ec9a016324989f8a96dd9c4d20a5a58981eda05784d47650e1d19eecdcc7027af58d256310f638bba10b50a7abe406e8e2e4ad3b5417f0eaf92b53d2af80f6041759c8c02dca90e93767140664151db0004a028a3accc8eea3d1ded405170507566ac8c66ef1062155cdcb83ccbfa3f3b3473f174fc5936436ee07c5f3efb8a2f274a31ea775335c9658f306fc2a5ff3677e8fd84febc9d1b4cab5b99a82a0aaa295a15e9141fd415ca3cfc67cec710b3d4f7027ff20570a736200c122296beb13487ce2daee255afd6a02d7e1dd4e4f4982d6557167cd3692e1f762cd04d72ba9d9b28d04d92f57b093dae919b43f8cd62cb6107685cd39b9b9bc5e5b7919f689feb0efb08729fde9ad3fb21c72cc6bbbb439813ad3ea767e3764ef542b065a1a3048ff4dd19663f1ebcd86f17090fdbc53c1a89f5fa666ffd88401fae88a98ba50a8a6d166e327f9e96fc3a1f645c011de41b507b14e84687051ab391107ad7f5e5470ec0775ebd52220f1af9f695e95fd76be12781e8e4a42875614af760780b644c7dcedeeb1ab163b16dad3754ab6e63f77781c71ba0f497883fd5eae1ee272d38918fe64ab34fcab26ec1739f970095db07fb0089f04c06a1407895824ef29cbc806d3baf9c03a1dcd7c7e132449724554dc6d766c936702291ae1a6e3a4db468f1cd1640a6e0eba75932d3e121782db574f5c6c3b9761eb98cc21f43bc3e6ef9ccd680f4c81602fc32abd86d72e73a9428c80b5fabe267b4e991593375ae32acca1c83fce0a2cb2aed9fd6e09a77b8d362d52e2354745896421ac68a087d9654e7e5cb27b6ef598ccaf9beabd07494823f8533b5103c1ed7b45b2cf315b1241664da63ce46105be7151de9a899a20b5d845635857bc730ffdb8b11a5eebbb6086b44a33c0999be9323b1b9858ec2df298dfccd8e7ddffe9eb96d1d78da47fa66c410805a8222450dc981b0fae69e5fc0e55e1ec077d12d1b13ef11f906438d0cba285d25e6dcf4437d4aa7c0b6b2f401b8d9938f1e7c80010bd34210599ec90edc910ca0dc5876dfe537ad50d6134b3967be6a219d424c854f734d7e1a7b8e06d994c9ec9de662768853e2d318a340eeebc257383ae812251ed96a89a20ab568431b1dbb364c1fd5c2ce764dcba30399c336ffed1af018f80b3b02917e25909910f5caa93c8222ea31861383fcc3deadcd34b966b352a53f445c99273bbb739f8ab225024ff437309ed121e8be694937c39371cbb1bc5f5129d5739b5bae32002aadbc74a428afa016d49afd6b1ac6300e65bb132991d9ce31bc6b352a994d4c3fec2f4d1d14cc28ae1db92e96be634ad1e908c6e1873d089eda0c88e0cbd56e815caccc12a9d048151a74fb48ddaf6e243c1141ca0f42659e74bb2fdc2aff71c097c4be40823dedae3327fd7ecd86309093acada573d0a6b5d0298b87f34bdcb94df92d715804bb56c312e48eb05695f1da1eca28a497b2ff1dd621c5a56fc14c2771e33bdcb4f9ecf00baf10d66ff32f2a81e6e1a67ea183ed2cb09b700c0556d98796de06a7623adf1c24099bdb158ee7b9842f4b4bafbc50d9cfc25bcd9b745e39817cc64ee7eb1cca1c1e765fac579601d0f4b7a920c1e8149796e11613545790627e7ce74ce0f0b60e13148194d558c110f8fcbee1cadd5e936b016fae25d98d6202832ea4b7f0583bb9cf1b8cd163a14f892bec7083db10dedfbad4c82545a75ee73d7e52168882a63afc2959c4b6d2188353a9abc336b053b6fee60ab2d7781adb78927627580a49e2ab448d6e9e16328e3f10f75acbbbf24569245a5110fe3edfea719a3866cb0029d7b4212ad80e70feae73289a68bc19280bbd00be5efff5a71ce8150d96ee9cd4c9b718aaefa6806fbbddc0dd3f00653de9d53c942bcb5e3f587663e9214e02c3d6b963b3c10b14e91a9bf6e5885d26af8792b4aa58c4477a81c1c4039f23e263034aa96ddb8664699eeb5db145967c16c3de92c77541482d048d7bef4835d03aaa7ad95a5434bb629774e277e3823423a3ada28aaff20da31bd6f077de515b6749bf2ce2ef3040b4a7c26301512793f73d6ea63f0675f143b06c7b51a5c3cf3828f2986b9711591b469e98279a23de546cfc43f7713b76313303b0806e241b7e7d3ee4706deaa1acb536c432829d24d33ff774799deb23575a67cf0503ea42b0a8b4063369e7dfc60cf3007444ffbbdbff36457dd794212acee688330f6404f6c779d14ccf90ca04f9828689b8b6bab7d43b87b06f9df7029da98bf3f52c8f22c42a65d030d970c2000f3c3402bcc5f60fa372a1bcee8c6cfdd5e2ca086cdbd6f62d948ec922ecfc0244b0d1d9b0f997c2d486c0efbec2412e88d85dbce4b74276b70dbd495c32ee9bb611690bf8d15046afd1b2d1fb02b20a09bfc184079bd00ec93c8a34241148eecb9341419e23a724e5237b2c60bd06f39fad7fdb6d360a46e9b63c40d77aa8fcd12e63664d5ab04e4c56effc099fd5f2837f88eda836f2d5f1c19cc8922472f014ce8def019f1cee2b54bdfddffd24cb69fec49abe46f3febcd8e81aed745f33daeb9a25e2ca0d8570d94beab8cf1d345f099906eb2aa7f558fb0c5fe02784c47ab9bee3631b03ecd22cb8b4ea7c32976fa9de83f2a9660c61aa25c6a22c362384f447aff771f8471e8b86ce7fa96b33aa37930f12e69dba30de4ab03ded2ae026605b761184d79406dbe38ececa09d4275247c06695b35eeb7f7677601e7e1eef56076e1222a127b34b2988a79b8b64ffaf42a70ebcb819aa6392cde6d42d5df0ff381ebab72372b363855e8b9ea31aa2cf2275240126f1de42ff0190da5bf25140e3164773f9e8d9a13b8d89047f2668c076a94687f52b2796ab24b76c275ae4fb531b21dbea90787c719ed6354059e08cacef3a78e8cc0b1e43fe4e8494e72e7b4fec3ea5845"]}, @generic="f6e0c2124bbbf2c916de52af2f02dec705d43c405abcc86a3bcd53f979449507c37d6215a8884fb27e30ed18832c1429aa3568721796ba22c6bb8c5d95d80db4810f9f9769de29a0821e2b82aac4d51e57eae35b65e442e8c82cafed5d3ffbeb5ded158ac0168597fbf8b185c517543ab7448c3b39c6ab10b0e7b2e79fed69bdf047e72bc27aad35b33fd34e6cb9d838c0309699b8a9133b1ff6d04cc6b8c5c20814a53d1f330baf794ea91ad4107422cb83b77a0f7cb84a8e36ecbd3f"]}, 0x2408}, {&(0x7f0000002c00)={0x2d4, 0x28, 0x904, 0x70bd2b, 0x25dfdbfe, "", [@nested={0xc0, 0x16, [@generic="f6ab6f1eaa3cd02b095b01f240bed31de3b02e1adcdff863aa4bb45883484ae46ad1238fc6e18d13ca6d8b52e05ea2292eeb8a5793f571de879ed29c6992b55644be3c8158965e6291e5c49216f5702da29822bbfb3978f406a908b529b78203ceab2bcb4963678f", @generic="92d41898cbfeaebe04d9b85993c9e4dcb7a0567dd2567bd72f42ecefc0e95f6562d26cb274cd2ca8ef52e8e2e0885e08b5b233649450da7e12adb990c628120a4a6411be28352a5e58bf5571451fbac64ad45c23"]}, @generic="5facefd39d70c5e6e6543f8638c311929c235a41cfac0eb72455bc84a13451f79221abf7aff2692cc41f0d83ad21d100a7eb1adfc002f92134bec9fd48a78eb2c32b079189f985f7a64c7772032b", @generic="a649e0752514c345329c6db0fb7023c39d37c00fe97db7f0747d97577b", @nested={0x198, 0x3d, [@generic="7eb86d660cbd966bdd090c5f2429fe61474ab847e708627de688e05d784ff439c9301fbf3f214a26af7cac1db8d8eef35628106b80c6b90371f598205d6f256ba04dc7e2aeaa515eee07b87f5f680625377469c0b8a0aa745074d8f4b33e4c750eeb221e30a4ba452c1c67118c16f1d1204b6c552b4fdc3814ebba6e11d5c7aa74288eb1404760ac091c9573c93003152b2f1644ec70dc3bbcebeabefb5ddb71a76ac51d34bcc217613aaf7b86f19af35d1c679451", @generic="310f15b5a03951588699bbb96060a54e14a4f218803290bbed68dd38689d5fff89e4cc53920d2b34c68083217d7afebcf1b7be0340a9cb3d54af55b73f315ce00355c2b33bc5bbd77ec1288735f82181bbd087d09dc1f3d4b8d2368a2d056803562dd7b3e887a096c457f5213e9278802723590b67d350e77a88043ca3ef4f64028f7510c8038d46769f72f4d651ea48ca5282acebcbfb774cfeeff0109a34a8f1e3789607fe3aa28ec92abf0577dd2ccde7d33a859802de8c045c50c0c9c7764066945b17351ea7fbd7ce7024d67ba881775249d169295a7e8dc15ab0ef"]}]}, 0x2d4}, {&(0x7f0000002f00)={0x184, 0x11, 0x0, 0x70bd2a, 0x25dfdbfc, "", [@generic="6065b26a491d9004e5fa50a59180fbe52b9a168ceb9fdcddb3449bbc9758e4ef8bbffd0e691538383bf8db8f498b2165b6fd0bef5d823c1978f47f744cb947330f16211733866b11f8ce21fad950890936c37e8cfa04b41d688adbe5026f4a59359f0c9c9b9089cabef6b29eb61add19e0c8940ae7b7d138df2ded0d365a2175e0b01ec908997e1f2b188383e738ffacc7b2ec9cc39f5e8e7ff401c40df7ed3db962ac652b47c89846807930b964fcaea60512b2fd439cc0065f81ed471111c867f4c3b5ad454b897ad2cc0fabc39b710aef76f2ed844c34062875cf0b434e36dddaec9e1a97afb9f6d4", @generic="6f6f04014df56c3e41d49144d2432f1f41658946dc9880569d8ee9f5d0d22966314ddea5a691ced15ba9a6f5b61a9c11e7ab4bc163ae024659b0b1a55db9c44a49992c4f38", @nested={0x24, 0x45, [@typed={0xc, 0x84, @u64=0xeb6d}, @typed={0xc, 0x16, @u64=0x80000000}, @typed={0x8, 0x68, @ipv4=@empty}]}, @typed={0x14, 0x55, @ipv6=@mcast2}, @typed={0xc, 0x96, @u64=0x400}]}, 0x184}], 0x5, &(0x7f0000000140)=[@rights={0x20, 0x1, 0x1, [r0, r0, r0, r0]}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}], 0x68, 0x40050}, 0x4000) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r4 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x202) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$FS_IOC_SETFSLABEL(r3, 0x41009432, &(0x7f0000003100)="e48a8c1a394b6644910216a95c3f89b02b24609c24d8e2684fa441e71ce60eb9ac1eda614c5414e8678ac06ff20568fe4c50c14d9f1541001aa02125a43e21c6837bb46e20c898367f0a39aa3fd9e4d548d2cbe6600c59df47dc6672aa7f53902227ecd45cd685b6f217a51ce7f8622d72dfc59cb2f26a820b81c66ae52554902a19dbffdb4685a4f98833b4be8a8fcc1b8c74f708a5b78f2adfd94e7064d285c5d85e332dae0772544e68a792c27956b3f257fd90bdbd5d53ce4024a2e02c7f8d57320a7da8cd85ab5b6afc921dc6c7eb4db4360a2da69d54387883ceb0fb1354c1d3e3884026d78be7b195b3d55cf31ed2f60c63478462a8aef58734b04613") [ 1550.448452] binder: undelivered TRANSACTION_COMPLETE [ 1550.449945] binder: 12789:12793 got transaction with invalid offset (0, min 0 max 0) or object. [ 1550.450012] binder: 12789:12793 transaction failed 29201/-22, size 0-8 line 3199 [ 1550.456762] binder: 12792:12794 transaction failed 29189/-22, size 24-8 line 3014 [ 1550.465166] binder: 12792:12794 ioctl c0306201 0 returned -14 08:14:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="0000000000000000f84db46414a08e46523fb5ef84c14e353b2e207714d41d10f1cd445c1f18e3d159b1a13ccb054a4cbe645f"]], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:01 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0xa4000, 0x571e034e66edda4e) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f00000000c0)={0xec8}, 0x4) write$binfmt_elf64(r0, &(0x7f0000000100)={{0x7f, 0x45, 0x4c, 0x46, 0x5, 0x7, 0x3, 0x8, 0x7ff, 0x2, 0x0, 0x0, 0x2, 0x40, 0x3db, 0x3, 0xe, 0x38, 0x2, 0x9, 0xffffffffffffffe0, 0x9}, [{0x7, 0x4, 0xffffffff8d6f4983, 0xffffffff, 0xfffffffffffffff9, 0x0, 0x6000, 0x2}, {0x3, 0x56, 0x4, 0x8, 0x20, 0x3, 0xdc, 0x10000}], "053c6512f48f9fcb87218a9b0773a389c100cd645599522a379094c05f7362c563892d70703cbab1a5955bb0ec43658e71650c5c3ce4b7d56457203355b8d8a51b81741d9f88826fbc2ca0ca4928e2c42988bb182b1cdf5b8c5f82cf6a90bf00404cfc785d1e520e4930d3851ab9543448c232277eee77248763c5cc1748e7a321357a64ca5d0dbf81805f235e5f614f458e28efd1a72ed16043e70264e8c7cbe3919c58d6ff0c9dd35d7cb87fb1752aa60728f0d3461ff6407e532346e7b916a337ca011aaa303cd3b4a30a45f13d9dd913ea4fa0eed655e1add8b06ba3dbc09fe36ff81999", [[]]}, 0x296) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1, &(0x7f0000000040)="0adc1f123c123f3188b070") r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x802) write$UHID_INPUT(r2, &(0x7f0000000880)={0x8, "aabe3be4a11c3497456bfbdb6ba2f5e8fb3f9f93992e41ffeaa08cc1c966bce3c1f5edb50174c4af1a9b6e04a3b3a6eddf49db07ee70e493d582302419a37f112b4a272d166430cfa28516a341c7a769846cb884a556773cc9fd39b3e33f86a6bb43db5bf8c3bb115733f7f741679d8f4c945fc2cbc062e7884161bbc0bbb832ad80cd60cb7c46ca0ca5ee25c084c291d9fc8e515251a84619b7e035dadbb5344b5f5e89ced22f84a5dab97ec14c3b611d3824e767a1370fe594a1a923eff57f4bb430e285d575d6faf10248e0efc6511ea15e2383663dcd72bfe3bf5df5ac51d2c6057c20f401b235e466a63072355c886952cc7329e1b60f24cdb52f6475f5c54af3b1bfc42d0c8ea58754f914dbe7179bb4d3a884d024e5cfcb645706380c51b068c3c08aebf458c865fb0ea187633a424740d0956791df7684f1268fcf54585807d3eaf2d13087bd8ad882dbd87341ecfbf76228ff00ea40caf51e59dd39fe3b041592bc9b3722c27bfa89fbaef252ac5714ab64a79ff9c8999f5140ea28a13191a3381307960c46af84013e17b4e3f1a9fdb3e1881de776ecb01ac077711bbc2c46d1defb1e08ef43a8b732bd5a58a5718e56f12d1df77033996969908a41b5366ebfcfc4aef1beeb30a1f49d39dfab5b58cbf3dc7da93dc0e158c78a7ec976a97e726fc5b240d1a9e1fc56cdeac4cacb879eff851763996f08bb61d84f79a3fa6f6e90786637266aaed28096bd2f343f5fbb5fa7a038db3c8f73540eb6f19ad91c26734746adbbef0fd545a3b4aa35aa23de974cf78c88d9a4e042c8d21c749ccf148637cb2b17477eeb9f72af3203bb3d7ec0c0e86c6b50702ddf3882327dd19c1397c0456ce61b35971341d8789ecf9e43d4bb85d8ae83446046df70e8406258887014c23b68cc3d52f72eca727d3980131da6dc193d6ac928805043ff0b1fc062e4b12ba3fd192e77c129fbded441d29d481bc41c41a227e83ed8799d34006a5111028450ee67740106f8dc1ea177012f21b74cf0527aacec59264abaac0b26d412bde923976281661a59637b58c8fccf1ab5df69210683bdb18b18492353995acd832af21d183155f7c3f6879e8b6210a59f5efbd8cf8e9ec800e1716017c5353035a2913a231d7f3aa62d584fbd5d826340b906907b4d058196767aafb2cb18df4a82dbf32e0a16169e513b6f410ff9f53d47f0f8cd77e2609538f925b57b02accd4e8df3c04a8509c74f1ee7517a21e4bca614384a723bcf209389e0628f282fc8144e3daa91e6e7a919b2308032eeef01f339bf59f2cd224c862279502372e54e2e99a415eda400f4922ffa0381e961e59b6b6df3378755fb2837e3e9d38e38803e87973c2c2396312b25f549accff9b1fb4cea8db8b4ec2f9a0eb045b01536b8c392a0d77bea030e0a3c64aabf085c2fa55f10477d41dd8c7420a89e99dbca39beceadc9beb67a0be4bebbb1aa8b87ea7a9a25b7829ae58104acbe0c4a32d454901ce70971833b01e08dcdb8e2b812aededf521c7be409b970a302cd30cd4816818aaf7278a4d26b5b40463750cb9df6ad1b4bfcea6bee6518f536deaf9f725c746d5ba7a0f8791ec56c398570daaa4c0529ca83339e94c0b8eaf80377ed682b696104481fb7df84cac8330441277527559c27e28ad4afbac68e4fff94b925bb2c0b813e45923fd17e8adeb7cee432cdba99ea1443ccdc83260f01971719a9a6528286a38a4bc82e74c707812da84abd58ec0bdc9c7202071a6b884dd11ce3bbec641928e0b0e2b7a217473059cebb12d100fd69fffb3a470d155b240ca4ba88d3a2793ebf3e6bd86a48617b3be2f68f550071d5b1fc8ef3a918bf2503bb8d0c3b690299b98993c2a0a624bf3b6ce92045e39793f6caa986bc8d98f48df476fbd27642d382963d6c35c86cfe9d4b822780a2913330292febb57e94df921e4ec8e9cb347c51e12ee5edb68099ee553fd0584d3dea4668f85a902583febba1104cde404ce7036d45c11807a85586db2e2232fadd524da04e56ff7a7bff1d2071f80349cb31f8a07300f635cf5ef98af76cac25d9f921a52777cba43f5ab97bb1815bae5a349a4d942ca10e607bb8fbd54fbb8bccf8df5a6b5bb7552a96aa5d705e0c96979cc2841c1bba4aecbb3bc11ed7f5acbd0bf502fc69d91b686ba23f1ce9ac7516eb0d00efcc760719dd0e6e8956f34195b0c5153a94104d32350974623517ed3c9ef8482eba199e616cf4fc6c895826f7ba4ea6b92dd150ebd4d47224adb3e5bb127efad9b3c3203758fdea241b5ae2bebf155f22b28dde6706d9688441f62d6c4fe9ab3513aa70303e6b1a08c9620e82b61737633391abc3cbcbc3a9d0ed4057ae6d826ad8e85ede66b7cd50ef2b305cc8cc0c27b5651bd5d822cef1afade26d55f6200ca99645b1cbcaba171f144f45b69de7068bf52d147ffe6be76bda07cc7af19ac4ece4052ab03564c7b6aa26328dd32e0d4c169911d76821273eb1bfd3ebb0bfde3524eb5a6bbe2084c6fb33782171713fe2a909498075617c4ae276ea039e35d47bf4b8d3364fd50cd783968a5ab8ea8316dc779e30f7b714dcd879e520fc8e44af5b17cf5fdd5432bb2222c9d910fb504825a2ec3388d8b759ed724ed76b315d5b45188044a29084f6aeb14ebb0eb941e6c91f4544fdb772f8bed4217efe80388dfbee59a2e8d0f8da4168031d4c789fde2c699633faf826443365a73c3faaf903d9b56bff38b4e4eeb484d44d791608276581526b5b2ec923666d04de5e09795c7ed1197323a5f571513e159d7f260cc1272b2544e9198200ea48cb9798cbccf34276c603d53e3b3fb917f212e2eaf554126803e55245b0a6f7f70d35fb18f02653beef97b2964459398e11208cfe15deaf9feb778c2f18880fc76571c2e47135187968420a6cce286fbb700ba9c5ac9f1f33128cb201566885ddcb25a74c1624243cf2572bcc07cf67a472c57b67eafc0485ae79bc4eb33e51b9bf8c5e2c170a92115d28f4a6afad05ab7d44d9679a3676ad842383bf7a306bc49c5cbbfd86b8eee2fd53b3860d653a5484e694381449da2d2463174b050fc87d06fb667a32b97d8ed58b2f66817f6a2a1ff5e2f8d8ca53c48a40715c6298d36f97524852cacc479dd94f55804a2405242c1a3e81bb063ae5d8f2dba8e6ec9fbe8dff48b439b6325869905ef2e3e50f6dfee2cefbfe5d9e064291c67e0f298010c65f944dc3ddb3f0cfbbb3a235dcd753bfd94123ce554129971266a446f13ba6e4084199a7ac23616bb531a34e2cd7547d0258c87067632cf967aef2d8a8303c3561a66db291a54ae347f07ab8008fb76b9e53b5982dbe36145b79530bb88f3a9022845a9c0fe75ef06c994114ae72cadb30fe9d0fc113dc92d28a71f19124f0ae1b79ade38eee49e4d4f89096fec7f61f55463e14622f8c12f40bc863e6de1f758075d8e77060aa8c02b749062731925616f7b6c3585b69c25e63e7c06ff1b9018b263f531de3d4092dd0f6521049222ba50b893994eb8de2d607c77908f826a32b9a760eb7f59388c0c2d4832854a2dcda77e7936620c88b64888537164ab6a93e8dc8ffd81309067a46ab6dc3ae545e40769d74285e055c2ae97cc59b49db321ee3bb7f4c275b9cbbb75c1698305143632e4e5acfd748a555ceb4a43974a2eb15cd25bcb2dd2930cea6ea3191c0234e184c9cc2c4f9a82f358da120aff89ced67b743dbecebadcec7f2bdac4447a15b1c219a384cafd2d57c9cb2c92376d73b9d146fd3283a7c1f9d3e589a614d94fc57e1264d02c201d696d54ef91bdb921bc6a15c63399e22e43ec11398ca8a51e4f0e85fd4ecf60e2349506b8758e0f11eb5430ec1566ab892b6051295c61b6ffddaf3c176cacb68f78dec4b27bed5e67ee6a391412776e8e0965d152cb35d7d0d3763afbfe9e41af79f0bc8e44ca55a9e4255aaa011f5f553bbcb0a04a1406aac8c366593529d9d4978d6a843413345a6a6934169bcc63855b1ab33a0cbc076f5709f9fc2ba32ff4d78649e48b556be518c1768048d2841d80447b29ab4a77385ba10cc825bb91fbbf64db513b2a18783e3660f7975b5c864e3d8c27df703b8762f8a86991d1582bf346b38afe8ea2ba99cb5c9475bad1a880720ebdea078f3da946684d7375534e3cd8f1601ca9d83f6a2c593b7f24ca548c7108d4f88d347306f7c3989226fb27e5d91cccb27041b74694a846fbc4ae77bbd8a651af922bc211c5352cfd532fc8a1c27f6a4b9b6ca8a7688d6506414af3cef1e8249eeb5f43bc425b8f371b489dcec5ec0fb0bd2d2fd83104b202093711caee812ef15defc7195f91802fb7bb754b6a38b7af65b41f6d3cb8a837627a6cb1a6e29b88d635eeab22fccd55549a90f5d79243c98f263a290e7ae56b84ebac0104de7c69c583298c974abce2555b4a660897ec8e46b51b1138210a49664bf9901a2ba78c106ffc7f981db38d87b11f34d5f9e5dc7d335d65aea09d3c078b23e779081d0df3a2e8ed8ea10991fa3526f57bbc52453436408a8b92237b460850389b8c1a7c2eeec9c423f8757b19b7cdbd669313d4825c1aee8b3582675d03e7a701b3e1113c95f38950482d01e8f20641770538890d15e59358c277b0a515299c975c158f24eb2216c9cd5d91266eb46123e179e2480d0bbdc2189f1929498c89dfff68b865cb7c2e6e3e438172fb7ba6d19706ad007fcb2b4a4ba6e6db40d6d59c938519565581ce99541544edf1e34b76595e78d73e2458e4471f44c3d2a3f6d72a6d79a15009b0540a7983ad2455acbd831336cf7f675ed7314bcc31aa96f716b8d20084f17dde77815634134ae3770a9e5fcac07ada55a3bea98ff10d1c39e81006a1d3ec9a576f9adc405c0c62aa216d937279d8bbaa640ef9ec1607b56b7095579ccc6c91e19743c7df0d41b7c503fcb73494971d00351b8fd0d7aff60b498e62840009cf0386e4c753bf89072e5a9ca27fb3f73fcee5f4bdd7e38172785024ff40083abf3c0ba635ed03f352029df778cf6764455e7ff54c826b8afb257a08ea0726cb1403716abab614512f65a6acb1e8fa1d1210d6a52a183feaa7544d233698c8c28190507738fa1693f2a95506ef1085ff0cfa4bfe5a668fe1b0e523aae839d82aea76a4638e3a8d61a169e2e6eb2aa6c1383ab5161c82babeff343ddc7471269688c6e067610377a6e6013fce5837b4945eba972fc8c8ae8ffc9a69962725f0af25fd527103fe1a8202e3cc2be995c81e05a8d244f6512c080d6778add768f5935542e520e14f37506dce036d13ae41d78dca02919d2e2b06d1d1e0bb78d7949106b51de8a91781e6d4dbf52f6adfc75d6f6da42420deeed360803677aa9612ace4be7fef86a81d1a86fe34a27a237648b53ace3f118be5542bfd8ea873a7ae21287946e570563a394851c88ddd6c5331a99f38f3c217c9fbf8311997bdee7efd966258f3b7030a362c2e5985bc33aebe65ea62c827ee1f303089f57a8603fbb815c6c7999f80c54442d4c6ad9d3046e3d8bc9f437ca77419fb81594b9f50f612ff966908978f7e3665c0db348984e0f1b1d302974e4c545e8c8294b4e7be8d4662f80ebc64b6ba81cb72f3c81f0e6425080a4471b5d7d0be88da1e39a59ae5d1ce69b34bc8a37571b4caea9bd4a6d86cf23c8430ed22f9de578486d57da8afcfb6055b68c5a0691e8ddc60307649527ef6ba63b7789a249e10ccfc0bd13ecc51b4def870747cdb418d91edc9fa147ece5748bd79dbacbfc28607839c4f4690083a5c8e961e2ecda", 0x1000}, 0x1006) [ 1550.498199] binder: undelivered TRANSACTION_ERROR: 29189 [ 1550.509311] binder: 12799:12801 got transaction with invalid offset (0, min 0 max 0) or object. [ 1550.518331] binder: 12788:12795 BC_INCREFS_DONE node 1335 has no pending increfs request [ 1550.530597] binder: undelivered TRANSACTION_ERROR: 29201 [ 1550.540322] binder: 12799:12801 transaction failed 29201/-22, size 0-8 line 3199 08:14:01 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rtc0\x00', 0x200, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000380)=0x14) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x40140, 0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000040)) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$RNDGETENTCNT(r1, 0x80045200, &(0x7f0000000080)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r1, &(0x7f0000000180)={&(0x7f00000000c0), 0xc, &(0x7f0000000140)={&(0x7f0000000640)=ANY=[@ANYBLOB="9c010000fbf189f7decdf87ed9cc695ee59cd6e4fc7809db5bd368f8539e6a2e35021a6df1c118d1b8ceed20877c37c67303cd2f57b97d78d07340cb130deb7869511aa43716d021a8879a7fc37a7013345a265b9fb7d3abe6a3da53e90abdd747b86425021c65be38bfde53bba5cd2fdd8422e1f4a74e8f31d0d7be923d1b031d3e1ef3e4836be4464f8357f5f309e16f758cfb5c7807bd08336c46d8e400d1343b9cb319ef91f2d78cc1e6f428e98cec547be808199b602ef98153fcd0fb648f50ae793065474f8bc40bb275f7465fe3e2a61914f9dcc5bf336290e69fc4fc17c609e828121489b2f6", @ANYRES16=r4, @ANYBLOB="00012dbd7000fddbdf251600000018000200040004000800010003000000080002000101000014000900080001000100010008000100010000000c000200080002007ee0a5770c00060008000100ff7f00002800050008000100696200001400020008000200ff00000008000100010000000800010075647000e00001000800030080000000100001007564703a73797a3000000000380004001400010002004e23ffffffff0000000000000000200002000a004e2200000000fe800000000000000000000000000023030000000800030074040000380004001400010002004e22ffffffff0000000000000000200002000a004e210c55e0a300000000000000000000000000000000050000004c00020008000200ffffffff0800040003000000080001000e000000080001001c000000080001000000000008000200010000000800040007000000080001001700000008000200000000001c000900080002008300000008000200f300000008000200ae6e0000200005000c000200080001001900000008000100657468000800010069620000"], 0x19c}, 0x1, 0x0, 0x0, 0x4000851}, 0x800) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0x0, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 1550.553065] binder: release 12776:12780 transaction 1328 out, still active [ 1550.574743] binder: unexpected work type, 4, not freed [ 1550.589051] binder: undelivered TRANSACTION_COMPLETE [ 1550.605418] binder: 12804:12805 BC_INCREFS_DONE u0000000000000000 no match [ 1550.608666] binder: release 12788:12795 transaction 1334 out, still active [ 1550.608672] binder: unexpected work type, 4, not freed [ 1550.608674] binder: undelivered TRANSACTION_COMPLETE [ 1550.610378] binder: undelivered TRANSACTION_ERROR: 29201 [ 1550.610543] binder: undelivered TRANSACTION_ERROR: 29201 [ 1550.619535] binder: 12811:12815 BC_INCREFS_DONE node 1339 has no pending increfs request [ 1550.619638] binder: 12811:12815 ioctl c0306201 0 returned -14 [ 1550.627428] binder: release 12811:12815 transaction 1338 out, still active [ 1550.627433] binder: unexpected work type, 4, not freed [ 1550.627436] binder: undelivered TRANSACTION_COMPLETE [ 1550.666988] binder: 12812:12816 got transaction with invalid offset (0, min 0 max 0) or object. [ 1550.667054] binder: 12812:12816 transaction failed 29201/-22, size 0-8 line 3199 [ 1550.674816] binder: undelivered TRANSACTION_ERROR: 29201 [ 1550.683457] binder: 12820:12821 got transaction with invalid offsets ptr [ 1550.683523] binder: 12820:12821 transaction failed 29201/-14, size 0-8 line 3164 [ 1550.683710] binder: undelivered TRANSACTION_ERROR: 29201 [ 1550.729358] binder: 12804:12810 BC_INCREFS_DONE node 1344 has no pending increfs request [ 1550.741659] binder: release 12804:12810 transaction 1343 out, still active [ 1550.749009] binder: unexpected work type, 4, not freed [ 1550.762366] binder: undelivered TRANSACTION_COMPLETE 08:14:02 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/status\x00', 0x0, 0x0) request_key(0x0, &(0x7f0000000200)={'syz'}, 0x0, 0xfffffffffffffffb) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) readlink(&(0x7f00000000c0)='./file0\x00', &(0x7f0000001400)=""/223, 0xdf) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) write$binfmt_elf64(r1, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) recvmsg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0xf7e9}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x100) 08:14:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x80000, 0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f0000000040)={0xa0000010}) r3 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r3, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000080)) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1f, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="00634040000000000000000000000000080000060020000000000000000000"], 0x0, 0x0, 0x0}) 08:14:02 executing program 0: r0 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/user\x00', 0x2, 0x0) vmsplice(r0, &(0x7f0000000280)=[{&(0x7f0000000080)="aeb2ef9e606f040256e0e43f655b5a4fc93eedb9af20d3db0962399ca9d9f4a91332a847f880de67fe979387be00f34b6602b663308b79e677216a9d27e98239ac0ad39a1025baf673e9e6963cd85dc8a5f67f920b69f6721af1417c1f508419330aaca41f", 0x65}, {&(0x7f0000000380)="17f23447047fd247744b10e39ca8ddbb08e95586ec3bce00e69d667f898578986f4a26e8805d6391cfa9904fd404b41320f09faf2d0858795fb24f0acac6fd4a47ab8a3753f1107c02951d39852046d9926878ff23166b9791119892cfef8206ae82761b42d851f1cfb4f561b814cf0216b0ab08f820bba5f15b2b452a5728dfa84a8520ec5e086d5648b169bd92b886a28832254a3beed84b3d79c21096b70556fba02c3b1724f3e273a7aa49e1fb0cd2552ffd6d216f47c6b55233444d5df6e7f85530a3eb0c50039673c566edf38cc0a8ed539e5fd24fe2914f5efee2fd3072d90cce414dcb201b5ff2d94cf8d663", 0xf0}, {&(0x7f0000000100)="9869f123d93bee926b0bc118baf4e3f033ccee10ccb7bd2ce4c922d5236739f3fc7a71931a580a4cbdd8603e", 0x2c}, {&(0x7f0000000140)="810d374e29469565aa6dfb60067dfb9aa2b8f6c5ac641d58d38bd0ba2349db9553e800d9f58a0bd401175c1e2bd78ffcbe327dd97f6864fca4d9c2c53f27167df485d4a2a90d2d14368ebab9e49dc64fb47bf1661b3677", 0x57}, {&(0x7f0000000480)="d06c51ddfcabc8bb85acc03a926b3f527e6bb5ab57cb13c43a38340b4893b60b73d46d38c44d0143899c2ada4c6e26c952635acdb97260f6b0d714fb77da02712ce551801092dd75f568d6030d090bc4606bc17e166bef24827d963800fc84e21887fdd42bdc6a14cb85edc432f6f4637a9d619e40b6b96f0258b37ad20afe534951fb2c44a72391f3c341ed1828a7428bdf9c221c2d7f990cc19824ff5f042465a889d4bbfac1b1fd6ebcfa1c0e6d7d495147b62be9f5a9f6b988d65069ffba92b6567967e130df90548e525a9cebdff4c62c3d3b1d12733885f22995b7792013eb0e42cac443c2b25021f3b374df41829f8047106c03e1c0a2a290ab9394bf14325254e7ec3734d955f8eae008bbe807848072ce9c5af6c3dd2620ede27509197cb6fc56e10267b54bb537a066cc3c2bbaae00a13d4c255af534bbece400f6b9d56909502f8ea3ce02c9e3af6d3cbb85fbe86730bb9bd695b00dc75e394e361c894a69c99b8cdc838aebed81b1654274d00da05c5d01b44fba5d3801abb804f932a2b799e0e3f487264c95ee79b54735455dcd8173a490b3630b07a36a5ceb8fe8d5841a725e228518119cbb72246a1259344a7ca84d6011cfbd9e8b6c6d6c604682ba9037b736f7c1d9a33642424cb3691a1a5c937a99d1b42eca40ed07f7a00d8021212b50df624952aae6c19c4342e80e767cbdc1be34456a79fd0032b8a1c1a9ff9f92793b30eae838f5550090201ab04eee8aa42efa85b91543b3938ba22ace5b0721845bd0b96832f5eef9d228445346f914137f4034b3193345408f016ae1c47d95c221c7030261d02273bbb09e72305904ab800aea38404fc2700c28d7d9e513f976208256eba0339d8bcda2d234a134dd60c615b895338037bcd916e209d2ed5ea18a517a95a9a728750b6854005b2afad693cc9b21c370f0ebe12d86c56d5f5fe999f989671810ae2fbd575067ecf00997e0a01c5111983f543cf20f2d6026e6bc19e5fe93f0947fcfe809c1e5c27049a6b98faa3cacad34958c9dae955ec17f256e5d12a146f2e72f93d63d2f9d4ea0c55da0fa6e5109ebe502ebccbcc9703e6fbe2df03f87886b7d7b09e977d4e9943b6ff4b8c039a1f41093467693172f1e69358289d714b22e928851cf6809781995bde0c3e3fde96e0f0cbd37871e0a3cd7c5cf6128668e1386c22f82b2f131817783c36a94adf465e287ed03f2591c903984d502d518480aaa7790a849a7816ef03afea976d982a8a7a44958ce8b8337441511cbef369a4d74e793c5e2aa0f3983fb808536818ea81f2ee0d15e518bb99da595957fd031acac70dd16edf529fb357f4a0751c5515fe54c46a1ba31887ce61b6a8b09d2c3fd81c90d00af8abd289a0cd44237959b4d84c91bac787fa3533e2de0db402a26627ccbd1fa7b17d26610d8d2681a44b14fd3bf7cacc14910adc34b76b19629c32d56f85b20163971be9e808eeb8ecaf3f6d8dec28ca4070ca1ca3331ce5bf67be440c3fc6190f0abaab73ae9b1531801ba253395d1f08935c9f8f707326dc9be86b152f5cbad03dbcbfb0b0a3adb2666c0cb2884d8825183aabca76daca38a03f5f502a19d51e0e4c1bf340a8f1718ccdc954da25e0350c906c9c0f466db6bc87b7acfe99d9fc79f96b6854ac4e4237bdadc7552758a6040d15b4bff82e607a40163cfcc5201b7553639a78fced6cf93a1b8d447b6fb01efa01bb7d536a78463dd2c871e7b43ee0ee842fcd300bf890a7fd698ac16d29de85fb3ec8669ecdebd1159ec1d1b08a3797ae60ac9019eb01b1144a9519668da76bcff0a6239812bf3e00c2a10e398b153a88d6367c7c32e68186a480789803d1f2dd7837f22db234ac3dee29fa74e1451b25b59dd6d7a092a1170dd7192c05270d018154d8af74600314dfb70c56f3f2afb2698f1758476b5a4889c1eb2951d424a8a28fb49c16491e43bd412fbad6ce5bf1ab05f2de5457e14893c7834b481fe4df742bde2a3c9465f64e71c0b687c6a5ec4aa84d763c4d9d888370670bba904775c86e7722b7236029d0cf80466bbe2b7551eb69330db6c868850d3beac1e488fba0fa965e61eda3d19487c905e7c6fdfda19604c102a2c0a8276e0ec06c62653fe54c7c33659d67e676a5e8fc1e1d76c5a3371bdea7b86dc3f39be7c6c935c16207ca049d2cf5cc78121bf3f8c92d5ab3b4a11b3ffd38bd82c53ccca15212e3ac3f7ee7199862ceae17749b7143e65ba39abc6b6b87771cf8cf98e1826f2688fe03b341d98a06ba6dc41d8eda993b880a9ea7e68cfa896d3f0c9a7320e7feced479d4a889e47a40b9ce4bd35eb06dbe0cb19138a14b55a6ac2fd60b602b90db0f24b7fba236129bfd8859d09255f2bb688e0f311faa4836c92fab80d959e466356cbddf1a1224b8b2a7e03b4749774008266c0c2999133012b21e57b56ea669e5ec2cb591d33d062882aee249f90e007c3c59ec17db3fb6f8abca780e12883389fce803bb7d9a6a7da6b1480b4a65ddcd84818ace6b234b3f4badfe8ef01b332b85ab558c48f7ce9ac0c8cc034c2c996bdb04a76186571149cc9d7ba407c32f1631181b93762b1b8604bcf0fb92409713697f7aefaa30603828e8e1b54fc9d18a6c014b3947588cabbaa1597bba06d4f9aaa3dd3cdb4b1b0502ed841c7204fb88a0b240094c289a2fe00ad40e362277951af640db607600e53a46d3d720b34b3634a3cefad5f78384c62a5afcb546c690acfb9f9c34e739a9d4a185d5b953044ccd66bea57fbd6d16803bf274cbf9a6dfc4740616856c6d328493198d1b6e2ff287eb082272b766fd63d1d93e73caa804fbdf0b19f9c485a9e015fa2a69dded74a81a7428ac4125f56a7c710fd4c8747e324a6e30091b12fdfe1dbd029b91db963bfbb441f1db5d2c0ecbf46a4d1b908516eede6333115053a7fca38df7c5184a667153195f2a38a5d185a3637b05b0c0bc35d91e3646d332f4137d5d6df7708c5fe5a2e07d1216d6ee01d4ffd2b69f84c177eff2e1b52c8037a26822a18b68dcb3af310a3297b33d1106d65d39dcb8b029cbf23d41f9bb6f6cacbc262129ceb713f20fd94e3f142869d5b817cd8c56e5e2a00f4671e2e0432db7acca233e34da43eed51992ff550dc7637c1f11416da2e4a3e3b93edcfc69a1035cda738ade10a47cfdea90c6163b8e57e1d9fad96ad183c08c5378195396d37f4204cf4ec9cccce781412c85c20df3c0b8402d15467b83d92a2e60e30a5590fb45cae43b0dd13c01547054b1ddcade3954f679eb9a020248254d6521ee0f4a56715310a7017cb1cc80b1a04939e3028a46ac9bf84154a442892e490622d4604983c5ebbe9fbdb8bff156b890c479e43c1ec7c34bc5050deaa41e03c8515274dc90c51b15e21520270428eab04fed48f3a5a45f4af743d15b10b75153e18fda9cbaee1058e2e9c8355f68585d7fc01c5da84e76c83d38269ee1aa19ae674d015b8b07e1af16b2e73de9569f0e9eaae4872366c0f827ef7e212ba054bdf467eb4b7fee140cca0e5524ad2fd1c90cdc748501930ceb2fe916f5586e6091bb5072522f128d360faf8542bb625afbae19b12e7bf74b95ef66c85c73b628662fa6af89a67193215203d2428e99dbcdf99a81837001c49b1ad2453217e9dcc1f4525df7b67054a9de21ed1a6a97f4cc2f51e11384f51db8abfd5bbcd67a8625e32a08fcb4b08a897ce96f186b257f7f0b9d50e159589e503cc1f826e00a71db8eb297a13eba69aee1f100c22ca5e960e4502e6946dde0abaaf9040e8a374a4b13f7e9fc819d7977955db524646fe18a09c3058df035e3d129af2fa15395bf3b8063d399bb1635e7448d1dc97f5ecc3075455ed64b6dce8123d83ac730cb0bbb8ec65d4cb9d4f239c4db9eaf2b6e4817eb056ec1a8b9cadcbce3da5751ff198d38798920bb32bcdb9233eb16de969d74ba25263a79fc9ee42bf25f84892d553b3edbc16df89f25706033559d7616b58d63e70a2ba8b7b2f0c446b7c5fbbd76c837aa9dee6de39c92abbf4f432ca8bfe2fd72aa4fc1b149cf7b61e2797dd2b14862f2d123185443e77568d4dcfe03005823e6eab13cd1c5c104f0c28936dc1879d49c8896bc3d939c3168c35c9744bc4f966cebec97b895f3a0f439260f81d7d7602ea6afcc5774e2185cb594c02a80742e167230992d85bacc39a03e42bd76046e6a1c9943ebe4738ee25f11080c2673a574aff2618e520aec5267c1e783272d82fa21ef9b6673a0a653ff3ef01b8b5ba8d7c9f2f1091fe98d9636af668cb23997c5a219afc912bdb6852939cfba4c995d44c7217f21faea03c8d2ccc0e83504b1bb70b1326b9bb5a7033038eb282be3e62352f4d4c9975d6fee54814ddac4a9e54f328a19ccb47d0f297b64f5dd8673a4bc2faf716adecc8bc2b497b18d3a7b436fd4d9524ef7596f00a4addbc8de5f6214214d2a53fa234e4dc5589326693ffed3608122d00327d4e743412312aa1214562008a870c8ae6e869adb366406b091f454a25cfc5274159e0ea3ce044df72941423b94ea0020df74099c1f4640739e370326e123b702a43b521b63b22c71a1bf5b65f1d23c113587093f1b79e7b5364d25eeaccb2d33fbfd148467c0e40b7db16378cd8c021e99aa6289764a669f4392d45b806a70b54742ba9b1f4816bbfcad43924f939a4c5ce6367ccf7ee5dd0d30ee8247b5093f772182422b8d18ba5a1081cc1f00eccf8dd1da60f3e6e3baaa33700cc9d6f35c28fe8d8fef85f2bfbf5410eb43d4997160e970cd541f6aceed2decdad23e36710066d9832e4f01f490699a5ec5f123134bbe953ddb21041d2b338219ec4fd45a56a3eb3b7f48a3dd1708ff1938e5d0d77e8cad4f0ea9dae1bca2448dec4513746dadc9c783e65704333c44266396bbddd608077c767f5cb0e9fa746a8fd8c18599b45107af1f9e745a88e84ff8b6e4bc0366c498e78c3c011e3a5607a3957e7d7a08d3a083d7b98e221229cd9742cede28351324063f98543a24512fc0426e2a6b5f4f22a406ce94a5b5d37d8916254ceee7810d58955c85260946877e2417293eabf73e88f5f29b51ad234000a9bff581dee379d542aaaba48bf02d2282a183238d10da8c7f329c9274366115d9c080f26fade40ca1bf9a75516dc0a4568250068a13408790a8b803b45f5c0ccd284a39d3239a6b5353c3a0011adcba61a6da267be770660704ea307e2866d373ad4448ab25291643f2992c598308d5fd52dff0e9f1a31c851d7fadec41c5f8bb019f3712457b54be519a64181596655ae02ade8aa5e34554cebec50b479ebe79fc0fc36f1ce42e184f9d57cb0a1b200beec99346b7e7ab919e40573e32fe887c43dcf414d41a149a984b7276c486b9f9b6e47c36e8e1285426c1958c5fe609c0734d9e74fb5e78f47a5ccbb8ecb4913028d97840f2e4cf8506fe44716f3869ba454ca047eb12b860ab28d8778bd00b3dedbbe296634b3ac95e285d17f4cda924a14b3d86069714e31e762f66dfc6cb869f07c3bd0acd3c235dac37c8f3bd544ea2ef364d06d2bf7d7da5e8f246971105fc9f6bcc255f17841dbdd431cd39ed973134abf0eceb5749b1bf2da08ae23dd6dfd632c63b04af08f3b1fd3d44d6ed6f7eb3b971b745b277440aad8ac713f43f3c120610a563ca56a2f2040e66db87986e3be973c871144961f9e2571533ee92d442b3beaa8c3cd1e5669656d432f0f0d35d564085b68186735af2abcc1f439bf0a18abdec58006b9edb87c69d282d75d79cec83b35f50750500bc19e6e", 0x1000}, {&(0x7f0000001480)="60d01ef7c9a7e0768d4e5b408e57b85fc2c403cd9ea710b8625289a8912cdd827cf4583e86efa61eecd4b02352322ca0c15f105ba798ad31d984cbe47b500174f1caa7ca8ba9dd377c43bf2e458ece0c37def44ba535288a883b57e5061e16b77d18b3d8b8fd8a218cf531c324730c10b8e7e5f35fa91c22fc239d45effcc9f1a54b1ccdb696a99d64433540190cbfe57d235e0ba47a66ea379035afde93d7fcf753ddcb23ee66b3f57cefce6c3e12c7965e539ab0", 0xb5}, {&(0x7f0000001540)="a53032eeb214d3e7284b7d0e42e78193392680abdf8b78bd71cfdd8d7b0d02f6b01c0296fba3043c0d43747e3a24baf0611473461b4da453b37c3c0393116620602f39d5d02730da0b6279266f8b42f33da1c03a8a569badb297c1ed3aaa2cda4c0afefcf28e15a4f9f62f824857c1f5bed535b99018f01b51be4299dfcf992bd61441f88ff2cd9ae884cd9f6e2ddb194a314ac9441857354ed8195db11af1830437d28b7759905ba3bcee23989d86986ecf524b6ba2c26b81829665033f083daf136deec3d752e7cfe14e1aa60b3ffea8cda2e9208146dda47dac863f05c79100", 0xe1}], 0x7, 0x1) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = socket$netlink(0x10, 0x3, 0xf) r3 = fcntl$dupfd(r1, 0x406, r0) write$P9_RVERSION(r3, &(0x7f0000001640)=ANY=[@ANYBLOB="1500000065ffff0200000008003950323030302e75e5865f40657314869340397c9540a115a78e4aae1498a29e0137b3216191631213787383dfd8ed816ab007c88243b1784228019b4b795eff8beb60bff6a4e891f7adcad7fb34fd9c0819e68986e3527e137a664f4769b0c00395757e2c250bcfb9c531cdb8056dd0e204"], 0x15) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) arch_prctl$ARCH_GET_CPUID(0x1011) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="00000000ddffffff"]], 0x0, 0x0, &(0x7f00000003c0)}) accept$packet(0xffffffffffffffff, &(0x7f0000002c40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000002c80)=0x14) r6 = fcntl$getown(r0, 0x9) sched_getscheduler(r6) lstat(&(0x7f0000002cc0)='./file0\x00', &(0x7f0000002d00)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r4, &(0x7f0000002ec0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x28800000}, 0xc, &(0x7f0000002e80)={&(0x7f0000002d80)=@updpolicy={0xd4, 0x19, 0x210, 0x70bd2c, 0x25dfdbfd, {{@in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, @in6=@rand_addr="ec13468b9d3d230beef3f60741335c59", 0x4e24, 0x0, 0x4e22, 0x2, 0xa, 0x80, 0x20, 0xe7, r5, r7}, {0x5, 0x40, 0x60, 0x0, 0xfffffffffffffffb, 0x6, 0x4, 0x8}, {0x100, 0xffff, 0x7, 0xffffffff}, 0x9, 0x0, 0x3, 0x1, 0x1}, [@srcaddr={0x14, 0xd, @in6=@mcast1}, @extra_flags={0x8, 0x18, 0x7e7}]}, 0xd4}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000010) 08:14:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x400, 0x0) ioctl$BLKDISCARD(r1, 0x1277, &(0x7f00000000c0)=0x80000000) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x802) write$UHID_INPUT(r2, &(0x7f0000000880)={0x8, "aabe3be4a11c3497456bfbdb6ba2f5e8fb3f9f93992e41ffeaa08cc1c966bce3c1f5edb50174c4af1a9b6e04a3b3a6eddf49db07ee70e493d582302419a37f112b4a272d166430cfa28516a341c7a769846cb884a556773cc9fd39b3e33f86a6bb43db5bf8c3bb115733f7f741679d8f4c945fc2cbc062e7884161bbc0bbb832ad80cd60cb7c46ca0ca5ee25c084c291d9fc8e515251a84619b7e035dadbb5344b5f5e89ced22f84a5dab97ec14c3b611d3824e767a1370fe594a1a923eff57f4bb430e285d575d6faf10248e0efc6511ea15e2383663dcd72bfe3bf5df5ac51d2c6057c20f401b235e466a63072355c886952cc7329e1b60f24cdb52f6475f5c54af3b1bfc42d0c8ea58754f914dbe7179bb4d3a884d024e5cfcb645706380c51b068c3c08aebf458c865fb0ea187633a424740d0956791df7684f1268fcf54585807d3eaf2d13087bd8ad882dbd87341ecfbf76228ff00ea40caf51e59dd39fe3b041592bc9b3722c27bfa89fbaef252ac5714ab64a79ff9c8999f5140ea28a13191a3381307960c46af84013e17b4e3f1a9fdb3e1881de776ecb01ac077711bbc2c46d1defb1e08ef43a8b732bd5a58a5718e56f12d1df77033996969908a41b5366ebfcfc4aef1beeb30a1f49d39dfab5b58cbf3dc7da93dc0e158c78a7ec976a97e726fc5b240d1a9e1fc56cdeac4cacb879eff851763996f08bb61d84f79a3fa6f6e90786637266aaed28096bd2f343f5fbb5fa7a038db3c8f73540eb6f19ad91c26734746adbbef0fd545a3b4aa35aa23de974cf78c88d9a4e042c8d21c749ccf148637cb2b17477eeb9f72af3203bb3d7ec0c0e86c6b50702ddf3882327dd19c1397c0456ce61b35971341d8789ecf9e43d4bb85d8ae83446046df70e8406258887014c23b68cc3d52f72eca727d3980131da6dc193d6ac928805043ff0b1fc062e4b12ba3fd192e77c129fbded441d29d481bc41c41a227e83ed8799d34006a5111028450ee67740106f8dc1ea177012f21b74cf0527aacec59264abaac0b26d412bde923976281661a59637b58c8fccf1ab5df69210683bdb18b18492353995acd832af21d183155f7c3f6879e8b6210a59f5efbd8cf8e9ec800e1716017c5353035a2913a231d7f3aa62d584fbd5d826340b906907b4d058196767aafb2cb18df4a82dbf32e0a16169e513b6f410ff9f53d47f0f8cd77e2609538f925b57b02accd4e8df3c04a8509c74f1ee7517a21e4bca614384a723bcf209389e0628f282fc8144e3daa91e6e7a919b2308032eeef01f339bf59f2cd224c862279502372e54e2e99a415eda400f4922ffa0381e961e59b6b6df3378755fb2837e3e9d38e38803e87973c2c2396312b25f549accff9b1fb4cea8db8b4ec2f9a0eb045b01536b8c392a0d77bea030e0a3c64aabf085c2fa55f10477d41dd8c7420a89e99dbca39beceadc9beb67a0be4bebbb1aa8b87ea7a9a25b7829ae58104acbe0c4a32d454901ce70971833b01e08dcdb8e2b812aededf521c7be409b970a302cd30cd4816818aaf7278a4d26b5b40463750cb9df6ad1b4bfcea6bee6518f536deaf9f725c746d5ba7a0f8791ec56c398570daaa4c0529ca83339e94c0b8eaf80377ed682b696104481fb7df84cac8330441277527559c27e28ad4afbac68e4fff94b925bb2c0b813e45923fd17e8adeb7cee432cdba99ea1443ccdc83260f01971719a9a6528286a38a4bc82e74c707812da84abd58ec0bdc9c7202071a6b884dd11ce3bbec641928e0b0e2b7a217473059cebb12d100fd69fffb3a470d155b240ca4ba88d3a2793ebf3e6bd86a48617b3be2f68f550071d5b1fc8ef3a918bf2503bb8d0c3b690299b98993c2a0a624bf3b6ce92045e39793f6caa986bc8d98f48df476fbd27642d382963d6c35c86cfe9d4b822780a2913330292febb57e94df921e4ec8e9cb347c51e12ee5edb68099ee553fd0584d3dea4668f85a902583febba1104cde404ce7036d45c11807a85586db2e2232fadd524da04e56ff7a7bff1d2071f80349cb31f8a07300f635cf5ef98af76cac25d9f921a52777cba43f5ab97bb1815bae5a349a4d942ca10e607bb8fbd54fbb8bccf8df5a6b5bb7552a96aa5d705e0c96979cc2841c1bba4aecbb3bc11ed7f5acbd0bf502fc69d91b686ba23f1ce9ac7516eb0d00efcc760719dd0e6e8956f34195b0c5153a94104d32350974623517ed3c9ef8482eba199e616cf4fc6c895826f7ba4ea6b92dd150ebd4d47224adb3e5bb127efad9b3c3203758fdea241b5ae2bebf155f22b28dde6706d9688441f62d6c4fe9ab3513aa70303e6b1a08c9620e82b61737633391abc3cbcbc3a9d0ed4057ae6d826ad8e85ede66b7cd50ef2b305cc8cc0c27b5651bd5d822cef1afade26d55f6200ca99645b1cbcaba171f144f45b69de7068bf52d147ffe6be76bda07cc7af19ac4ece4052ab03564c7b6aa26328dd32e0d4c169911d76821273eb1bfd3ebb0bfde3524eb5a6bbe2084c6fb33782171713fe2a909498075617c4ae276ea039e35d47bf4b8d3364fd50cd783968a5ab8ea8316dc779e30f7b714dcd879e520fc8e44af5b17cf5fdd5432bb2222c9d910fb504825a2ec3388d8b759ed724ed76b315d5b45188044a29084f6aeb14ebb0eb941e6c91f4544fdb772f8bed4217efe80388dfbee59a2e8d0f8da4168031d4c789fde2c699633faf826443365a73c3faaf903d9b56bff38b4e4eeb484d44d791608276581526b5b2ec923666d04de5e09795c7ed1197323a5f571513e159d7f260cc1272b2544e9198200ea48cb9798cbccf34276c603d53e3b3fb917f212e2eaf554126803e55245b0a6f7f70d35fb18f02653beef97b2964459398e11208cfe15deaf9feb778c2f18880fc76571c2e47135187968420a6cce286fbb700ba9c5ac9f1f33128cb201566885ddcb25a74c1624243cf2572bcc07cf67a472c57b67eafc0485ae79bc4eb33e51b9bf8c5e2c170a92115d28f4a6afad05ab7d44d9679a3676ad842383bf7a306bc49c5cbbfd86b8eee2fd53b3860d653a5484e694381449da2d2463174b050fc87d06fb667a32b97d8ed58b2f66817f6a2a1ff5e2f8d8ca53c48a40715c6298d36f97524852cacc479dd94f55804a2405242c1a3e81bb063ae5d8f2dba8e6ec9fbe8dff48b439b6325869905ef2e3e50f6dfee2cefbfe5d9e064291c67e0f298010c65f944dc3ddb3f0cfbbb3a235dcd753bfd94123ce554129971266a446f13ba6e4084199a7ac23616bb531a34e2cd7547d0258c87067632cf967aef2d8a8303c3561a66db291a54ae347f07ab8008fb76b9e53b5982dbe36145b79530bb88f3a9022845a9c0fe75ef06c994114ae72cadb30fe9d0fc113dc92d28a71f19124f0ae1b79ade38eee49e4d4f89096fec7f61f55463e14622f8c12f40bc863e6de1f758075d8e77060aa8c02b749062731925616f7b6c3585b69c25e63e7c06ff1b9018b263f531de3d4092dd0f6521049222ba50b893994eb8de2d607c77908f826a32b9a760eb7f59388c0c2d4832854a2dcda77e7936620c88b64888537164ab6a93e8dc8ffd81309067a46ab6dc3ae545e40769d74285e055c2ae97cc59b49db321ee3bb7f4c275b9cbbb75c1698305143632e4e5acfd748a555ceb4a43974a2eb15cd25bcb2dd2930cea6ea3191c0234e184c9cc2c4f9a82f358da120aff89ced67b743dbecebadcec7f2bdac4447a15b1c219a384cafd2d57c9cb2c92376d73b9d146fd3283a7c1f9d3e589a614d94fc57e1264d02c201d696d54ef91bdb921bc6a15c63399e22e43ec11398ca8a51e4f0e85fd4ecf60e2349506b8758e0f11eb5430ec1566ab892b6051295c61b6ffddaf3c176cacb68f78dec4b27bed5e67ee6a391412776e8e0965d152cb35d7d0d3763afbfe9e41af79f0bc8e44ca55a9e4255aaa011f5f553bbcb0a04a1406aac8c366593529d9d4978d6a843413345a6a6934169bcc63855b1ab33a0cbc076f5709f9fc2ba32ff4d78649e48b556be518c1768048d2841d80447b29ab4a77385ba10cc825bb91fbbf64db513b2a18783e3660f7975b5c864e3d8c27df703b8762f8a86991d1582bf346b38afe8ea2ba99cb5c9475bad1a880720ebdea078f3da946684d7375534e3cd8f1601ca9d83f6a2c593b7f24ca548c7108d4f88d347306f7c3989226fb27e5d91cccb27041b74694a846fbc4ae77bbd8a651af922bc211c5352cfd532fc8a1c27f6a4b9b6ca8a7688d6506414af3cef1e8249eeb5f43bc425b8f371b489dcec5ec0fb0bd2d2fd83104b202093711caee812ef15defc7195f91802fb7bb754b6a38b7af65b41f6d3cb8a837627a6cb1a6e29b88d635eeab22fccd55549a90f5d79243c98f263a290e7ae56b84ebac0104de7c69c583298c974abce2555b4a660897ec8e46b51b1138210a49664bf9901a2ba78c106ffc7f981db38d87b11f34d5f9e5dc7d335d65aea09d3c078b23e779081d0df3a2e8ed8ea10991fa3526f57bbc52453436408a8b92237b460850389b8c1a7c2eeec9c423f8757b19b7cdbd669313d4825c1aee8b3582675d03e7a701b3e1113c95f38950482d01e8f20641770538890d15e59358c277b0a515299c975c158f24eb2216c9cd5d91266eb46123e179e2480d0bbdc2189f1929498c89dfff68b865cb7c2e6e3e438172fb7ba6d19706ad007fcb2b4a4ba6e6db40d6d59c938519565581ce99541544edf1e34b76595e78d73e2458e4471f44c3d2a3f6d72a6d79a15009b0540a7983ad2455acbd831336cf7f675ed7314bcc31aa96f716b8d20084f17dde77815634134ae3770a9e5fcac07ada55a3bea98ff10d1c39e81006a1d3ec9a576f9adc405c0c62aa216d937279d8bbaa640ef9ec1607b56b7095579ccc6c91e19743c7df0d41b7c503fcb73494971d00351b8fd0d7aff60b498e62840009cf0386e4c753bf89072e5a9ca27fb3f73fcee5f4bdd7e38172785024ff40083abf3c0ba635ed03f352029df778cf6764455e7ff54c826b8afb257a08ea0726cb1403716abab614512f65a6acb1e8fa1d1210d6a52a183feaa7544d233698c8c28190507738fa1693f2a95506ef1085ff0cfa4bfe5a668fe1b0e523aae839d82aea76a4638e3a8d61a169e2e6eb2aa6c1383ab5161c82babeff343ddc7471269688c6e067610377a6e6013fce5837b4945eba972fc8c8ae8ffc9a69962725f0af25fd527103fe1a8202e3cc2be995c81e05a8d244f6512c080d6778add768f5935542e520e14f37506dce036d13ae41d78dca02919d2e2b06d1d1e0bb78d7949106b51de8a91781e6d4dbf52f6adfc75d6f6da42420deeed360803677aa9612ace4be7fef86a81d1a86fe34a27a237648b53ace3f118be5542bfd8ea873a7ae21287946e570563a394851c88ddd6c5331a99f38f3c217c9fbf8311997bdee7efd966258f3b7030a362c2e5985bc33aebe65ea62c827ee1f303089f57a8603fbb815c6c7999f80c54442d4c6ad9d3046e3d8bc9f437ca77419fb81594b9f50f612ff966908978f7e3665c0db348984e0f1b1d302974e4c545e8c8294b4e7be8d4662f80ebc64b6ba81cb72f3c81f0e6425080a4471b5d7d0be88da1e39a59ae5d1ce69b34bc8a37571b4caea9bd4a6d86cf23c8430ed22f9de578486d57da8afcfb6055b68c5a0691e8ddc60307649527ef6ba63b7789a249e10ccfc0bd13ecc51b4def870747cdb418d91edc9fa147ece5748bd79dbacbfc28607839c4f4690083a5c8e961e2ecda", 0x1000}, 0x1006) 08:14:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="086310406ad7b90d76c6a3803eb9f065445d71cbaa5be90b524ea95b3303dd2f5560b125808dd9", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1551.163716] binder: 12826:12829 got transaction with invalid offset (-150323855360, min 0 max 0) or object. [ 1551.184344] binder: 12831:12832 BC_INCREFS_DONE u80a3c6760db9d76a no match [ 1551.193751] binder: 12826:12829 transaction failed 29201/-22, size 0-8 line 3199 [ 1551.194748] binder: 12827:12834 BC_INCREFS_DONE node 1351 has no pending increfs request 08:14:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f00000000c0)=0x6, 0x4) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) write$FUSE_POLL(r2, &(0x7f0000000000)={0x18, 0x0, 0x1, {0x8001}}, 0x18) ioctl$RTC_WIE_ON(r2, 0x700f) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="ff00000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) bind$unix(r3, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() ioctl$FITRIM(r4, 0xc0185879, &(0x7f0000000100)={0x3, 0x7, 0x5}) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000380)=""/122) wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1f, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="00634040000000000000000000000000080000060020000000000000000000"], 0x0, 0x0, 0x0}) [ 1551.194853] binder: 12827:12834 ioctl c0306201 0 returned -14 [ 1551.196089] binder: 12831:12837 ioctl c0306201 0 returned -14 [ 1551.226917] binder: release 12831:12832 transaction 1347 out, still active 08:14:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/context\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x40080, 0x0) r3 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x10) inotify_rm_watch(r2, r3) [ 1551.260516] binder: unexpected work type, 4, not freed [ 1551.277719] binder: undelivered TRANSACTION_COMPLETE [ 1551.290096] binder: undelivered TRANSACTION_ERROR: 29201 [ 1551.298333] binder: 12846:12847 BC_INCREFS_DONE node 1355 has no pending increfs request 08:14:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x802) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_STATS(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4428000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r2, 0x20, 0x70bd29, 0x25dfdbfc, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8054}, 0x20004000) write$UHID_INPUT(r1, &(0x7f0000000880)={0x8, "aabe3be4a11c3497456bfbdb6ba2f5e8fb3f9f93992e41ffeaa08cc1c966bce3c1f5edb50174c4af1a9b6e04a3b3a6eddf49db07ee70e493d582302419a37f112b4a272d166430cfa28516a341c7a769846cb884a556773cc9fd39b3e33f86a6bb43db5bf8c3bb115733f7f741679d8f4c945fc2cbc062e7884161bbc0bbb832ad80cd60cb7c46ca0ca5ee25c084c291d9fc8e515251a84619b7e035dadbb5344b5f5e89ced22f84a5dab97ec14c3b611d3824e767a1370fe594a1a923eff57f4bb430e285d575d6faf10248e0efc6511ea15e2383663dcd72bfe3bf5df5ac51d2c6057c20f401b235e466a63072355c886952cc7329e1b60f24cdb52f6475f5c54af3b1bfc42d0c8ea58754f914dbe7179bb4d3a884d024e5cfcb645706380c51b068c3c08aebf458c865fb0ea187633a424740d0956791df7684f1268fcf54585807d3eaf2d13087bd8ad882dbd87341ecfbf76228ff00ea40caf51e59dd39fe3b041592bc9b3722c27bfa89fbaef252ac5714ab64a79ff9c8999f5140ea28a13191a3381307960c46af84013e17b4e3f1a9fdb3e1881de776ecb01ac077711bbc2c46d1defb1e08ef43a8b732bd5a58a5718e56f12d1df77033996969908a41b5366ebfcfc4aef1beeb30a1f49d39dfab5b58cbf3dc7da93dc0e158c78a7ec976a97e726fc5b240d1a9e1fc56cdeac4cacb879eff851763996f08bb61d84f79a3fa6f6e90786637266aaed28096bd2f343f5fbb5fa7a038db3c8f73540eb6f19ad91c26734746adbbef0fd545a3b4aa35aa23de974cf78c88d9a4e042c8d21c749ccf148637cb2b17477eeb9f72af3203bb3d7ec0c0e86c6b50702ddf3882327dd19c1397c0456ce61b35971341d8789ecf9e43d4bb85d8ae83446046df70e8406258887014c23b68cc3d52f72eca727d3980131da6dc193d6ac928805043ff0b1fc062e4b12ba3fd192e77c129fbded441d29d481bc41c41a227e83ed8799d34006a5111028450ee67740106f8dc1ea177012f21b74cf0527aacec59264abaac0b26d412bde923976281661a59637b58c8fccf1ab5df69210683bdb18b18492353995acd832af21d183155f7c3f6879e8b6210a59f5efbd8cf8e9ec800e1716017c5353035a2913a231d7f3aa62d584fbd5d826340b906907b4d058196767aafb2cb18df4a82dbf32e0a16169e513b6f410ff9f53d47f0f8cd77e2609538f925b57b02accd4e8df3c04a8509c74f1ee7517a21e4bca614384a723bcf209389e0628f282fc8144e3daa91e6e7a919b2308032eeef01f339bf59f2cd224c862279502372e54e2e99a415eda400f4922ffa0381e961e59b6b6df3378755fb2837e3e9d38e38803e87973c2c2396312b25f549accff9b1fb4cea8db8b4ec2f9a0eb045b01536b8c392a0d77bea030e0a3c64aabf085c2fa55f10477d41dd8c7420a89e99dbca39beceadc9beb67a0be4bebbb1aa8b87ea7a9a25b7829ae58104acbe0c4a32d454901ce70971833b01e08dcdb8e2b812aededf521c7be409b970a302cd30cd4816818aaf7278a4d26b5b40463750cb9df6ad1b4bfcea6bee6518f536deaf9f725c746d5ba7a0f8791ec56c398570daaa4c0529ca83339e94c0b8eaf80377ed682b696104481fb7df84cac8330441277527559c27e28ad4afbac68e4fff94b925bb2c0b813e45923fd17e8adeb7cee432cdba99ea1443ccdc83260f01971719a9a6528286a38a4bc82e74c707812da84abd58ec0bdc9c7202071a6b884dd11ce3bbec641928e0b0e2b7a217473059cebb12d100fd69fffb3a470d155b240ca4ba88d3a2793ebf3e6bd86a48617b3be2f68f550071d5b1fc8ef3a918bf2503bb8d0c3b690299b98993c2a0a624bf3b6ce92045e39793f6caa986bc8d98f48df476fbd27642d382963d6c35c86cfe9d4b822780a2913330292febb57e94df921e4ec8e9cb347c51e12ee5edb68099ee553fd0584d3dea4668f85a902583febba1104cde404ce7036d45c11807a85586db2e2232fadd524da04e56ff7a7bff1d2071f80349cb31f8a07300f635cf5ef98af76cac25d9f921a52777cba43f5ab97bb1815bae5a349a4d942ca10e607bb8fbd54fbb8bccf8df5a6b5bb7552a96aa5d705e0c96979cc2841c1bba4aecbb3bc11ed7f5acbd0bf502fc69d91b686ba23f1ce9ac7516eb0d00efcc760719dd0e6e8956f34195b0c5153a94104d32350974623517ed3c9ef8482eba199e616cf4fc6c895826f7ba4ea6b92dd150ebd4d47224adb3e5bb127efad9b3c3203758fdea241b5ae2bebf155f22b28dde6706d9688441f62d6c4fe9ab3513aa70303e6b1a08c9620e82b61737633391abc3cbcbc3a9d0ed4057ae6d826ad8e85ede66b7cd50ef2b305cc8cc0c27b5651bd5d822cef1afade26d55f6200ca99645b1cbcaba171f144f45b69de7068bf52d147ffe6be76bda07cc7af19ac4ece4052ab03564c7b6aa26328dd32e0d4c169911d76821273eb1bfd3ebb0bfde3524eb5a6bbe2084c6fb33782171713fe2a909498075617c4ae276ea039e35d47bf4b8d3364fd50cd783968a5ab8ea8316dc779e30f7b714dcd879e520fc8e44af5b17cf5fdd5432bb2222c9d910fb504825a2ec3388d8b759ed724ed76b315d5b45188044a29084f6aeb14ebb0eb941e6c91f4544fdb772f8bed4217efe80388dfbee59a2e8d0f8da4168031d4c789fde2c699633faf826443365a73c3faaf903d9b56bff38b4e4eeb484d44d791608276581526b5b2ec923666d04de5e09795c7ed1197323a5f571513e159d7f260cc1272b2544e9198200ea48cb9798cbccf34276c603d53e3b3fb917f212e2eaf554126803e55245b0a6f7f70d35fb18f02653beef97b2964459398e11208cfe15deaf9feb778c2f18880fc76571c2e47135187968420a6cce286fbb700ba9c5ac9f1f33128cb201566885ddcb25a74c1624243cf2572bcc07cf67a472c57b67eafc0485ae79bc4eb33e51b9bf8c5e2c170a92115d28f4a6afad05ab7d44d9679a3676ad842383bf7a306bc49c5cbbfd86b8eee2fd53b3860d653a5484e694381449da2d2463174b050fc87d06fb667a32b97d8ed58b2f66817f6a2a1ff5e2f8d8ca53c48a40715c6298d36f97524852cacc479dd94f55804a2405242c1a3e81bb063ae5d8f2dba8e6ec9fbe8dff48b439b6325869905ef2e3e50f6dfee2cefbfe5d9e064291c67e0f298010c65f944dc3ddb3f0cfbbb3a235dcd753bfd94123ce554129971266a446f13ba6e4084199a7ac23616bb531a34e2cd7547d0258c87067632cf967aef2d8a8303c3561a66db291a54ae347f07ab8008fb76b9e53b5982dbe36145b79530bb88f3a9022845a9c0fe75ef06c994114ae72cadb30fe9d0fc113dc92d28a71f19124f0ae1b79ade38eee49e4d4f89096fec7f61f55463e14622f8c12f40bc863e6de1f758075d8e77060aa8c02b749062731925616f7b6c3585b69c25e63e7c06ff1b9018b263f531de3d4092dd0f6521049222ba50b893994eb8de2d607c77908f826a32b9a760eb7f59388c0c2d4832854a2dcda77e7936620c88b64888537164ab6a93e8dc8ffd81309067a46ab6dc3ae545e40769d74285e055c2ae97cc59b49db321ee3bb7f4c275b9cbbb75c1698305143632e4e5acfd748a555ceb4a43974a2eb15cd25bcb2dd2930cea6ea3191c0234e184c9cc2c4f9a82f358da120aff89ced67b743dbecebadcec7f2bdac4447a15b1c219a384cafd2d57c9cb2c92376d73b9d146fd3283a7c1f9d3e589a614d94fc57e1264d02c201d696d54ef91bdb921bc6a15c63399e22e43ec11398ca8a51e4f0e85fd4ecf60e2349506b8758e0f11eb5430ec1566ab892b6051295c61b6ffddaf3c176cacb68f78dec4b27bed5e67ee6a391412776e8e0965d152cb35d7d0d3763afbfe9e41af79f0bc8e44ca55a9e4255aaa011f5f553bbcb0a04a1406aac8c366593529d9d4978d6a843413345a6a6934169bcc63855b1ab33a0cbc076f5709f9fc2ba32ff4d78649e48b556be518c1768048d2841d80447b29ab4a77385ba10cc825bb91fbbf64db513b2a18783e3660f7975b5c864e3d8c27df703b8762f8a86991d1582bf346b38afe8ea2ba99cb5c9475bad1a880720ebdea078f3da946684d7375534e3cd8f1601ca9d83f6a2c593b7f24ca548c7108d4f88d347306f7c3989226fb27e5d91cccb27041b74694a846fbc4ae77bbd8a651af922bc211c5352cfd532fc8a1c27f6a4b9b6ca8a7688d6506414af3cef1e8249eeb5f43bc425b8f371b489dcec5ec0fb0bd2d2fd83104b202093711caee812ef15defc7195f91802fb7bb754b6a38b7af65b41f6d3cb8a837627a6cb1a6e29b88d635eeab22fccd55549a90f5d79243c98f263a290e7ae56b84ebac0104de7c69c583298c974abce2555b4a660897ec8e46b51b1138210a49664bf9901a2ba78c106ffc7f981db38d87b11f34d5f9e5dc7d335d65aea09d3c078b23e779081d0df3a2e8ed8ea10991fa3526f57bbc52453436408a8b92237b460850389b8c1a7c2eeec9c423f8757b19b7cdbd669313d4825c1aee8b3582675d03e7a701b3e1113c95f38950482d01e8f20641770538890d15e59358c277b0a515299c975c158f24eb2216c9cd5d91266eb46123e179e2480d0bbdc2189f1929498c89dfff68b865cb7c2e6e3e438172fb7ba6d19706ad007fcb2b4a4ba6e6db40d6d59c938519565581ce99541544edf1e34b76595e78d73e2458e4471f44c3d2a3f6d72a6d79a15009b0540a7983ad2455acbd831336cf7f675ed7314bcc31aa96f716b8d20084f17dde77815634134ae3770a9e5fcac07ada55a3bea98ff10d1c39e81006a1d3ec9a576f9adc405c0c62aa216d937279d8bbaa640ef9ec1607b56b7095579ccc6c91e19743c7df0d41b7c503fcb73494971d00351b8fd0d7aff60b498e62840009cf0386e4c753bf89072e5a9ca27fb3f73fcee5f4bdd7e38172785024ff40083abf3c0ba635ed03f352029df778cf6764455e7ff54c826b8afb257a08ea0726cb1403716abab614512f65a6acb1e8fa1d1210d6a52a183feaa7544d233698c8c28190507738fa1693f2a95506ef1085ff0cfa4bfe5a668fe1b0e523aae839d82aea76a4638e3a8d61a169e2e6eb2aa6c1383ab5161c82babeff343ddc7471269688c6e067610377a6e6013fce5837b4945eba972fc8c8ae8ffc9a69962725f0af25fd527103fe1a8202e3cc2be995c81e05a8d244f6512c080d6778add768f5935542e520e14f37506dce036d13ae41d78dca02919d2e2b06d1d1e0bb78d7949106b51de8a91781e6d4dbf52f6adfc75d6f6da42420deeed360803677aa9612ace4be7fef86a81d1a86fe34a27a237648b53ace3f118be5542bfd8ea873a7ae21287946e570563a394851c88ddd6c5331a99f38f3c217c9fbf8311997bdee7efd966258f3b7030a362c2e5985bc33aebe65ea62c827ee1f303089f57a8603fbb815c6c7999f80c54442d4c6ad9d3046e3d8bc9f437ca77419fb81594b9f50f612ff966908978f7e3665c0db348984e0f1b1d302974e4c545e8c8294b4e7be8d4662f80ebc64b6ba81cb72f3c81f0e6425080a4471b5d7d0be88da1e39a59ae5d1ce69b34bc8a37571b4caea9bd4a6d86cf23c8430ed22f9de578486d57da8afcfb6055b68c5a0691e8ddc60307649527ef6ba63b7789a249e10ccfc0bd13ecc51b4def870747cdb418d91edc9fa147ece5748bd79dbacbfc28607839c4f4690083a5c8e961e2ecda", 0x1000}, 0x1006) accept4(r0, &(0x7f0000000080)=@alg, &(0x7f0000000100)=0x80, 0x80800) 08:14:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r4 = gettid() wait4(r4, 0x0, 0x3ffffffe, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$TIOCOUTQ(r5, 0x5411, &(0x7f0000000180)) dup2(0xffffffffffffffff, 0xffffffffffffffff) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETOWNER(r2, 0x400454cc, r6) signalfd(r1, &(0x7f00000000c0)={0x9}, 0x8) [ 1551.301174] binder: 12845:12848 BC_INCREFS_DONE u0000000000000000 node 1358 cookie mismatch 0000000000000000 != 00000000000000ff [ 1551.301277] binder: 12845:12848 ioctl c0306201 0 returned -14 [ 1551.301722] binder: 12846:12849 ioctl c0306201 0 returned -14 [ 1551.335663] binder: release 12845:12848 transaction 1357 out, still active [ 1551.343229] binder: unexpected work type, 4, not freed [ 1551.354720] binder: undelivered TRANSACTION_COMPLETE [ 1551.368215] binder: release 12841:12842 transaction 1353 out, still active [ 1551.376170] binder: undelivered TRANSACTION_COMPLETE [ 1551.389505] binder: release 12827:12834 transaction 1350 out, still active [ 1551.395466] binder: BINDER_SET_CONTEXT_MGR already set [ 1551.395476] binder: 12856:12860 ioctl 40046207 0 returned -16 [ 1551.395689] binder: 12856:12860 got transaction with invalid offset (0, min 0 max 0) or object. [ 1551.395753] binder: 12856:12860 transaction failed 29201/-22, size 0-8 line 3199 [ 1551.400870] binder: 12859:12862 BC_INCREFS_DONE node 1362 has no pending increfs request [ 1551.400972] binder: 12859:12862 ioctl c0306201 0 returned -14 [ 1551.460766] binder: unexpected work type, 4, not freed [ 1551.466290] binder: undelivered TRANSACTION_COMPLETE [ 1551.472319] binder: release 12846:12847 transaction 1354 out, still active [ 1551.480931] binder: unexpected work type, 4, not freed [ 1551.486232] binder: undelivered TRANSACTION_COMPLETE [ 1551.491792] binder: undelivered TRANSACTION_ERROR: 29201 [ 1551.497523] binder: release 12859:12862 transaction 1361 out, still active [ 1551.504550] binder: unexpected work type, 4, not freed [ 1551.509870] binder: undelivered TRANSACTION_COMPLETE [ 1551.515356] binder: release 12870:12871 transaction 1364 out, still active [ 1551.522587] binder: undelivered TRANSACTION_COMPLETE 08:14:02 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/status\x00', 0x0, 0x0) request_key(0x0, &(0x7f0000000200)={'syz'}, 0x0, 0xfffffffffffffffb) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000080)=0x0) prctl$PR_SET_PTRACER(0x59616d61, r3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) write$binfmt_elf64(r1, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) recvmsg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0xf7e9}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x100) 08:14:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) fcntl$getownex(r3, 0x10, &(0x7f0000000040)={0x0, 0x0}) ptrace$peek(0x2, r5, &(0x7f00000000c0)) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(r5, 0x0, 0x10080000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="04000000000800001da334dc48823c52364348c5cd4b8e56c3a3458051a84b4a705c2e3b01557d2c314eb510e26d54"]], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffd) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000440)='./file0\x00', 0x80000, 0x44) sendmsg(r2, &(0x7f0000003880)={&(0x7f0000000480)=@in6={0xa, 0x4e23, 0xfffffffffffffe22, @rand_addr="34ff614429a1ec6ad0395ca7c74fdf08", 0x1f}, 0x80, &(0x7f0000002680)=[{&(0x7f0000000500)="340d80676762dd5d4de97758e12d586ce659289100d23321385820ce1f9fd3020d31a986e2123ff350e67fcd922d4f2cacd1a4ec16207db43b250ba3357dc0c299fa5f2db836309a9b06e6db57ed930df4299d26df4a7b3162a584af8241d753f74494b158baee9c6549481390c4ea49f452e27b9b0c8530e89578aec63d5f9445e6d8545dddfc245da798d1771424097b2c2fe89bd43c5c102f02521d8768626a751967e2ecb0dccba80bbeb7c271c18314730ea30372cf731225b06f88f20a0bffb2199abddd9747228917d27ec286e3b1dab3e94a16e6c60dd14f890a6076905c46cf64155856bb7bb56199ae9d4efb3ed96cfd2a86fa563f9f050a8dcee2051961f28371cc1e2837014f061d8721f820dc4858cd14d8f180ffad53865d7f0bbf9ad84c1f02cb4b6cd2c99b984e1cae7cff6b31f6edc1027bd8f952fc7d1aebcf1b6aa13d283379263ae303207fc3c558943c5fbb191e7fd5214c48761fb52b5883d205c80a508280c9102ec37c25743d00ce6563593f685d808245eb7aae8a99e3a04fa1522306db84e2db452934b8fd6cd79696f297327ff1109de1890feeb1a635055a6b372c7cbbe940652c5f4dc09bcf7750fd9a73b9b942d0297f65bfca216bfea5ae5a3b6c339c83388915d0b35060d8ea17b7a44814b4dd13fec116f11e1a0a1f4afa8cdb0ed6229d4289bc4f21c7d7920ed63a226dd9b8be37f9dd0146bbb6cf967c11323278969a909229617d6416325d3c9e404b7bc86b129353895331b543bcf988433ea5af6ab8019eb33d9318331e0bb1e6031ff82eea5b988699d4a0305832eba46742c98b5924e23aaf248daa32710de0f27a3af163b4d146bffb9f3d186607f62e0279a0e2060e53e983a539e942a8a34ee8af01c589561dc4e2e0a557a926e72a13af941726802f85fac1cc558d49127fba609b07c22f172b250ec7308e9e195a48fe30ef7d398bd88580818bcedcb12c3d2b17b924a4e172f38a65ec63e4bccd4a06ba7273b7a246bd7783d597f0b41bf9dae3cccefba908ad3dd40e755f3d198cc9021d7aee45d9b9ef477b5a298f2e2c5d8a00acfed5b704b4886fda7e45e0249b2a80bb0d500fe9be299e0a8e36e2a20188a49c91dc7b1822f4caa45f28571efa8bf1f6442e3c3c7ccb2a83065992c7b00fe0495ee482a1a8708ad98667479dcd967ce69a71f396fe262bae718aa971d0986e5f3d432c32965ac85ba80e2ff897c1125cd4ae8e18c8b31609e707a48189d61feec5a92c36a2a70434ae7b6cea80fe1e73055589f5d9ce665a24fee07c0f2caf03f59c992737ea00ceb483f583dadf5fcd1bc3548be027e5b063bf65a2be1de61bd5bc5edd4d8ad10e4ea5c15a01a73c2e62a4b0d857e3a555c0643e13358069fd0d9b43965ecaa6dc737596f63f031885cc68809e44306c41f4504db76e52120b2c947bdf145b7ea8d6e5786e928aea4d6d9aa52e55b123e3933887b14d1b8f3f852ebb0e8e6c84da76c2d366da8a9e754fe13d530239ac6fed74dc3531f94c07e86349475bc6c5b65e1530b564f2989c9880ab5a34b746c4fbf340005c048f59e7e02daa6595a33ce0a403400c602a97c0bba84365f397679bf48af863aa5466e628e0435c85ad9f4d25ad53ec41d8bea1033c4469c1b2b61bb29a64186a59b6fa9e2a2926310051fe8c41aa076851913da5c026d16a5b0eafa6fd2f743e933113dbbef3c8f98deda691c2de43a124f46ebf3f041636cc7ab19d8d715cc630924b2687907daf8dcb3cea77eea74da6e92d92950462b357f0eff22ff79146c6479cf78d8e6675be0a5a4f984be85dcf4b97041afb619f295a590223a4854caf8e2fe08e2f934115079f61828e6bc08f47e2ccec33916404748e91bbae49a759991e578f7b2711ae0bac0700a5384e733a4dc21d388ed720ef468d428e40659f977250855fe2a491c50adc17dc2adcc09caaf7caebd3049f3172c34704c8b1fcbc743bd3ca383098f68ff312858354a1999522655c0e8608b3f9e0ed5d63cc8a36a224a5e5b5f39a391d635068fa9551f328ee34285051df72dca8fe114275c88ed469d757819ac5031ddf9e95f1879b68dfa1f387a7df0375f44b134bb56390ea9d9af5e2ac1b6b7bf51d870e707a3a36e8d51c605fe409b2ca1d67871b56509c86c6bacdee63820b73e4750ad7f113e10af1826eb64b2522cac0f25769ce78a507f6e1678632ad78001b5d244bc27a1132dfb8e5123997d56cde74b70ed5be9ce225624afd384177ea2588fab1612c25029ff6d3ac9353a35cfabe6ef74a599fcfc9a231940d7ff7d4bffcd4182ab20c31177eda11058825fd928d64f7ba1c45cb6605595857de16f34629218f66264c9db18fd503e49f856b6c28437ecf5c89fcde6ac122d43d67c82a955250fc6823b64e7ed99cfcb7962c5e63ac6c89ef38d455989abef38ebf17dfe80a726d0d88497cac3d4a180160f7a7d7014046ee8191bfe54f0d547e509ba19eff8d8d2131eddadf5ea35fd1872e9082a079c93135d512fe43915f36083e0cc86ff06ce88d4146ed8b37497131b17114ea486b2227bdc9e54b674439ccb48c9e35f98ec3e76447faf89e53ac5f158d8db9eb7c54c638ba703695a005d4c0e4cc1c04b4beeb2f782ac5fd5528306a191d1a4178a9c91d902e5d486a9dadf2f446a6ccc795f0a4e9c503d0bd67d8faf7638121c8b8e1ecc047121b260d27868020f9248601fe12b79997be5ccc6da8aff473c8e90045a42d2db6e7b2f04c8c6b116091f10aaa4b1916f99843c383f50ab8d5b7f094db733bad617e2dc1c273443a8e882d2699309f416c9e5e2501835ee4b1bb6f2982c41c46e46de20f9154092d5a56e1df83a4f71bf4d61508783088ff02cc17c4c45692bf94523e98efea7ef87d35cabd5923093b4f9571d212b03c1e0ae5b8fabcf7199d6e26fc4d8e1050070572e3d401c8b0508d2a6bb92d17c8d75498897861815a2aa7140acea27d9d9bfd3425b23d9b551bcf1a9e52cff1286be773555144b2e945192880619b14e023f40b555ab4ba9ffee4a96e8d676de44cb075456c9de686504b357e3667f4571caf449cd9ebc1a5a65a4bb3fc7905fb372ecee322e424740197d0ffd4b79330aaa6d5f50e02e59b01d94a3a554c464ada09abeb91d973ee4baa06183a9842f1dfd10069fcc6f2f215bf660653bf5401a83148a573f1ff36f899c47d751947ad7f7417e2bcc73353f24ac90d677afd7d4dab2ab36bdc610eb83ec8137dd1a2c6da50fe353b7a12d46c5c900ad4c44d4d2a6507240392afbca4fa422331eaf299479078f2414438a457e887275d4436e852474b606565c1ae005ee1a9bb54cfb6c764e2babb663b60b9cd06e591fc33ff3d15c7655a884f9a98ac2f51a690dcb9975c545be2938b9f747d6399b2130d29cb6c5f2d7c177da0eb6628e23a41f40c1a453e392cd1e4e17fef9ee2dd4bf58211072b986312a631db3bfa5087bd5ed2173ce38dce525d4f39ffedf82f3fd0b14aec1e7ebe2c9213f84a44e8e747418df1a6d040dc35c239f11b686ef13490a6730099b84be9863a0531e6742dd93f74facdb84aa385a899ceb6f691eb1dc83c20485d182760f5610ad9fcb959f4e50fdedf9d345eb7f6770851818c9672dc5a9b92409210afb6c035ea8951cc480987dcb3922dbe3331f02942586724b448d74a02ffa17406617f89c5ca96b9b24e6342a8292be3095cdda2d674ea21ecdccfb8947ca67e11f9fbf50b0c9ed57b7a2b7d73df85bf7e918be92d1e026357cdfac47c154f17d9ad290e9a7ab028c363142f3d50342f45c7ce2d16d1e210510acb61b2cfb79aae2b0f8893fa6c855ae8917f462cded6ff67c101f6d94c2079e5caba8b9135d2803ba368617f4e94441ff4a55641783379cb91f8a1b8d150552c8d3d67ec3ddec3bb1384279a9ed6e58cac55b79d73a40d8e2c9450e4e2ed33d577a3c9b0da2fc8f9a9319eb6cb487f4e73e2f63d6c1a0cfbf63a54135106a03fc01889ca2f0dd2a541220e69bb25d964bb2b9bfb3d5803a1cc7f9cf1dd112149b2b92558051fbe6a2989edc0cd806c61c84c62e4bb69a85a53c952d23211b62f9b0f6c5c94084418151b6ae9f1bbc3b2b720b6c9b72190e565578516e16322c9a5918598e2176e3b36852c514fec56f0148a3d6f5693507d041196c2d7f55eabb55b7b9eb599f0f3c82c0fbf8d36df07d230436c8a1dd60fe5dd8e798c69b85a26a647ab87662699ff6e304780ddfc337c260ee673c85e20b020cbfb3261a16eeb600583bd90b019b7f72083f313446246d37ba0180fc2a43a03220978eacb679eb3815000854a3e69678fa16c9f4b06edb386577f2d8c1733a91e97e50a1930995f0175fc98ad20f4417e3dfb99472d3066e9c9a664d00b965d8b7d5bf0b57fd7bcc5544727de3da6fe65101fb65195447f716ffc8ac75838e0807fabeb49a88211aa7a0c1c5e09642dc50c2c26f6c60d7aaca0ba4bfebc20679df78064981e4d496149d967d8501b50e1d7e2296caaa55823b25616485e6478de937504352e3a168adfe35df5cf06c9dc2c7b8943c1ee5e85a681bef6ce959ea0f9e17913afc066ace9ea9b16d104f0e92d4e07e4e4d89986cc6a06f8b1832d8c32abd7aaf7f8f93c5efe4d75872e4b9a7c23f6c4b69d29b039b303577f47cdc90294441d10c3f9a2333bc73ad22dcefd8f8fd3d25de7e4e06026ffed0b3f6040dbc2e58515c07844bb29ff682f8095296c2b2a2a0dd6efa07aa875643e1896f9508d51c6d56a985226a76a20e48fbdf82953407d61d58e5938f854b50ad2f7e348fd538cc8390d304c9fc4847189d7964bc72a39bc8b784f179519185544b9411712cc65b7df9645dbae8cf03fdf2fd1591c59c8534ae9459fa2dc08a4d0b741bee803721e63cab029d1148172e85139ab14e265fd7a9cfb46488cb74998599c0f3d32b9dfd05aba19aec6d70cea008892b5a52bcacf772f640b7b817c288906ca9170d189755d3168e3d9412e36af7edc1f01c7bf81356893f14ecb7a99c40e727182a17a1218c765d3a3f620ac568d5639744cef4006662d5111d620afbc4789f9472ef8032f9067c74c98ed7970a7c0b8bf18023ccf5eb884872019504b905bcecd98156ddb725e0a598f1c36391aed63d1b30da8e6396b366a0f5be7b2c770131fa81b1557df5abe43931f7161994fe74959797cbf65b0792bdcb71aa86e7c55e05ad21b8ded4baf42390d96c2f73cb159f9961dc860ec407f97879d6aac2c49d1d9a0100f3e8dc6801aafa336c761753a99b79ed53aacb4996cba5268d0e4975d8ae70f24170863a7961c765e65c83534f9c65a7dfb7464ad83f77387f708f74dc3791431c009cbe3cc9dcd0960e9f3fd1b76e1990f877f2c38a5a71443f4e0543001d50c144cf0e71ed24476f18afcb5448fd897be4924ca728cbe4d506ecf4c230d55edf051c967e2da1098ea9691dd2c06928afbfb6dc0fe1c1a06a3529863b610fb782d5d06fa0f4e64eac7b4519384353e1d15256162d8d6e9ff3cae3281e277074b1a7432713c3c2ae5425643e67c9000f5b70559ab4ed37fb23c5c356d5f19f1c17b8eb0e25b5c4c44149aa67fed30c2bc0795c0148152a39013848e782e642f70ef0756606327449594006dc733af2f6a4836e27b8beca7867ec5b40103d2c5cf21d971380bf691e9b4980fd019165f5e3bac217bfcdad5b77678949bebd85c9f58a90155ed622745e01362bfa10d625ad062e5d4879c540fc749ec661c7e4192c3e19c009e", 0x1000}, {&(0x7f0000001500)="c057d74552aa9ed1535dd8a730b62ce0852fbdb59515ea92b06d0ffbd75c8c46df0514fa17f3848551fbcc4be40b6417637b076266a263c3f3dfd5aeee35cc99e2c2545f223846640b1fabd174a813725c3937f30d964d0583e9c95882852c775675227e70227d6d796b850991ecf9716e3b9e72df80bf915d7f52f298c8442773f51b4d6f9ce950790016d0fbaba7dd9fe3683e955b0c341a12ef4f30b88bbd7d76564185d74b68dc257265bc4ada0c05a81f16e349060ec4077a759bfd4d41d6660f0d7a7f922a7f9b054df0259eff650a7869a335a34da9ebef5b88939dcdf428d18e3209a0bc8c992999dc8acdd4712ae43b60b21da0e796e3ff832bd21c703c83861dbb547b3e777b09baf189c7c557b5612d61cfb5d9b6046fc3a71591a9bb63b67bef92e507151b92f34be3834fd653d7732c24448e1cdf99e8b114c501567822d9473c734b720b0d54964a108ec2168461f8455ab0fb06c9a4b81f05fd59ef7b83e52d0c4ea8b43be541d27ce625c2468bc60f6ebf42d367e4a184e3070018cb78710abb8ccb3f500eb3cfe77a0b59d25e6a1416ad80fa261f5f966f92f176ec74d378225a7c75c8261ab7c86baff738b88c2365dc0f96afa1e62f1c63498e9ca6e33ebe141eb2c9491baf8a9d0bd36f276b410db9307d61a93d69b3990c89669a65f1abe26a0071ad2b24b05183a000f3617a90c4e2fa8cc0211f61d4def118eb8f1d66d7c9126eeb2bb151e2243e8758e28a7555afb086004cda3e5fd428cf788dbf0b61fb320149995f8b093e574f8ed78feb8f086a08f51b90c496b196f4e5d686f5a774f167353cc0dc0eedbc95a11bd9ff55e873aa2e4b770a676508692fffca98b789a33680d099a434ba0e84906d77dd7a5ea48b987188b182fa20d939104c616a8c8db77348b9e75e0f637e6ddc34fd9a617a2e85db4db1a9ce6b7b0aa4cf203658526ecf33d2f3a9c9e58382c2d8fc0c24d5f84d52910e3d8e2e685a36fa9cd06218279b9b589e5802bb6e1c66759c3e66104b918d42237fb959420b11bbbb0dd000780d511a0996014b1ec1a79a0cbdd2b9312939e9a227a8c425d83eca56b53647b6d69a2d2509f4f5d461f29de26d523fad6b396d87b7f132b807ea0c0a105bfca0ac9e4b4048d83ecc041bda69f75156ba95e66653b3dbcc89592e931c84b8a14692c2ef01ee7bedf6a702776d8b8b737592085931199274da50f5971877d0f12e9bb7123c621dc735cafeb5a44fbcf866de9562435f9870897423537ff395f198d67bf5d788d5d194065e55da7e49257569870dba3ed7313cc6a94f8070a66fcec5cfebdb74c053cc7350ff7f1c3c22f627ee38d04c98446868afcf27a5c060ba391fcf773300d4ba2f6aa5b9dea4cafcc9207e609f70cd34df262202677db61efe6174bc2fd88cb7ad2027693b08f61fd8a3c0adfb0cedbff23acaf589329ae04be10154511ee07db2fba4a7654ce6e99d06b7916e98909bb8a0b1b1001f1b89c91bc30a938b605a2448f8c53a8ebca6dd1652e54cd23ed931f6c6bdd3f7c204e6b997b8d754dcbfebd3be58fe7e446267b224c4e0e094d986c4684f379ef95fa043593b55571accbcdb6becc82756f27a76f672118bec3fc28a0a179f81be42003d216c81b6e8fe61040ee3875d9de6b367408c891ecab76a8c53fc4e6fb15ab229641ca8fb6dd257a0a9a568e4509d193cda53417c2982cc3ee8b709bf73a2c7c1926d8a5a1dd5d6e08d49854a4cf82cc2d1527153da0dca7bcb0f456c5b3d448308dc6f02ef3a101424bd64e1ab3cfa4b131e8b9a54975c7c415dc28d77c552ab976a76e0907081cb37d6195e2ae732ddef3fe280873bb3ac9775097e738284f5a40f932a07ac022e3cef18106aac160b3f42c4ecce6c6be00306953b06c9f7f81fe8e797f00080cc03848f8d29eb3ecf5bbe609b79b4feb62a748e46351bfd95d72eb8d5b5f6cb24a6d6a1774c65980dcb112c881021b7c9e67c47c5c80290c6b63e4b4f57f15b9cf30168f63c53296691d5484e40412df520939c29a430a9a2682e08771572b9e2fadf87c2e443630c5a7eae1cd5bdc8eeb820755a12ec552b793c7009b2f38181e23874012651382904f205fae491f8295f81df77e22374219a592843e7e06c1f5649596be1c4c5523d46b4a03eb6e460949563d3af710be52787dfde67c8e75cfc5d9ae4839eb38a7be302bb48f82050f2dc977a19640602552240b73ab6a559657619d37a3da203554380605fe6d32430a46ccf2f690e8bc86e1b50a47c8c92493e0e8c5adf6db8a61bf5d556e33a4ac18cb6296d75cc4024addd40192cafa25d90c0752fd222b42646c649716e967cd6a7f5bc0015815b185e9c8de2346ab08f210a046ba619e2ab0310892988e7215ac7f92afa220dc01e6829240d2c15eb4d1f11e18b0ce2cd67490f9c509b362231317d81218487bc47b0d5c8e9929933db8148cc4c8d634b9e8bc75c49747e8b9981b93243268e5a9685a9edf94596070ce7de7c5d968ab4ae2378f3fa526cbf1ca4b80ac594ee296ee642217396568d05fc79b470c8ade538680408613306d013051d0e874b6046f7053d20911ed9ad9a7827e3724626d854c7761ac405327168abe27511bec0abe0c546709b6ffbf8e19485180b29b521aa54086fe701f9cdf00bcb8551ac8a04221cfb8545d8ae7121daebe110a052bc80072d647ccdd84718670f34f7b4c8c7c4b971cdf5749cd36ceeb760691621c09edd4b6bf94d156db6255c11cd629f38cb929a0189a954eaa6e954221638f2687f7f03a3d80ce24060dc6547fc88a1b9fb1f1ec4921bc0ddf8d3a8c9e7ba9252cd7438e6eaa15c80af224610cfdc541a89e9db1e4da411728c0177f5866c8d202fded4e92e263ab79aa81083ad0639f3e3b69a8d65b434669fa4679c4e28a049a71d0318df3b850fad7b578ca1c6f42722a872b7fce2b5e8088807435fc0746538fd0022b18948392f79ef0906e768c0317c0a5efa302588bbc216c439d610fef2946685267fcf8f8d45673589170edca989326f37ce5df52b8bf04f24053706e825d8447e6529a04eb855054617a2a7dec0be681b22263ebd313a89719ab71e0a451ad0b4c998cc77d9bde7ca77a2ea2eb92defe786e05eacc5b1b7f03b1a4553c067f1e4c4f415775d12c197e37817165cbf1dcf88af40d1205195191e3dc800c268903229989684ee8fa8de6915abb16a021a1a5451eba2b927b1b7e8bf001d997304a735c66b39862c7218932dac885902e116441287d6ac899c8f8fd3a03cf252ea299bd766981c268921d5e5e8fa7de6ecaa796f6091f547a31a041192b2ea05bb2c7a6d4e69c1ba4b6aee1a0bebe1eafa67489155200df64da0919c16e4a96f05b067f0412d74cddc5828ff7fe534b5da1b7d0dd58c07f9d8fd37fd4745ad9194a33d9f71fb4899789a854b2f0c264569635713c319759bc84b6deff76f55da836e4d938fea9fa64b48324598e351b6b53fafc27a61fdf2c9117f994c3e372815f0e053d16a784b03647b3f3c624f46adc9923515f0623e2361ea9ff91f44c13beaa7cfc7a7e055494ae1e5028171905e04cffc04853c4ff9bf0029b488fcd5fb6830c20811fecbf41357218b93b79bfdaefc206c558da842ab0bfcac2b8cfcdbeef88472633cf386253149cebf5ab7e506e979d03a41e50d43b428b25d3263d08e06f91e83d70617806e1e9a7c8d09535f3decfa50e1b640b8f70e4ae9bfcb1920a1ff2bfe3191a353d9847fcc7f37d5bae5cd8fe694111c05f972a79ce84c9515a18dba50e3939b9ef25f20efb7648e765925a7f9028cf9380fea832c0d48f6f3ab90423d097fa2afb32e21737ab3d4b493d54f510163e0225831382c49d6dc350f3f50c0c9327be01f5b42d571a660e44dd67e5c5ac770089b8128613b93c412f33384ce4667853a04927eb9deaddc5d10e68df9e269c6e302fff0479c4144289d9b74dd4224197162ea586db6ebbc82488e6ecec2b6bb302e9c754cfba87fc1a31297c9674f402524221209eaa9cb639d385592b5d10da562f9499128eaea0e9f80febfc9eac476595fda1d5f4d7e24dff29bd8aa88beff3f6e3b34ef92b08926a925817c53cfd4e5a397a3eca1e15d3229d5d888ce20322779c0721f6a6170914c66ac0c1d32f1ebe26c2582d5f70e85021eb09886ad9faf85110af5739008e4a88f68b34ef6e8531ad5641707af3e8400b15033561f334bc912cae37f643ca5d503c31fddbc0922d8166ce224f15a42e5cc57baa130b3dd67a1f067054a9d83bed1c7f6d362f553cb8d4ea6a4f61c26b74cf9690eb3f22afb01d393611b29f19fd02ca02eb1f9299ae341fd5281f4ea17fd71cf0c35990aae288f96cbdc9cd519f9e619c61a37706bffc492a87212f7b802fa088ab12ac41d4156ca2693733365e035e7fe1bef8b647aba2187eeb90ba3053b0ec3a9c5a00de7d6f25bb6aee7e8039aa39f9c1520cb01f3d0ed40ada992feb329beffdad092ce23a0c78fdae2a48c11cc0ef3517bf6391b2a04704aea6186a7921a61e71a9e3f9f885363fe07a385f5b7af071cbe4a019f1348d2cef5dff8701ff406edf79d0495303127513eb0ffe3e1d6aaf8b8cb969202b8394a0934bb97d43be3b67bc974feb9773992e8fd35afea55402212fd575855f57ca3c32bb7d453ef0b72e0d6f79b969d98a2ac69f455790cbd66204b6f7b876816aeff40f1d19080500a2a61c62d17da8791343ad8c6a34bec55f44c849a36f6b02973547654ae8aceb5b898cc3a5856bb66457b8648618dc5b5bc43d61f03a684a35ac05ec29faee21eef7cac17fc66af8b557f81475f28340baff87b9dc2aeddfe3d55b6c6505fcfcbb29617fd9c4faee3bf415b66026ae423fce29bb9cc6c2b2d13373742e3dab4564ac4876206141310cbe82050915691ba46f4bb9eec067842f0a37c307e75af468bfa7ff132c4d1f9781b6074c4efc8ec918e40f036128f597a138987b20109d171783eb5fc6329cb9770e0c8b5072dce99e7eef7d3b086bf9506adce3698f5f0a724084ccbe6fe614c52936b2249d85e8cb63b0fa245dc1ca35eb928ac98400930331653fbeca4bb83030410af4d8a72e241cea9510935ca7600919267d3ffcabc953cec9f809433e8441b6c271180228046e673df4f72e11d9275f0561480efb1be166a811fd076422aedfef050a80bb8d2bdaa697d5a9aa352f1515494c13ebad88811699e4bb318363ccf8d6a963f36b15ba9a50f61a69cc13b64f1b395a9403e3965e05fdf5e92f36d1f40ffc93fbbc57fa8e9f4ce1fb4d0242f133b1c31c82ecaadfaa3b55f2af43e1fd01b8ad0128ded4fde73717b8b77ce8a33c3c9997f60b1e1b7c5ec71fe07255595a55385c8ab9468ba6dae142d1e1772e217ee476dd886774a36af8d621bfc657d3db4b33ba9c41c959eb4f44044c3b3602937d0fb914b6c40c9971acda2429aff5691f8d5c6c5180c3536aef03f9ad84c9304053c573f87218b9c1dc7acb07ce7a8f612c813ee91e11b24575fa0196f5c338360f978e17c1177f11f4a12e8effd147ba03a20399dd297cdd0b734fc7d7f405bd36d7f00d585f00f8ed57b18949d40eab68a3e72be0719c8be078e8beb5a5b204fd703ebb3006075a721230a9df1b66952ec165e3d0c64033a1ef1b50cce221db8bb68dc7b0f9980239f361883584847cb2a43cb8d5cd7a1f2b4e1bb8e7ea0e73c66298a8a9f8d5630bce7ddd1f517e6c67c1b197e4de2f3ffa93549082f4afc9e4a4f0d9a7d", 0x1000}, {&(0x7f0000002500)="fd4e6ea9c973d2353b2877737ec3799f31df4b7bda2c843faeba9bf6e166972d0fa1b988a22916c85e3c81817ecf23112e5629f49c08280371147cc17b3600ce1ed10750e079629dec2b4f1338a74a3124757ae714dd989e36d060ba77e07d70aaf20c3cb835911017358783c2ed94957e043b94873d1eabd4", 0x79}, {&(0x7f0000002580)="8a775351d3bb45abcb09b33d143b2851dfbabb858f670d80689d0aa64cc72b123e9c4db00323fbb3fcda7ea195be76ca02724293", 0x34}, {&(0x7f00000025c0)="61b271a61a100280e05cddda46640bf0a65d762e", 0x14}, {&(0x7f0000002600)="1246f96933247690886c181a8601a4b254352ba88aba29f1b148f915df1deec1d22f990133f3f2f74bce858ac02704b581f9dd2d4186f317548907f989b764c9f8f68f4bed3149217e82e4e6a59a6306d672163322a4946ffe1c9765fd96cc9b0a796952e223a4de2bed4c6cc29529101d39476a41211853ac", 0x79}], 0x6, &(0x7f0000003980)=ANY=[@ANYBLOB="000100000000000010010000010100003644e967cfc1cf7573a39949e735ad4c21dbf825c890d348faecf5592cd4bdb56da66c65f0058da162a1c84d59086137c09f3aeb1936f3729969806ac12543906e94913ecf0fef9553c24adc7cd883323fe3f5285fafd2ba3b580c2e63f3ac511c9257e6803b771a773b8741f4928da6228611762d12e13b49a053782aad917a608970e6b8499b548b4f973608f809a08f2525ac02d0114016705c4ff4679248b5dc0ba41a64b720d974d28f0fa85517fd953d85eedcad3e63f38d5ee1675f78a92322ac24b2451f414507900f6f8c6761a5d6ca2bb1d0dd2f943249b826d78550fe7dbc7ea263c05626a9070000000048000000000000001401000008000000323eb0428e6a1b3b6aeb57625cdc09968fd740bb9ffa05aca3487c5adf0e5d3a04fdf7ede7215dc387668c989cb525aa083e8e000000000010100000000000001f01000005000000b963c922e41f98706b37b861b53c42131ca708ef5be4b76a8f441498bf740ba06cfc1be466faf127aefcf9ad26f8d2c1fde5a31af5d0edabd39d9f5d584b8c779052aca2fbfd75d6891091e1b60e4f94d9e632b07e2acacb7b804dbf0c547a9af65dd77ddd2f52f28e8770ae0f8ec3b7a91cd96b28aff89ca56ab64368d9e522bbfa7696a47745d2a2e2ec2c5f47af2b09ecafbf43506a3827cb6b684f8199dafa3ebe32873e71c334e61defcebdf0512c56823264c0dad4724fc83699f8939c9b90249285bfaa3ab47696565034abc55a37f4313c6c985cc15e02acec64d5934df3a138b22e46f3ddec69faddc3f403d46704cd5ffd547f671bd68bb4331b2241d4da995d5a203e15fdc38a5c42b55812e274e75b2c8ada92848b65214f2cd003caad84268a0e02987b7a58822744cd70e26fbe7eb0e229d4fb1dd4a64bc1639545e08f0f4ffcc268890b46cabe3b910432b54d6a48577e37c0d1301ba22785884c809b31e8ebf00e0cefe1514a23898a8bb199c800002a75c1c654a338ed728a645832785612ec49f687499b4e592099d571b11ee56bd85f4904733ed575c10c44365012bb7a18caa12cf5d83639e2764fca0ecabe476acdd47542157ac0c1636d6df38fb3b44267bb04a5423d12f754bc69996415ce538fcc742b94d5238772989ae7bf9a4dffbc390726cf988887d86d35e640423eb680454e0fd0a7efa6d3b2969800a9b67a57ed6cd50871b2bd86012b0143641ba4dc207f72ab6175e896c22502527767f5c5e9e6e7412ae5bba843864c7f2c36b24a14d65a66df6149ca67d056dfdb73698e6093b98acbf5c9a22428d15d6b4156a6c8f80290603bf4f5ce55996d03b8c3b5f022866c5eb5432d903bdb80e8537b3523a5ae565ceb9085a56f1794b9e15a266e6eed4c76faea582e7f4e026502e68ae954e09427c6ea7346776caf94bbf5e8f02abb828d6a4ea83ff5b57bdd87f6991761384953d02f404dcda73d1cb0d5f13e8285d0d8326add3cd895a3885059ad1dff6c7e2760cef1ca520d11aae871357cf8d37343012c742257de382ad375ca28a256a7687382c597a0bc25b206729c9d341ccdc1f91cfc55e5fb58db7e28ca202405cd9c0d4d4daa93b0c0ee9fcf1b7376cfa75726cf1f8af4616fead42953c795d24b17be33af497c397bc51f149fb40eb31d5be235b0cf352f54345bdb8564ec48eda5ee369d7dbd862c7ea956546953544446b84dd669b6b1c6f7dd4b47405643d5992fb80eda1561668feaecf7b07c27d59a2a5b72f564eec876e1b555444214380dda903038bd8f9dff276b7096301e9fd0b9cb1d2893e2b50612f3b6ba21465da912f39b28da269e67ce960388f9b2826ddc5abbf1e79561e8472596b89226bebd4abdcf366e51ecb6749a5034679abbd848faa4637b71f37d8247ba3af036a9e8040e71aa736a9ab2429e16f71d7b8ce14bead28fa56a7b6c1cd34712df4a978d825c89694974ae0d1de5e3cec56643df93620ab744f8c68f412e9b8f9f0aa5cbde9968b972b4fcbde991635aed656bd49e96a1e430bc7bb97b9f5aedc3df5b0d01b5e7476735d90aafb2c8f139f5baa0627437c97e01ea48238676d3dcfeb5ba2e4e10fb6c09282eeda2342e27976ebb54d7fc9526958d9d413500cd0ae30636e3f4c3424c44c93be06f16e9fecce02ed77cb4580a1bfade56ce336898c07fdac4ae9972c201e56ecac7e4d8418da412ed4084d6045a0ef1e203b9a8364f0f6efd62ff2b097c4f43436e9405a5df9db9a8a2eb4e8471b6ee9dfe84a415fbc281c3bb401bd02a05af726b38e5f572c41337ad4d6660ee4721a9dbb6782f66ce5d118b379f37e2872b420d12ca98af23caf8609962ffedfcff67ca03e33b448ea4ad852c5cc455a2ae0177ab9463124da6f752bcc098aadecf32b4b905b194cddf57642d41a1556f822c183d8f0a90a05529fe0bcc43c010573379d2ecf70791c8eeaf1fcb793fef89173efaeca28456dc894dd9055ddbf3fd574069ca0173ae2cee042178cea25badb2e0e90f81283ee96c94c3f872a078251765d40232eb71cf6475fa72de379aa434aa3786bddd0637279b18502388f8c3b912073a1b1726d46be9f9ddd9b436cf0cea39ca70576419d1f330f998b2d61adeed7749d8dba9dd2171de590d95b4c3b5cb7b4ce0e4d4fe863117a32825592b531cd707d2d5278dfe5516b7ac64af2ab2d4aab7cc7c1f3499cbce51d8c6a4f0566d6d87c89607b3eca3719ab7ff6a7df71cd69e51e9a8ceb8d224f6bcb29bcb0cfb52b469fd2f2a325d216e49acd6803e7519c929f4d3ac1cc18b56742a1cd9a21e22b2b2675541f2ce2d3d174897533ae6242af86764c340ce30b8b3ce99f7474f3476f2074bb95999dd8ebb9b572f6c474dc38fe851354a5cd64c0cceadeedd35409f54dc2b2e4cab28d7df560df8ec8cd4449c3e7873c97fbd2baa7d148573973486379784594cb7e665ee402fd28ad27babc791412fc5082b2edea7be19d642ce2e8eb3a3a8e30dd39f0f81b0a3fb0cc4f4fd30e6c5d800c7ac8c762d75438f902ae652a6d5e3f4fbde880167e6d06609178ba9da829bf0381971559afe3a21d20cb7f7869b84dc0e3ce5de6b848e0f151073171a7969da40701e5c15663f78df92de6db9d3d46845902ea1a80e8f2033ff02d05d1e725306fd24c1db3d4f9b86a401c82cb533480398683ec3ccfc6c17824b1467423df135f840fa84dce1de94aa56552bba66efd0a8634831ac45ee478732b29ff69829cc9248c04debfd4b9fb2f1d18aa6a4cc88ef899bd83e8f335e3eab2120ec3ea4dea2aacc4e1489b47a846467b8b7625297fb25972098db5021825f3df4604d490f27cfb841a281b6c17fcc4060e38a72ba0b18ee29e758c0af62f2862644200824387312b39c15ca7139ee700f1d5f7d3471e413340b7b7ab72b4237762ecea7ad0ee6c31c7e0da431063125e1456c95ce12cea825a6e973eb43641b11578fb4d5a6efbcf84a710558edec1cf43cea48344e05d220ca31bbc5bf76b36c3f05eb0b6eb687ccfb2a662706d5295d5c74880bb361d3ec8d12f953532120fdc5800299dc5e0c2f19396af4df1953c753e5af8bedf8ab777cf8b77de693ff23e48d8be58c5aff133da898a3b18462ddd153ba97153e1e418c611615c8a7c47da6682f23fc1aa6757a5cb2e511a5006212ba6ce1f6ea421f88fbadde72ebc82bf886930b4bc9be8f68e80fc61389abf64ef92bd8cac226e7aeeacf7a51681e76ab3f61bfc6dac5dd071c985f033f1eb472ef49e0048f810aa028e90f0e7767e3d99c1ca8dfeef898a7a2b001efc3c690c2e5b40c9b4e1595a650884ff9987254a64e97c3adba8dc2fce9b7a279f607c3f5646254e5289f60f35736f9561ed2e2cd3cb1f5c1c533476359c1e5ac121c88503401ca936f1d6d9c61337db3afb0acf94daca27d09fcd226aee4060b4ba7bc81a18e3f7fbbca91bd294e7b68f633cc312e261faa490d11b7f4d84a5c544dd2f74cd21b142d020da25edb98a581e2804f2559b7bbd71a5c9028e7ba1691d379b1ee6cc88b3bdd7271e7733530250c43a004f06522f06f1e0167905835c7178391e8563c6f93fa6bd4562f96f9c628a18f77c5be208b1011e4fa89816b22f2c51a77c8504962b3036c3a7bd60b245f0af316ceeb8ad1dd969454a26d7376301f462c3317cd770f9173f8c333602cb726de0cf4dbdb5490b8175d11081c3af855df1908a3dc9be3741abc991a94001d4be4fe889bc8f8dc3b75bec970e8c72def414a7123d9d4f93ec3dd11ed28e3884b56f7e20fb0568c9b7a419339aed890f6188e1bbf70262ea2bb9a9a276b265cfe4b3676352e3bb41502c2823b6785eb6f12f26275247c69d74273ba98c00fc08dd7e35840d19bfafe380885e16ecfdf3ff5d8310d188fc4a76e8a7b3bdc368e98fab3884927986af7acdcdc534e83ed60294f90dd5dcd68eb16b9e476ec34ebfb101dcee2976ea638136cf9e01b5ca3faf4490edbfd3fcc9c73fa0f52282fa0e3e12864992e4a9bc56befd72d601e1f8d7c0c8772c55ff8c4d5ccf16692423315593ca128a5da377ee18c06777983bed7bc0c2305200ae5bf9e023c3fa2e6d763703bb0a39440d8cf7ea178ea91b31c9c5ab3b58f3b2dde8d2b4a037d635fcdd7e750ab068c5df35011d26da1e074df00b0ef744a310a037e5dc5ec33ec03908cd2202d3744b052c879fde82b8c723d141e72ea5163ae8a5b5ecd9ba76d39bcd95a3a67b9ab696f243a57c4cc31045966aadd9710c1d8adebb0ee09975f6b8538911e7bd88ca27aaf161461eb565291868683f3103989f20704f2292720fb57444a81501f8e4f6e3a276ade1fe0ef0340ca3907e247e338e210997c4897ee059f62feddf31f4e01cab3179b5dc45bb526e3fca951889a13260048624915d4534fb2894f2776b5c41ab545eaf2cd229a69dc70bf3311fc17a612dcf7dbcea91ab89de5adb27de5c9054aae14203a2c6843856300cb1b5c91213131a5e4240d8a28c1b9bda8a60a18695e08e06e7507f70091f8bc97d106cd414e176ff233c075c0c82063e199a4a73f2d6815525726e6dfd2ee7d0390fe0badc6ca760c504c542e635d7202e8268dd1143bbecf50ec4953543b08116636a9a5a0872aa8031c8c49f9339588aa42f281493328ed07a4e75d423c8a84d8f3a5341121149367a761ebd545b71c85f07afcade2823e47b0be2042b8082ceaa336bfc935f10899f1c593b7904121939a87c44f8bc7dfc6a0230a7d0b97b4511cd0736e423dd2cc505b1a5977bf09e73f96915c7294a30410e43abe6a400e25f127a1d3a0e97877069321e71d3101abb298869dc86bcf50dfdfae15b8150a47c88a361541dfa2fc8bc0c645174a871b497e917325fd2e15b621fc11095f0603439a0634482c83089fceee354f6f72d9051b267df04015cc6a3f564dce98dd64587b644c506e355d3ce584e10e2d3e61a6dcfe20e968617be8776e0b4d281cd2d0dc4703b505c2e785c9cbfafd2e79749d57b86c70340e90f54b8eb705f76d9e1b66d476fc8943a370be7e5af80b2245232e6f7687698077553e595844b970dae9bd70448fc204996f9834e6ecd10c1dedde607565a67c91fa30ee9c710915ffeb7b5d7226ec0132a1e79b88b8738bd3f887a2f720d7556191e91ac9744600712eba62165c78c61c155083cd2cf718e92de89260097d36722324c078c8e641ba8cc63d11f1aff263c0a5abb3b289c1f0489201acf94d67ec34f235fef0fe5674dee0740fe2d170618d1c7785c929dd2245745274da57934d908370a239cdb9833420413c94736ef8961163603c245212e411513344a966867e111949fa03eb1b26423032f52f684c52abe6dfe9428a67de4a4e0376c16c103f2d83a1427272041698d77d7eee8a733d755ca8643dc2777bb736bf7f476e1aa4c9700b8611d580deeaf434a132007493164742cb4ba9a598e7d4375bc0586a1c9419d52d6784d236256058f6efc7ab0e4b1c1924d9f2b9fe520e32810408b5196d4b66cad5a32d9fd1ce10830b7aeac60b6783a57d8271d532d5b7e6d7e807d77573fe988eca7eeb175ba235147c03403d00a7142d59698d7af84bcde8d0ac797342ef87847153d6933ffbe04752c9c9c0d52f71c5014f4c18afeb9dea5b4f7863ccd321c07b96ae649c8d8583786602f967ed7afce8a9ccefa1a16522edee2dfa0cc0020b7431f192260a484ff12e10b5265a289c0077dcec87477d7d4bb1cae31e0cdc18584189db5c57627cc4b0aa4661cccd20000000000000009d01000018be24c92cb7d20404575cac00000000001c93272b67aa0c71e40b337e7b9b8a09053903aa7a2380d2373196b19e637e8c6574a8400ebcadab14298a103ce4dfaa8cc79dd767291f2b51be4a3b39484fbe476a4db446d41594791d56efed72ae9791841fe68df59d741c8caef2c5ceeb877b67de76139ce191bab16bb5befdf3e1dbb90bf4483e95fde91890278dfecd50cb67bb8c601c212c703b8362e2811eac20d0aad7571b43f7d6e53c6fff49cb5739ee6829853bfe87fa2e713b8cee3d090549aebee32bd7ae510fc565d794549696c232ca0e6e14bceee9003c3e771c0f6e2e71eb6f"], 0x1178}, 0x20000001) r3 = openat$pfkey(0xffffffffffffff9c, 0x0, 0xfffffffffffffffe, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = accept(r3, &(0x7f0000000000)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000080)=0x80) setsockopt$inet6_tcp_buf(r5, 0x6, 0x3f, &(0x7f00000000c0)="d62820fdcb645d5f5eb82728e61c1870bc72cfc601616fbba9315c93df5551faf4fa76631d23fda9a97299a2a469a91532ee26e83adc3033b5eccfc7f166b1fb93331635fba52f279fd841b0bb1e2f972a337aa9cd79ae49ab6ecdc2aa13db810f2af17985694fcabe224ac5b52708b6c4ea14d760eb010303bf99dd3202e2ede53a1a666c1f32221d635935dfe8bfd5511d238b7e403a4d2046bb3ab30b9f51cbf7363a315ab5c440a491bdd405459ed6f3ee6a2c7febd523b886fe4238159b0e214977cc6a74eae43679061dbf97fad06c8be6ed48a5f6ea5625b6106d10e996ee10361171bdf4fd470df8f002abe86cf92177d3c80022c6a750", 0xfb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f00000003c0)=[@timestamp, @sack_perm, @window={0x3, 0x5, 0x200}, @sack_perm, @mss={0x2, 0x3}, @mss={0x2, 0x8}, @sack_perm, @timestamp, @mss={0x2, 0x2}], 0x9) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x3c2, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r6 = gettid() ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r6, 0x53c73d5, &(0x7f0000000380)=""/1) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1f, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="00634040000000000000000000000000080000060020000000000000000000"], 0x0, 0x0, 0x0}) 08:14:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x4000, 0x0) getsockopt$inet_int(r2, 0x0, 0x3f, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r3 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$KDSETLED(r2, 0x4b32, 0x3) write$FUSE_WRITE(r3, &(0x7f0000000000)={0x18, 0xfffffffffffffffe, 0x3, {0x9}}, 0x18) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = request_key(&(0x7f0000000380)='encrypted\x00', &(0x7f00000003c0)={'syz', 0x3}, &(0x7f0000000400)='-\'mime_typeppp1,nodev\x00', 0xfffffffffffffff8) request_key(&(0x7f0000000100)='dns_resolver\x00', &(0x7f0000000140)={'syz', 0x0}, &(0x7f0000000180)=',}*posix_acl_access(vmnet1!:\x00', r5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="003ddcb6", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$SNDRV_TIMER_IOCTL_GINFO(r2, 0xc0f85403, &(0x7f0000000000)={{0x2, 0x1, 0x3ff, 0x2, 0xd1fe}, 0x3412, 0x1, 'id1\x00', 'timer0\x00', 0x0, 0xc9, 0x3, 0x200, 0x7}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1551.909803] binder: 12874:12879 got transaction with invalid offset (8796093022212, min 0 max 0) or object. [ 1551.915843] binder: 12876:12881 ioctl c0306201 0 returned -14 [ 1551.941198] binder: 12877:12882 transaction failed 29189/-22, size 24-8 line 3014 [ 1551.960710] binder: 12875:12883 BC_INCREFS_DONE node 1368 has no pending increfs request [ 1551.961089] binder: 12875:12888 ioctl c0306201 0 returned -14 [ 1551.980431] binder: 12874:12879 transaction failed 29201/-22, size 0-8 line 3199 [ 1551.983205] binder: 12890:12893 unknown command -1227080448 [ 1551.983214] binder: 12890:12893 ioctl c0306201 200002c0 returned -22 [ 1551.983388] binder: 12890:12893 ioctl c0306201 0 returned -14 08:14:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x27, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="006340400000000000000000000000000800000600200000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 08:14:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000180000000000000008000000af238d0f", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="009beace329d1c3100000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1551.989096] binder: release 12890:12893 transaction 1370 out, still active [ 1551.989101] binder: unexpected work type, 4, not freed [ 1551.989104] binder: undelivered TRANSACTION_COMPLETE [ 1551.991210] binder: release 12887:12889 transaction 1373 out, still active [ 1551.991214] binder: undelivered TRANSACTION_COMPLETE [ 1552.037668] binder: 12877:12882 ioctl c0306201 0 returned -14 08:14:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x27, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="006340400000000000000000000000000800000600200000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 08:14:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="805d11bf00000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="10631240", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1552.052951] binder: 12899:12900 transaction failed 29189/-22, size 24-1120591116811370504 line 3014 [ 1552.056612] binder: undelivered TRANSACTION_ERROR: 29189 [ 1552.067503] binder: release 12901:12902 transaction 1375 out, still active [ 1552.067507] binder: undelivered TRANSACTION_COMPLETE [ 1552.104164] binder: undelivered TRANSACTION_ERROR: 29201 [ 1552.118771] binder: 12899:12904 BC_INCREFS_DONE u0000000000000000 no match [ 1552.126719] binder: 12899:12909 ioctl c0306201 0 returned -14 [ 1552.139014] binder: 12906:12910 BC_INCREFS_DONE u0000000000000000 node 1377 cookie mismatch 0000000000000000 != 00000000bf115d80 [ 1552.141509] binder: 12906:12912 ioctl c0306201 0 returned -14 [ 1552.154276] binder: release 12908:12913 transaction 1379 out, still active [ 1552.154281] binder: undelivered TRANSACTION_COMPLETE [ 1552.180874] binder: 12903:12911 got transaction with invalid data ptr [ 1552.190119] binder: 12903:12911 transaction failed 29201/-14, size 24-8 line 3155 [ 1552.199023] binder: release 12906:12910 transaction 1376 out, still active [ 1552.206066] binder: unexpected work type, 4, not freed [ 1552.207023] binder: 12903:12911 ioctl c0306201 0 returned -14 [ 1552.217574] binder: undelivered TRANSACTION_COMPLETE [ 1552.230184] binder: undelivered TRANSACTION_ERROR: 29189 08:14:03 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x200000, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000340)={0x2}, 0x4) r1 = socket$inet(0x2, 0x4000000000000001, 0x4) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/status\x00', 0x0, 0x0) request_key(0x0, &(0x7f0000000200)={'syz'}, 0x0, 0xfffffffffffffffb) ioctl$SNDRV_TIMER_IOCTL_STATUS(r2, 0x80605414, &(0x7f0000000080)=""/116) timerfd_settime(r2, 0x1, &(0x7f00000001c0), &(0x7f0000000240)) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) write$binfmt_elf64(r1, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0x6) recvmsg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0xf7e9}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x100) 08:14:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x4000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x27, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="006340400000000000000000000000000800000600200000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 08:14:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="10631240", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:03 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000000), &(0x7f0000000040)=0x30) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1552.756172] binder: 12922:12926 BC_INCREFS_DONE node 1382 has no pending increfs request [ 1552.762870] binder: 12922:12930 ioctl c0306201 0 returned -14 [ 1552.775335] binder: 12920:12928 got transaction with invalid data ptr [ 1552.781409] binder: 12921:12929 got transaction with invalid offset (0, min 0 max 0) or object. [ 1552.781895] binder: 12924:12927 BC_INCREFS_DONE node 1385 has no pending increfs request [ 1552.781993] binder: 12924:12927 ioctl c0306201 0 returned -14 08:14:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000200)) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xe17e) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x0, 0x0) prctl$PR_SET_DUMPABLE(0x4, 0x1) write$P9_ROPEN(r2, &(0x7f0000000040)={0x18, 0x71, 0x2, {{0x3, 0x2}, 0x7f00000000000000}}, 0x18) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 08:14:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000000)=0x6) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$TIOCLINUX4(r2, 0x541c, &(0x7f0000000040)) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1552.782095] binder: 12921:12929 transaction failed 29201/-22, size 0-8 line 3199 [ 1552.799091] binder: undelivered TRANSACTION_ERROR: 29201 [ 1552.819230] binder: release 12924:12927 transaction 1384 out, still active [ 1552.833560] binder: 12920:12928 transaction failed 29201/-14, size 24-8 line 3155 [ 1552.842648] binder: unexpected work type, 4, not freed 08:14:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="d86aeeff", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) mlock2(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="00075c7db40400000000000000e400000000"]], 0x0, 0x0, &(0x7f00000003c0)}) [ 1552.854330] binder: 12920:12938 unknown command 1074946832 [ 1552.856578] binder: undelivered TRANSACTION_COMPLETE [ 1552.868537] binder: release 12922:12926 transaction 1381 out, still active [ 1552.881156] binder: 12944:12946 BC_INCREFS_DONE node 1390 has no pending increfs request 08:14:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="10631240", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1552.904759] binder: unexpected work type, 4, not freed [ 1552.908356] binder: 12920:12938 ioctl c0306201 200002c0 returned -22 [ 1552.925534] binder: 12944:12947 ioctl c0306201 0 returned -14 [ 1552.940284] binder: undelivered TRANSACTION_COMPLETE 08:14:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup3(r0, 0xffffffffffffff9c, 0x80000) ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f0000000080)) ioctl(r0, 0x8, &(0x7f0000000140)="1421a1b991931a870328044a5db2e1a4ad8ce2a073a1f4") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000000000000000093e144526914f214fc8f944c458021b74eeed7b79d48a1eb5bcbfeb40c86b8909eff0441699715478bcbc5b69aeac0d9fe47e30ee3af39fa1fe0f8bfcd9340b86dd0320b1255b3b08f0113876c8b444d1148da1532a48242fc50185ed2d263997499"]], 0x0, 0x0, &(0x7f00000003c0)}) [ 1552.962488] binder: 12954:12956 got transaction with invalid data ptr [ 1552.962909] binder: 12951:12953 unknown command -1152296 [ 1552.962918] binder: 12951:12953 ioctl c0306201 200002c0 returned -22 [ 1552.963041] binder: 12951:12953 ioctl c0306201 0 returned -14 [ 1552.968127] binder: BINDER_SET_CONTEXT_MGR already set [ 1552.968136] binder: 12955:12957 ioctl 40046207 0 returned -16 [ 1552.968346] binder: 12955:12957 got transaction with invalid offset (5173243807488, min 0 max 0) or object. 08:14:04 executing program 5: r0 = socket$inet(0x2, 0x2, 0x40) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'irlan0\x00', 0x8900}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/status\x00', 0x0, 0x0) recvmmsg(r3, &(0x7f0000003a00)=[{{0x0, 0x0, &(0x7f0000002940)=[{&(0x7f0000000340)=""/76, 0x4c}, {&(0x7f0000001400)=""/178, 0xb2}, {&(0x7f00000014c0)=""/157, 0x9d}, {&(0x7f0000001600)=""/190, 0xbe}, {&(0x7f00000016c0)=""/77, 0x4d}, {&(0x7f0000001740)=""/147, 0x93}, {&(0x7f0000001800)=""/4096, 0x1000}, {&(0x7f0000002800)=""/163, 0xa3}, {&(0x7f00000028c0)=""/84, 0x54}], 0x9, &(0x7f0000002a00)=""/4096, 0x1000}, 0x6}, {{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000001c0)=""/18, 0x12}, {&(0x7f0000000240)=""/63, 0x3f}], 0x2}, 0x563df9b4}], 0x2, 0x40012060, &(0x7f00000003c0)={0x0, 0x1c9c380}) request_key(0x0, &(0x7f0000000200)={'syz'}, 0x0, 0xfffffffffffffffb) r4 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r4) bind$inet(r2, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$inet6_icmp_ICMP_FILTER(r3, 0x1, 0x1, &(0x7f00000000c0)={0x5}, 0x4) write$binfmt_elf64(r2, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) recvmsg(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0xf7e9}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x100) 08:14:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fsetxattr$security_capability(r0, &(0x7f0000000000)='security.capability\x00', &(0x7f0000000040)=@v1={0x1000000, [{0x5, 0x81}]}, 0xc, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="000083b0895781b167363ed25de17a45d14b9c6352fc15327b3d7508703fc9a92a67c931806fb37fdb6ef215041252eed414cd88ae7ff95dcd583224cb8e2ff2fb0a22164b53cc5bfe602244e9ebdaf0b76b5bddb294391837896e66c0e3ab387037384e7972d17079b274c943e3ec543788c5017d6d4f0dffd33cb94e90bfe9c05f2f5f77281212650dbf71aff7b3d7197664f8224c335d7c564d37a4f384b9daba1b938117ccc020efaf28ccc72a0bc10d2ed297ef6ee7cdaabf10ce52f5d774f8b8ab34d33bee838abb83c58c5a2bfd5db0f05ddc0a75cac60d8c602ad6afd8a27f6d5cdfd7e787a6976307859a240dec31def8bf2943fc5ef82705bceb47"]], 0x0, 0x0, &(0x7f00000003c0)}) [ 1552.968419] binder: 12955:12957 transaction failed 29201/-22, size 0-8 line 3199 [ 1553.001311] binder: 12959:12960 ioctl 8 20000140 returned -22 [ 1553.003321] binder: 12959:12960 got transaction with invalid offset (0, min 0 max 0) or object. [ 1553.003538] binder: 12959:12960 transaction failed 29201/-22, size 0-8 line 3199 [ 1553.024571] binder: 12954:12962 unknown command 1074946832 [ 1553.024582] binder: 12954:12962 ioctl c0306201 200002c0 returned -22 [ 1553.024920] binder: 12954:12962 ioctl c0306201 0 returned -14 [ 1553.058993] binder: undelivered TRANSACTION_ERROR: 29201 [ 1553.064819] binder: undelivered TRANSACTION_ERROR: 29201 [ 1553.078195] binder: 12968:12969 got transaction with invalid offset (-5656143408117121024, min 0 max 0) or object. [ 1553.089008] binder: release 12951:12953 transaction 1392 out, still active [ 1553.096065] binder: unexpected work type, 4, not freed [ 1553.104836] binder: 12968:12969 transaction failed 29201/-22, size 0-8 line 3199 [ 1553.119398] binder: undelivered TRANSACTION_COMPLETE 08:14:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x2b, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="00634040000000000000000000000000080000060020000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 08:14:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$net_dm(&(0x7f0000000440)='NET_DM\x00') r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x1f, 0x1b, 0x8, 0x14, "20edd540087fe1d97ee3458c6d08c79d2e068bc6d83c4ef520679f94d12d808695c94a034c398e507796f92dcc935696bc63ec476543432755ed0d8c29bfd8b6", "0ab877eec2fdb1623dd9f476ae4b78eb62f19b9ef93ce826fe258639b2011ec5", [0x1]}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0xfffffffffffffc71, 0x0, &(0x7f0000000280), 0xfffffffffffffcdc, 0x0, 0x0}) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000180)=0x0) sched_getattr(r5, &(0x7f0000000280), 0x30, 0x0) ioctl$EVIOCSFF(r4, 0x40304580, &(0x7f00000002c0)={0x53, 0x3, 0x8, {0x9, 0x3}, {0x80000001, 0x5}, @ramp={0x10000, 0x3, {0x3, 0x0, 0x1, 0x8001}}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() ioctl$PIO_UNIMAP(r2, 0x4b67, &(0x7f0000000080)={0x8, &(0x7f0000000040)=[{0x8, 0xfd7}, {0xfa, 0x40}, {0xffffffff80000000, 0x5}, {0x8a, 0x437}, {0xf77, 0xff}, {0x7, 0x20}, {0xfd9, 0x7ff}, {0x20, 0xefb}]}) r6 = dup2(0xffffffffffffffff, r4) ioctl$LOOP_SET_STATUS(r6, 0x4c02, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0xa, 0x18, 0x10, "d9dfae587c8a5e6bd038244d0b5173c1e83f1dfa7a936886dd3d5029769617dac7985ee7891d98ecf16df90c5681e972a728763f588ce018dbce31379343a6f3", "d4d71625f1fa45efbcb4b2f8e360605c1d1e42e0de82f1c9169aa23ac4a9034c", [0x401, 0x101]}) 08:14:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r2, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20010000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x9c, r4, 0x0, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfffffffffffffffc}]}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x7}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xd20}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x81}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x60e}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5538448a}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x800}, 0x40050) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xfff) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 1553.147420] binder: undelivered TRANSACTION_ERROR: 29201 [ 1553.153397] binder: release 12944:12946 transaction 1389 out, still active [ 1553.164685] binder: unexpected work type, 4, not freed [ 1553.171252] binder: undelivered TRANSACTION_COMPLETE [ 1553.176638] binder: release 12923:12976 transaction 1399 out, still active [ 1553.186110] binder: undelivered TRANSACTION_COMPLETE 08:14:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0}, &(0x7f00000000c0)=0xc) r4 = getegid() fchown(r0, r3, r4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) fsync(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) fchmodat(r5, &(0x7f0000000040)='./file0\x00', 0x40) [ 1553.198909] binder: 12978:12979 BC_INCREFS_DONE node 1401 has no pending increfs request [ 1553.202238] binder: 12980:12982 got transaction with invalid offset (0, min 0 max 0) or object. [ 1553.204341] binder: 12980:12982 transaction failed 29201/-22, size 0-8 line 3199 [ 1553.207508] binder: 12980:12985 got transaction with invalid offset (0, min 0 max 0) or object. [ 1553.208330] binder: 12980:12985 transaction failed 29201/-22, size 0-8 line 3199 [ 1553.240939] binder: 12978:12984 ioctl c0306201 0 returned -14 08:14:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) r4 = gettid() setpgid(r3, r4) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 1553.246491] binder: 12986:12987 got transaction with invalid offset (0, min 0 max 0) or object. [ 1553.246558] binder: 12986:12987 transaction failed 29201/-22, size 0-8 line 3199 [ 1553.264476] binder: 12954:12956 transaction failed 29201/-14, size 24-8 line 3155 [ 1553.264970] binder: undelivered TRANSACTION_ERROR: 29201 [ 1553.265064] binder: undelivered TRANSACTION_ERROR: 29201 [ 1553.265146] binder: undelivered TRANSACTION_ERROR: 29201 [ 1553.266590] binder: 12977:12988 ioctl 4c02 20000380 returned -22 08:14:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="853a62f2287997cc0e84ed8d847b9fd7302264d3d10b9bf6b53a73197aa8611a0634655b030000000000000053ba", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="f8ffffffffffffff"]], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="10631240", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) [ 1553.292482] binder: release 12977:12988 transaction 1406 out, still active [ 1553.292488] binder: unexpected work type, 4, not freed [ 1553.292491] binder: undelivered TRANSACTION_COMPLETE [ 1553.347951] binder: release 12978:12979 transaction 1400 out, still active [ 1553.355574] binder: unexpected work type, 4, not freed [ 1553.355651] binder: 12994:12996 got transaction with invalid offset (0, min 0 max 0) or object. [ 1553.355716] binder: 12994:12996 transaction failed 29201/-22, size 0-8 line 3199 [ 1553.368539] binder: 12995:12997 got transaction with invalid offset (-8, min 0 max 24) or object. [ 1553.368681] binder: 12995:12997 transaction failed 29201/-22, size 24-8 line 3199 08:14:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) getsockopt$inet_int(r2, 0x0, 0x32, &(0x7f0000000000), &(0x7f0000000040)=0x4) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000000)={0x99a, 0x8000, 0x4, 0x7, 0x2, [{0x35, 0x92, 0x7, 0x0, 0x0, 0x2}, {0x6ac39dfe, 0x10000, 0x2, 0x0, 0x0, 0x1800}]}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 1553.370756] binder: 12995:12997 ioctl c0306201 0 returned -14 [ 1553.413273] binder: undelivered TRANSACTION_COMPLETE [ 1553.418623] binder: undelivered TRANSACTION_ERROR: 29201 [ 1553.424120] binder: undelivered TRANSACTION_ERROR: 29201 [ 1553.457855] binder: 13001:13005 BC_INCREFS_DONE node 1412 has no pending increfs request [ 1553.468053] binder: 13003:13006 got transaction with invalid data ptr [ 1553.475623] binder: 13001:13007 ioctl c0306201 0 returned -14 [ 1553.482730] binder: 13003:13006 transaction failed 29201/-14, size 24-8 line 3155 [ 1553.483127] binder: 13004:13008 got transaction with invalid offset (0, min 0 max 0) or object. [ 1553.483188] binder: 13004:13008 transaction failed 29201/-22, size 0-8 line 3199 [ 1553.506854] binder: undelivered TRANSACTION_ERROR: 29201 [ 1553.525700] binder: release 13001:13005 transaction 1411 out, still active [ 1553.533967] binder: unexpected work type, 4, not freed [ 1553.539896] binder: 13003:13009 unknown command 1074946832 [ 1553.553681] binder: 13003:13006 ioctl c0306201 0 returned -14 [ 1553.554602] binder: 13003:13009 ioctl c0306201 200002c0 returned -22 [ 1553.568661] binder: undelivered TRANSACTION_COMPLETE [ 1553.612303] binder: release 13013:13014 transaction 1416 out, still active [ 1553.625432] binder: undelivered TRANSACTION_COMPLETE 08:14:05 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000240)) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/status\x00', 0x0, 0x0) request_key(0x0, &(0x7f0000000200)={'syz'}, 0x0, 0xfffffffffffffffb) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) write$binfmt_elf64(r1, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, &(0x7f00000000c0), &(0x7f00000001c0)=0xc) recvmsg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0xf7e9}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x100) 08:14:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x800, 0x0) ioctl$RTC_AIE_ON(r2, 0x7001) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x2000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) accept4$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, &(0x7f0000000080)=0x1c, 0x80000) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() fcntl$getown(r3, 0x9) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) sched_setscheduler(r5, 0x7, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="10631240", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) 08:14:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x2b, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="00634040000000000000000000000000080000060020000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 1553.976948] binder: 13020:13022 got transaction with invalid offset (0, min 0 max 0) or object. [ 1553.990067] binder: 13025:13028 got transaction with invalid data ptr [ 1554.000815] binder: 13020:13022 transaction failed 29201/-22, size 0-8 line 3199 [ 1554.008948] binder: 13021:13030 BC_INCREFS_DONE node 1420 has no pending increfs request [ 1554.012296] binder: 13019:13029 BC_INCREFS_DONE node 1423 has no pending increfs request 08:14:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x2b, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="00634040000000000000000000000000080000060020000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 1554.012876] binder: 13019:13029 ioctl c0306201 0 returned -14 [ 1554.021673] binder: release 13019:13029 transaction 1422 out, still active [ 1554.021706] binder: unexpected work type, 4, not freed [ 1554.021709] binder: undelivered TRANSACTION_COMPLETE [ 1554.031614] binder: release 13032:13033 transaction 1425 out, still active [ 1554.031620] binder: undelivered TRANSACTION_COMPLETE [ 1554.044484] binder: 13025:13034 unknown command 1074946832 [ 1554.044495] binder: 13025:13034 ioctl c0306201 200002c0 returned -22 08:14:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="10631240", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() 08:14:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/status\x00', 0x0, 0x0) ioctl$UI_SET_PROPBIT(r2, 0x4004556e, 0xb) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x100000, 0x10, r1, 0x400000000000000) r3 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000040)='security.selinux\x00', 0x0, 0xfffffffffffffcb3, 0x1) socketpair$unix(0x1, 0x80005, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r3, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = getpgrp(0xffffffffffffffff) sched_setscheduler(r5, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) rt_sigpending(&(0x7f0000000000), 0x8) syz_open_dev$rtc(&(0x7f00000003c0)='/dev/rtc#\x00', 0x3, 0x101400) getsockopt$inet_udp_int(r3, 0x11, 0x65, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) accept4$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14, 0x800) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000380)={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, r6}, 0xc) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:05 executing program 3: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000040)={0x0, {0x2, 0x4e23, @broadcast}, {0x2, 0x4e20, @multicast1}, {0x2, 0x4e24, @remote}, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x4, 0x4868}) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$FICLONE(r2, 0x40049409, r1) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) open(&(0x7f0000000000)='./file0\x00', 0x10040, 0xc0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400204) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000a600000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1554.044608] binder: 13025:13034 ioctl c0306201 0 returned -14 [ 1554.048563] binder: 13021:13027 ioctl c0306201 0 returned -14 [ 1554.088602] binder: 13025:13028 transaction failed 29201/-14, size 24-8 line 3155 08:14:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x2d, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="006340400000000000000000000000000800000600200000000000000000000000000000000000000000000008"], 0x0, 0x0, 0x0}) [ 1554.161774] binder: 13042:13046 got transaction with invalid data ptr [ 1554.164850] binder: 13041:13043 BC_INCREFS_DONE node 1427 has no pending increfs request [ 1554.164958] binder: 13041:13043 ioctl c0306201 0 returned -14 [ 1554.165632] binder: 13041:13043 ioctl 40049409 4 returned -22 [ 1554.174844] binder: release 13021:13027 transaction 1419 out, still active [ 1554.174850] binder: unexpected work type, 4, not freed [ 1554.174853] binder: undelivered TRANSACTION_COMPLETE [ 1554.175025] binder: undelivered TRANSACTION_ERROR: 29201 [ 1554.193937] binder: release 13051:13052 transaction 1430 out, still active [ 1554.193942] binder: undelivered TRANSACTION_COMPLETE [ 1554.231217] binder: 13042:13056 unknown command 1074946832 [ 1554.238076] binder: 13042:13056 ioctl c0306201 200002c0 returned -22 [ 1554.246571] binder: 13045:13059 got transaction with invalid offset (0, min 0 max 0) or object. [ 1554.250686] binder: 13044:13047 BC_INCREFS_DONE node 1433 has no pending increfs request [ 1554.263888] binder: release 13041:13043 transaction 1426 out, still active [ 1554.280125] binder: unexpected work type, 4, not freed [ 1554.300466] binder: undelivered TRANSACTION_COMPLETE [ 1554.312784] binder: release 13044:13047 transaction 1432 out, still active [ 1554.320931] binder: 13045:13059 transaction failed 29201/-22, size 0-8 line 3199 [ 1554.331006] binder: unexpected work type, 4, not freed [ 1554.336959] binder: undelivered TRANSACTION_COMPLETE [ 1554.349260] binder: undelivered TRANSACTION_ERROR: 29201 [ 1554.364494] binder: 13055:13064 got transaction with invalid offsets ptr [ 1554.368704] binder: 13042:13046 transaction failed 29201/-14, size 24-8 line 3155 [ 1554.380478] binder: 13055:13064 transaction failed 29201/-14, size 0-8 line 3164 [ 1554.400611] binder: undelivered TRANSACTION_ERROR: 29201 08:14:05 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000080)) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/status\x00', 0x0, 0x0) request_key(0x0, &(0x7f0000000200)={'syz'}, 0x0, 0xfffffffffffffffb) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) write$binfmt_elf64(r1, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) recvmsg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0xf7e9}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x100) 08:14:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x5) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x100, 0x0) ioctl$SIOCGSTAMP(r2, 0x8906, &(0x7f0000000080)) r3 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x38, r4, 0x308, 0x70bd28, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x8}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x4800) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x802) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x490000, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000040)=0x0) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/attr/current\x00', 0x2, 0x0) getpgid(r3) ioctl$UI_DEV_CREATE(r2, 0x5501) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$TUNSETVNETHDRSZ(r2, 0x400454d8, &(0x7f0000000000)=0x200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)={0x0}) r5 = mmap$binder(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x0, 0x10, r2, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000014c0)={0xa0, 0x0, &(0x7f0000000400)=[@register_looper, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x38, 0x8, &(0x7f0000000080)=[@flat={0x73622a85, 0x1, r4, 0x4}, @fda={0x66646185, 0xa, 0x3, 0x10}], &(0x7f00000000c0)=[0x30]}, 0x4e8}}, @reply={0x40406301, {0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x60, 0x8, &(0x7f0000000380)=[@fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0x1, &(0x7f0000000100), 0x1, 0x3, 0x21}, @fda={0x66646185, 0x7, 0x0, 0x20}], &(0x7f0000000180)=[0x28]}}, @free_buffer={0x40086303, r5}], 0x1000, 0x0, &(0x7f00000004c0)="86aa0013db75f25b66a29a6bb0aee708e5c32d7565ea172de1b0a82c54b17fdad0f58ee20a8d23a325eeaf6ed1799f37fa7dcb31133bf2dcf4550c186fe98e0f0dbe6a33f4814866df7950a21d16c8d98a5364de840f82ef3da4ec85ff72bd7263b8760f2d8e387b86c2d41b2d3cfb846faaa61b3aad551b46f93d1845a2638ede6212c4f99038b690f6dbd3911d35b0e9f847fd12c467e9a8dc904a0d8d93edfa9fb8d16697b2e4ba9506d44e88179f928eb527898a0d105d5d1f0779481d0f1c4b0c856074c0761c7f88b97b453d8c7281804f08331acbd2dc789572a05fe2995d6268574110380dda3107418c46c04563655cf48b0374c22018e48d8cf1817106d7998336e0e3bf8562d1eb5afb3e4cbac57a91ae64dc11941bcce07707cb801cc5b102daf818a139bb183fe65f23251a208f6384f3a9fb7cad62b3b95f50d5eb77ee561ce0a915d5f19b2b67857efc14a6c7aec2be29946367f45eca06afc38277936e6d1476c3c29ffbf2765e1b14b3ef5d8ca83b32cf1bc2c7b2c67956934ba692239556dde4e71be93624d5e3bd5a5eb4ba9eaaec6eee82292074ccbdea12aab8fbcc973112391e15abfc7062a428ac2f325d22b67436fa56e354b5e559db89f1228f62e0a01105e367c72c43311ce933fcdadcc8fddac7b01839e86a2254d311c141f2b361b8874d13f144273998dd1b627ae09087f33e7281c47287b4eb4d2347312b727667859d2f88efcf44de74cdc4fe936a28d7df6de92ca52b3f1c3b173b84ea9defbecc66f3b896e27c7b2b2ddcef963453d23f5fca29dfeabd238366ab7faf0ae84f9e3e88f41b7470a196dfbe553b2d6ef743ebc5c94b0c28fc27823da01d24cc2fcf18a346d3ec73f0f8dc7e859af6276ceef4ad71512f10a296f9eaaf4c60217e89944052fe74d35e7cb9ce16724a32f1ff8bd2c533e3a1278d533603048966be90a040e94d57114ef12ec87dbcd4d5ffbe1e88696fd31b1a38dabe6bd9a87948512892dfd82490fff7c39e78aaa8d9dd2a4b86ca560ba644e1e3c335906dbed8ad59cd4ee9d1626a51e6d6282b9b90f20394dba7de3fc7f16943b2155e9b258ec78cfa986405156a13d6ae544288cf956effe64d970b1b5164d4418475b0e9b0905bb226b817acc06c434a5550bc7a67533e07539a3040dfe4826fed27a40f84d980ec10ea254d237f77f1aef3722b00342cca79758c7a483a1a159e39fab2d0c82e46c10897c6ee77b930a27d2fb8e7fcb08faa11540939a1fbb6769e3b2fe3842edb0c95774a3132f97ede5847ddcee13d4d9fa2d35f4b4dd3d6aec0871f238c2bf258442ff748ef3c15f42d99edcdb3ef6a479910da88e25f9bddf47f9675fab194e78583870b78c482f99ea8c43b0f03ef0c356b7037921b59f4558f8ff5c6606f5bad136604f99b816e21ff5b4102cecd9a0cd3e40c234cb36e593ed4ae07af914c0a836774209ba1d4ccd3d220e5abe0af7ebde19f5b36651034e29ad579d5c61390c928048460ae1d4c728ab161a9959b90db6b80d22d853d09b17501b567304b7bd3c81dfa47fd507daf974df75a455e989e119b46c7a91c2169d9b09e63b4ba49ba6bee15fe18a80961d1923db25aebec48b30206b23e1a3f6ced844eef68268d8ecf35677eea4cabf10d6e434f58baf6539acd97dd792de841977b0d693169131275f62a0b2811dc2e7f630e51f53e646d2c1fca2ddc3318f9c9bde557353d340c01d26460e536d31cec8569a723e61696261e046374cf59bf274ecf5055ed8008caecf06131cc3f87808f819926a33f4f3bf3572f9f86f887bdece142b81af11d22d53aebc96f422f3d93cc8f19001f259ea04edf067a7d451c2348788ab9d40fbdd862faae10b90ec0c520ffa01c1e360d09e748963f8a0b4a380a2ef87e6cf345bc66a855b0d899a37896910f0e8b42c53261ad5c5beca23d5fdaf1f3a964ad082471f51ceca5f1ff47b085b14cc6640bd0c356838e59f31162eef0d813039908204550088ed7bad441c355430356cd6db3b8d66b12f0ba76e7ef2f6042e044761a45888c6d9f1342cba8d8e3a6f58e5baf1040aa610c8ffe48925413fdd52b5ba3d8fbcf5a63d1e0c56d750247913d46a2ce1bd78372030071b444b4b85e61c758188341cc17378d088b1df0f8c1df5418c0c710f2545eaa0cbb74f16ad336972a306d24cc20e65571db4b8a512bcba60434d6c9beefd9a5384461769e83a7301665d1d8a42242812c273884bf24454650f4bcef049f48048725905b4d30853b07a569b6b73ee64c4c06d8c9045150ff69091917afefad48ab2727dd1992f2b7e6ce0282282fbec3220abba17267454c645bd70551cf40c6791d76984116ee698f317274d000e3a5720c838c69ef6f19da4dcb8e12404cbc8aa9f3a1bed71fea68fab526e8c188086d42348ef8e1f1dfbde2eea5aed679c4e12f5d932c60617d70ae29e8b3c2de223cfaed40ff45892d615616160fc750562eb4d59b8fd56173ad20b9678275807143c00cffaa0bf92e5e3691b0290eaeb39b72bc86040a36d57f24e8d8ec20d3c2b95eb0b255d7ff5562580da03dc5e9a33ac81189be5e2c9e0b641a0c9cdbdb5f0fe067488d34a9c6357ad9a032644991507c7d2604c8ef3237b125892e8b1fd886204b339a9d6b79923644f0af3ffbd22d8fbef2bb2173263a54d38859de2c41153b4027fd3f309305c5d57dff6e4be10b9a95747682251eaf5e0ae8be5f8f05e779bd93b77823f751d7c7b1ffdb4a1bb0a10402f95c352c7f83a27c66ace4c5521cb8022c019c514c155611128bffe7e35f36def2a6e91651b2fedb4b9fd6c17466e0a959916b3140c731b742a7d441112dd30043994da972b25ea5edca9c921984f8d9f25d43142b838bcb583dec676073204fdfef811373e7c2fe503d507a5b7456637c9265e5e6bfce4ae57b1f1c540d71ae888133a32d5d2767040ea6ae10b0ca581bfca4cf6d263c9e7e9fdb4c13539420a6eefc01deb9bba6b769f2521d6e6d75e7e41d08f2fec118dd8d362c94fa12b607d13495a9005b111095946cae791a101e87c8785b101d91773383648576b2dfaaa57047f8d69e7aa042ef7808441f5499bbc875126c4e0e870764172b77d50bc33db32b9dba8e7eefe5279722886a09534a5c9e35999a516b14f490ed79f9d2941fb882204f977f40d04e21f29e00a94638f34d7129b84faa8c6650deebff22bf47fafb62b23b01b7254c464e95b93defb2b227f73e4071e63a86263c0d26b6b01248ac0ee0aa748de04559aa95011830d1ce3ff5628d71d5ca0132a9b90782c3dd0fd6930fa8820dc39e5c17424e71f312ae95f94473362e5464d563e54c5a2e7c6f52f0268ebe14fe111f0c20533e2c9f1d5b376f6ae5b4661d8dc4d9f571801eba9c2cdbd7ae38b14fef8a45ad688e072697eeb6a198d7f938cf35bf03d86e4b25d3dd751cba6d53929245edbf3f14546ba5c1d177d0deead340f5856a241d89ed002738f57c99a7e0ea3877aa70a92eb64662e1aa3dbdebb75527e07a262ac77096f20921f430975509cb2ea1f711c5b3bd48f5cc97ed8cb259bc8712762b6b56a2ac7c1176af39914dc99c7eb79ae33f4bd329633add0241fce85397b29925df32ab99baa71dcaffd942f50f53b74d6394c265f2bcff8cc828b9e174f4bf1ae71ff1f43dd911ac8b75988a6260132f0f509dc5c7ea29e105af89ea42910a41bc214758ea6100cae77e595bbf3fb771919bd57cf1e7fc006672922d70332eadb39143fa6eba2205e079011a3d7203e603a05bfb25bc2958cda4fdfcf335e9c1aa54f4151da5a77da7488000181fd5131b93fa19149b5a489fa6e6d90e652e11564a5f7c772e3ad03cf0ae62fa52083a91dffee850d20acfd375e54a2eb241dec45f47bdf3bad2525866ce41f199adf23fcba6109b9927b4fcdb807d0d4c9d810cab94e66f6ddadc05bb9edcdbac32f4e1680ffa8a987e1351bdc59fa842f44e0fdc0561a7531f049a6384535ceafcf6c314cb45eb25bb115aed533cc7a47370d084e35ae5338d4daebac7b98aba2cb2685949a943e86577fc6a6098ac22a80e2a7102d8c77e107528534443273244bc69b35f88c9d09b87f1238b80126f51ff1ea07c7ff07fc7415a11079345a004fceda9f4d06b448524378a32089d004f12bc97b0047d3380c8b4e4e64b6de7489757a499684c4cfa0c530b2ecc5a469c45660bb988d8289a6b67acc63a183a054c6c8ebac9622c94575e01caa4d37b70c3d6bdbbd59688845abf5eba92b2bcb96875b215e856cab40a228d25d21a60e5d3c61c40c3cb08ecb94741c83fbd21a00827cd7d0bb74d57ad1cfa410800f9351ff408a10477233f5ffe8934700f5270aa9571beb09f653ed75ac244ff7986b16c8cb61ded391bbd101b251bf433d969262d1879b0f1d2bf40a76b41d930b626835414d55a20f221f7c5c607df4f4706e759fd9a6613a481517210a6dbf6c15723ef144c192fe69a9b6034189bd3c9bcb594e0056e3cef0b906a13f27b8804bbec1cde9d31a97cf01099d0149569b12f5e63595d77eea71486773ecf29dd772904b89ffd83c94c17e18bad67ed0b12b82de03b87ab70d42801ddf9d9366e46e8b9ddaf882884843275d15f1c0716d661746432b8e092c0e051febc5aaec79c7e64bc6ac8338dfe485c53a28d3ef1ef730066c035545f26508c602d1bd7a5ec32f652864af43af11e949ecb5c3c5a0833c6fff2f1f1d782f313d4e3d363225030350adc2eb16b71b8963d290335982679f13733c7b98660cfbaeb9ba32840d15a75d1c2fee91dccafc4fb45471d8662aa07eb640f5ff39e0673b48b65b021449515c45f5f42ba32a91cb5f66402c6f2b71b38ba59383feaf8f588b470e040463a8c39773aeaa1ca3db94a31cd7d36b4b723466587e1190ff4ed7afa68c1b711bf5ad0653224f6fe1d3cd9bc81f75c223492b81727c75364d40905162d795d5d11d6cd5cbb772a37158212e58d1fd77342d563d180f46c09a96aff0368ba0866e91d0b1437361313889536e508c7951033d50856d2147f880a9b67816fe8848d34d90b20490d7cf991b73926683311aa389f840c4fac21cf497c96696f2fb7cbcc0a83bac888795bdcb3718f75861fdbb8a5e720c5857c1f7cda2463fb1d957ef9400d78f792c1731a16fcb4db614ae1d982434ecdb537757accbf3c4e4716bb829e108c68878333fe04fce9fb740292ef2b878210fea8f80a03defaf5dd89785f44d156a79353fcfa141ba3a8a4b9a96c67a5b2282bbd610ae4258b0bfd335c370b381bc0a7d43b06bab382dab808bef919576bcc45c977508f4d809778b8b44623a6043157aeee00353d1eb200431912a5b6d3cbf86736c8809605611524925f5fb301032a715d19433a1498d16c38c54c77698c26de289a00d3060fe53fbe14ec7406d99b61976a9648ce6f7afa3dbb141593cbb9e2a5fa6fb1125dd679fa64164f0d35d43153441adcb3718506183f303d3c9b5b485aaddb6fcb3d3d229d3f750faf535383c47bcf7db2a1ec0d097e600043cd57b811007a44178b804d7dd82c098d4307a7550918981b78a9504a818191017e3f0a7746d2e8d04c1dc532c7f907b6347b6f608f482ce12f8e0403699777980f2ef423b6e6b0bfcce975131f3e29a49c45f86d26052a6ca89160dd632370477bb446daafba451932fbfc9ed4bd78b6ad867872930685b2825d6a70cf7ede003d7041a6e389e9adfef2477da64b1df0be6dc2a5ef12b2638297cadbb6a6c5"}) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="10631240", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() 08:14:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x2c, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0063404000000000000000000000000008000006002000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 1554.848962] binder: 13069:13072 got transaction with invalid data ptr [ 1554.854416] binder: 13066:13070 BC_INCREFS_DONE node 1438 has no pending increfs request [ 1554.854517] binder: 13066:13070 ioctl c0306201 0 returned -14 [ 1554.870603] binder: 13068:13071 got transaction with invalid offset (0, min 0 max 0) or object. [ 1554.874877] binder: 13067:13076 BC_INCREFS_DONE node 1441 has no pending increfs request [ 1554.875010] binder: 13067:13076 ioctl c0306201 0 returned -14 08:14:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="00fa811cc9000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1554.875178] binder: 13067:13076 ERROR: BC_REGISTER_LOOPER called without request [ 1554.875187] binder: 13067:13076 got reply transaction with no transaction stack [ 1554.875196] binder: 13067:13076 transaction failed 29201/-71, size 56-8 line 2922 [ 1554.882305] binder: release 13067:13076 transaction 1440 out, still active [ 1554.882310] binder: unexpected work type, 4, not freed [ 1554.882313] binder: undelivered TRANSACTION_COMPLETE 08:14:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x40001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000000)={0x0, @speck128, 0x3, "150be7f1b0948bec"}) [ 1554.941807] binder: 13082:13083 BC_INCREFS_DONE u0000000000000000 node 1446 cookie mismatch 000000c91c81fa00 != 0000000000000000 [ 1554.954929] binder: 13069:13072 transaction failed 29201/-14, size 24-8 line 3155 [ 1554.962741] binder: 13068:13071 transaction failed 29201/-22, size 0-8 line 3199 [ 1554.970627] binder: release 13066:13070 transaction 1437 out, still active [ 1554.982319] binder: 13069:13072 ioctl c0306201 0 returned -14 [ 1554.986007] binder: 13082:13085 ioctl c0306201 0 returned -14 08:14:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="10631240", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 08:14:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFCONF(r2, 0x8912, &(0x7f0000000080)=@buf={0x76, &(0x7f0000000000)="48ccd70c138871d10af6f1f8280d553e323449bccfc7e7cf02a2dddabe441d446d79ecef354b447573ae6fd1efe3c17793d24d567248cbe2c4d3db8e60e350ec9b267a41e38a804a514a514ac939a1ac4a9d2b861d5d39593965d7f1d19f81074b2f741d54053b5a89f89be62ab8615e566bf87ed8af"}) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x7) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 1555.001623] binder: unexpected work type, 4, not freed [ 1555.019832] binder: undelivered TRANSACTION_COMPLETE [ 1555.037885] binder: undelivered TRANSACTION_ERROR: 29201 [ 1555.056727] binder: 13088:13089 BC_INCREFS_DONE node 1449 has no pending increfs request [ 1555.067389] binder: undelivered TRANSACTION_ERROR: 29201 [ 1555.072956] binder: release 13082:13083 transaction 1445 out, still active [ 1555.076287] binder: 13088:13092 ioctl c0306201 0 returned -14 [ 1555.078921] binder: 13088:13092 ioctl 800c6613 20000000 returned -22 [ 1555.095968] binder: 13094:13097 got transaction with invalid data ptr 08:14:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x2c, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0063404000000000000000000000000008000006002000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 1555.107935] binder: unexpected work type, 4, not freed [ 1555.114890] binder: 13095:13099 got transaction with invalid offset (0, min 0 max 0) or object. [ 1555.115467] binder: undelivered TRANSACTION_COMPLETE [ 1555.115724] binder: 13096:13098 BC_INCREFS_DONE node 1453 has no pending increfs request [ 1555.115820] binder: 13096:13098 ioctl c0306201 0 returned -14 [ 1555.122004] binder: 13100:13100 BC_INCREFS_DONE u0000000000000000 no match [ 1555.124812] binder: release 13101:13103 transaction 1456 out, still active [ 1555.124818] binder: undelivered TRANSACTION_COMPLETE [ 1555.144316] binder: release 13105:13106 transaction 1457 out, still active [ 1555.144321] binder: undelivered TRANSACTION_COMPLETE [ 1555.175027] binder: 13094:13108 unknown command 1074946832 [ 1555.175038] binder: 13094:13108 ioctl c0306201 200002c0 returned -22 [ 1555.175145] binder: 13094:13108 ioctl c0306201 0 returned -14 [ 1555.175806] binder: 13094:13097 transaction failed 29201/-14, size 24-8 line 3155 [ 1555.204335] binder: release 13088:13089 transaction 1448 out, still active [ 1555.204768] binder: 13095:13099 transaction failed 29201/-22, size 0-8 line 3199 [ 1555.225153] binder: 13095:13111 got transaction with invalid offset (0, min 0 max 0) or object. [ 1555.242808] binder: 13095:13111 transaction failed 29201/-22, size 0-8 line 3199 [ 1555.260735] binder: unexpected work type, 4, not freed [ 1555.266051] binder: undelivered TRANSACTION_COMPLETE [ 1555.284526] binder: undelivered TRANSACTION_ERROR: 29201 [ 1555.290105] binder: undelivered TRANSACTION_ERROR: 29201 [ 1555.296470] binder: undelivered TRANSACTION_ERROR: 29201 08:14:06 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000080)={0xffffffff7fffffff, 0x0, 0x5, 0x5, 0x100000001, 0x10001}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/status\x00', 0x0, 0x0) r3 = add_key(&(0x7f00000000c0)='.request_key_auth\x00', &(0x7f00000001c0)={'syz', 0x1}, &(0x7f0000001400)="6da4ce6465008ad7c95a3ff36bbd54f23a9d11dcc92787e518d6d669a5a56c89a0e032c90af68bcf712ce7014101e2072a766b988bdef0ed737639625cb6eee85c3b397a59ddfa77353f2db1bb720efb99160bcf9561422d40e5b21516ed6b180889acbd51a9f1dec7a0d8d4660d02ae0ddb135a98c19b370bda03782ac0befc10d7f13e8d8132801ae164cee1522f2e57aa4e74442dd290287ad7b31ce204034b0d0e131de8bbf825d257c090d64eb916245773bf62f12c56654b15fa80b06b411b0f71fc7b1e1eb13e0eb1210585d511", 0xd1, 0xffffffffffffffff) request_key(0x0, &(0x7f0000000200)={'syz', 0x2}, 0x0, r3) bind$inet(r2, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x4, &(0x7f0000000240), 0x4) write$binfmt_elf64(r2, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_int(r4, 0x6, 0x6, 0x0, &(0x7f0000000080)) recvmsg(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0xf7e9}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x100) 08:14:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="10631240", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 08:14:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="0000050000000000"]], 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@mcast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@local}}, &(0x7f0000000380)=0xe8) setsockopt$inet6_mreq(r2, 0x29, 0x1f, &(0x7f00000003c0)={@loopback, r5}, 0x14) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r2, &(0x7f00000004c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000080)={&(0x7f0000000400)=ANY=[@ANYBLOB="5d99e6c0", @ANYRES16=r6, @ANYBLOB="000b2dbd7000ffdbdf2502000000080005000080000064000300080004000900000008000500e00000020800030002000000080008000500000014000200687773696d3000000000000000000000140006000000000000000000000000000000000108000800ff000000080007004e21000008000500ac1e00010c00030008000100030000000800050003000000"], 0x94}, 0x1, 0x0, 0x0, 0x404c044}, 0x8000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) lookup_dcookie(0x7, &(0x7f00000005c0)=""/159, 0x9f) r7 = mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000001, 0x913, r1, 0x0) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000540)={0x6, 0x7fff, 0x4, 0x4, 0x1, [{0x80000000, 0x0, 0x8, 0x0, 0x0, 0xc}]}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000500)={r7}) 08:14:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) pread64(r0, &(0x7f0000000000)=""/124, 0x7c, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x2c, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0063404000000000000000000000000008000006002000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 1555.643573] binder: 13114:13121 got transaction with invalid offset (327680, min 0 max 24) or object. [ 1555.644060] binder: 13116:13120 got transaction with invalid offset (0, min 0 max 0) or object. [ 1555.644291] binder: 13116:13120 transaction failed 29201/-22, size 0-8 line 3199 [ 1555.648037] binder: 13115:13119 unknown command 0 [ 1555.648047] binder: 13115:13119 ioctl c0306201 200002c0 returned -22 [ 1555.648148] binder: 13115:13119 ioctl c0306201 0 returned -14 [ 1555.682868] binder: 13125:13126 got transaction with invalid offsets ptr 08:14:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000af295226fb0bcd95c6683b1e33083123129713e93d3146460f0d41dcfef8a2f4c8866b43cb6496fd3aacaab834d8e2f4a29507ac8d567f407bcd7ad03b1625598a02cbf6a97284fb41024ccd8b406f4232c29dd3aa77e586507b2c3c41e5d74912b4aab817fd8e07891d7d3f4d5f37094f87bd9461e793ab39064a41b3932fda3801d90f56e49e259f4f3d76b83f8fbbb7ac257a58dd7ec6bc1f184cdd71584ff27c46f297eb47e6b02cf6fd7356536faa4dbdce2b3fb5c081170cf0e0f648b85d72a47008ef6a32bc7db6059f8b97fa7f44e3f485b261ef0629552834bccd09f64613f289cda0b655d22feb07cfd291", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) sendfile(r1, r0, &(0x7f0000000080), 0x9) setsockopt$sock_void(r2, 0x1, 0x24, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) write$P9_RREADLINK(r3, &(0x7f0000000040)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) 08:14:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$inet(r2, &(0x7f0000000000)={0x2, 0x0, @empty}, &(0x7f0000000040)=0x10, 0x80800) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1555.682918] binder: 13125:13126 transaction failed 29201/-14, size 0-8 line 3164 [ 1555.707695] binder: undelivered TRANSACTION_ERROR: 29201 [ 1555.713271] binder: release 13115:13119 transaction 1459 out, still active [ 1555.725549] binder: 13127:13129 got transaction with invalid offset (0, min 0 max 0) or object. [ 1555.732453] binder: unexpected work type, 4, not freed [ 1555.732456] binder: undelivered TRANSACTION_COMPLETE [ 1555.732819] binder: undelivered TRANSACTION_ERROR: 29201 [ 1555.756453] binder: 13118:13122 got transaction with invalid data ptr [ 1555.760202] binder: 13114:13130 BC_INCREFS_DONE u0000000000000000 no match [ 1555.769658] binder: 13127:13129 transaction failed 29201/-22, size 0-8 line 3199 [ 1555.777796] binder: undelivered TRANSACTION_ERROR: 29201 08:14:06 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/status\x00', 0x0, 0x0) request_key(0x0, &(0x7f0000000200)={'syz'}, 0x0, 0xfffffffffffffffb) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) write$binfmt_elf64(r1, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) fallocate(r0, 0x2, 0x400, 0x10000) recvmsg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0xf7e9}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x100) 08:14:06 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x1004001ff) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000100000000000ac00c2a4bbab8b9c41910000000000000000cf6400000000000002000000000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="00100000ffffffff"]], 0x0, 0x0, &(0x7f00000003c0)}) [ 1555.789830] binder: 13133:13134 BC_INCREFS_DONE node 1468 has no pending increfs request [ 1555.803678] binder: 13118:13131 unknown command 1074946832 [ 1555.807485] binder: 13133:13138 ioctl c0306201 0 returned -14 [ 1555.818707] binder: 13118:13131 ioctl c0306201 200002c0 returned -22 [ 1555.819938] binder: 13118:13122 transaction failed 29201/-14, size 24-8 line 3155 [ 1555.826230] binder: 13114:13143 ioctl c0306201 0 returned -14 08:14:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) fstat(r3, &(0x7f0000000000)) getsockopt$IPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x43, &(0x7f0000000080)={'icmp\x00'}, &(0x7f00000000c0)=0x1e) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xfff) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 1555.826663] binder: 13114:13121 transaction failed 29201/-22, size 24-8 line 3199 [ 1555.856237] binder: release 13144:13145 transaction 1470 out, still active [ 1555.882708] binder: undelivered TRANSACTION_COMPLETE 08:14:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) 08:14:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xffffffffffffffe9, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) gettid() r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) write$FUSE_NOTIFY_DELETE(r3, &(0x7f0000000040)={0x36, 0x6, 0x0, {0x6, 0x5, 0xd, 0x0, '/selinux/mls\x00'}}, 0x36) 08:14:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x600600, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000040)={'mangle\x00', 0x25, "59c441b0b0e561a0d25cf93619571ac1b7880122586cbfb96376d734182071235763aaea75"}, &(0x7f00000000c0)=0x49) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 1555.915145] binder: 13146:13150 BC_INCREFS_DONE node 1472 has no pending increfs request [ 1555.923889] binder: 13146:13154 ioctl c0306201 0 returned -14 [ 1555.950781] binder: undelivered TRANSACTION_ERROR: 29201 [ 1555.953164] binder: 13156:13158 got transaction with invalid offset (0, min 0 max 0) or object. 08:14:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fcntl$getownex(r0, 0x10, &(0x7f00000002c0)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r3 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x4000, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000000c0)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@local}}, &(0x7f0000000200)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000380)={{{@in6=@local, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@local}}, &(0x7f0000000280)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000007c0)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@local}}, &(0x7f00000008c0)=0xe8) sendmsg$TEAM_CMD_OPTIONS_GET(r3, &(0x7f0000000ac0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20800}, 0xc, &(0x7f0000000a80)={&(0x7f0000000900)={0x158, r4, 0x206, 0x70bd2b, 0x25dfdbfd, {}, [{{0x8, 0x1, r5}, {0xf0, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffc0000000000}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x101}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}]}}, {{0x8, 0x1, r7}, {0x44, 0x2, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}]}}]}, 0x158}, 0x1, 0x0, 0x0, 0x4000}, 0x40) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$sock_inet_SIOCGIFPFLAGS(r2, 0x8935, &(0x7f0000000000)={'batadv0\x00', 0x7f}) fsetxattr$trusted_overlay_opaque(r1, &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r3 = gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) fcntl$setownex(r0, 0xf, &(0x7f00000000c0)={0x0, r3}) [ 1555.953247] binder: 13156:13158 transaction failed 29201/-22, size 0-8 line 3199 [ 1555.960773] binder: 13155:13159 ioctl c0306201 0 returned -14 08:14:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$RTC_WIE_OFF(r2, 0x7010) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1556.012237] binder: 13161:13167 got transaction with invalid data ptr [ 1556.023582] binder: release 13146:13150 transaction 1471 out, still active [ 1556.033193] binder: unexpected work type, 4, not freed [ 1556.048906] binder: undelivered TRANSACTION_COMPLETE [ 1556.053321] binder: 13161:13167 transaction failed 29201/-14, size 24-8 line 3155 08:14:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(0xffffffffffffffff, 0x8912, 0x0) r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$UI_SET_ABSBIT(r3, 0x40045567, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$INOTIFY_IOC_SETNEXTWD(r3, 0x40044900, 0xa3b) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1556.056504] binder: 13169:13172 BC_INCREFS_DONE node 1480 has no pending increfs request [ 1556.057389] binder: 13169:13172 ioctl c0306201 0 returned -14 [ 1556.066325] binder: 13171:13173 BC_INCREFS_DONE node 1483 has no pending increfs request [ 1556.066443] binder: 13171:13173 ioctl c0306201 0 returned -14 [ 1556.111429] binder: 13165:13179 got transaction with invalid offset (0, min 0 max 0) or object. [ 1556.152419] binder: 13180:13184 got transaction with invalid data ptr [ 1556.157343] binder: 13181:13185 BC_INCREFS_DONE node 1487 has no pending increfs request [ 1556.157461] binder: 13181:13185 ioctl c0306201 0 returned -14 [ 1556.173859] binder: release 13181:13185 transaction 1486 out, still active [ 1556.185781] binder: 13165:13179 transaction failed 29201/-22, size 0-8 line 3199 [ 1556.195465] binder: unexpected work type, 4, not freed [ 1556.206511] binder: 13180:13184 transaction failed 29201/-14, size 24-8 line 3155 [ 1556.207032] binder: undelivered TRANSACTION_COMPLETE [ 1556.207492] binder: release 13171:13173 transaction 1482 out, still active [ 1556.207497] binder: unexpected work type, 4, not freed [ 1556.207500] binder: undelivered TRANSACTION_COMPLETE [ 1556.207711] binder: release 13169:13172 transaction 1479 out, still active [ 1556.207715] binder: unexpected work type, 4, not freed [ 1556.207718] binder: undelivered TRANSACTION_COMPLETE [ 1556.207897] binder: undelivered TRANSACTION_ERROR: 29201 [ 1556.208098] binder: undelivered TRANSACTION_ERROR: 29201 [ 1556.208276] binder: release 13155:13159 transaction 1475 out, still active [ 1556.208281] binder: unexpected work type, 4, not freed [ 1556.208283] binder: undelivered TRANSACTION_COMPLETE [ 1556.208765] binder: release 13133:13134 transaction 1467 out, still active [ 1556.208769] binder: unexpected work type, 4, not freed [ 1556.208772] binder: undelivered TRANSACTION_COMPLETE [ 1556.223966] binder: 13189:13190 got transaction with invalid offset (0, min 0 max 0) or object. [ 1556.224015] binder: 13189:13190 transaction failed 29201/-22, size 0-8 line 3199 [ 1556.224960] binder: undelivered TRANSACTION_ERROR: 29201 [ 1556.238371] binder: undelivered TRANSACTION_ERROR: 29201 [ 1556.330501] binder: undelivered TRANSACTION_ERROR: 29201 08:14:07 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/status\x00', 0x0, 0x0) request_key(0x0, &(0x7f0000000200)={'syz'}, 0x0, 0xfffffffffffffffb) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) write$binfmt_elf64(r1, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) recvmsg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0xf7e9}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x100) 08:14:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() write$binfmt_script(r2, &(0x7f0000000000)={'#! ', './file0', [{0x20, '/dev/binder#\x00'}, {0x20, 'security.selinux\x00'}, {0x20, '^@vmnet1GPL\xad/'}], 0xa, "ead05dd3916242e74ea57d256a4524a9b2bf6695643556f91d4b0333ef4bba7b4cfe83c4978f9c6c6a6f2d6bb91c0cae52f38d5147b44d9242d7b6d25248c29a839e9b790938f4e85f6d20be7517bbb8674d150dcf8a5e43baddc6e3e2a38a7eca250c6d94a27b9ff0d1ff0128c38ad101ba220509ce640e752e18d9772e17c77cf15d536754e5d112740424b60fcaa3542f09940f3f622c39e5b488b323226bbef97bc7cbbcf20fef9a8b14e9f5d2b4814650c193572557363d3a2a9108fa65164913"}, 0xfc) wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r2 = gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) tkill(r2, 0x12) 08:14:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) finit_module(r2, &(0x7f00000000c0)='}mime_typewvmnet1\x00', 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00:-\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="62efe2648236ae231040853538dae66e669fecce7240702eeda2e265ab67b0f9068eab48a282f1099654698b2e912ef429901d456f303bb1623d52368f10dd6d19ad8d96896db24e9d1ed5712488616f7ef330e5497729e3a5ac106eef5455e00ef58459bf66088f3638202ccd27e8d5c4e16f3faf896702ceb8960eda3c406a65db4f5be5916af4f74d1ac3d55d0c03000000000000001d1e44572646", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00>\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r4 = gettid() wait4(r4, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1556.656020] binder: 13193:13197 got transaction with invalid offset (0, min 0 max 24) or object. [ 1556.659114] binder: 13196:13199 got transaction with invalid data ptr [ 1556.659181] binder: 13196:13199 transaction failed 29201/-14, size 24-8 line 3155 [ 1556.679473] binder: undelivered TRANSACTION_ERROR: 29201 [ 1556.691519] binder: 13193:13197 transaction failed 29201/-22, size 24-8 line 3199 [ 1556.698824] binder: BINDER_SET_CONTEXT_MGR already set 08:14:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000800000000000000d789432d7d45af2800000000000000000000000000000000080000", @ANYPTR=&(0x7f00000005c0)=ANY=[@ANYBLOB="0676751559bda501001100004000d1d3cd0505dc55ff35e12cca0e99600599edc753a673f4c4a8c3d50a62379f71e2e2c713d90dd75d0a27959459cd9ca9476d8df446f07d610000000000000200a08df278115a282a79ca64b16c034f1f545e0f4286146364c6cbeefdcb19fa7d8081e5e9381f91190e3f970337a95a9524bbe2dc268dcfb6d4a9f27506490f98983d2c5dc7b27cbe85efd048901c22c5501d5f75498d3ff2abffdd78e783dd6f4b6927f8700efe9d02a84c14a750c8bd6633f87652a5a77582420f9f3e5ccce5e3d5769e691ea99c5e12c98dc6bb84f343ceddbc6388d5da718b0ce2c181465f885b71b0f91100bfedfdc533742131fd7ccc6ceab616f7a1a8360a621e4d134a938e871a67a2c35d53ed96a9b571cb35588deb0e5d3a2d661f7598ef89fa0d07abaacdc060f78b5722850a89b3487c584324606d9a691b34b2fb3a92dbe7f382794286a420f567bbf17c52fe528caee99d14aaa97ac21b08b93f195dcca562a522af43605d28d475eb313dca5382c7f4aaa3b48320a3aac33b2b584e63ac73e352b2bf1cbf83e98ba0f7aa32354f59e54191bbf25118463caa9a80c6e867c5cddd21ca9035557244f914300dfd6a14"]], 0x0, 0x0, &(0x7f00000003c0)}) getresuid(&(0x7f0000000080), &(0x7f00000000c0)=0x0, &(0x7f0000000100)) pipe(&(0x7f0000000540)={0xffffffffffffffff}) ioctl$KDGKBSENT(r4, 0x4b48, &(0x7f0000000580)={0xfffffffffffffffd, 0xfffffffffffffffb, 0xff}) fstat(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000200)='\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000440)={0x0, 0x0, 0x0}, &(0x7f0000000480)=0xc) setxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f00000004c0)={{}, {0x1, 0x1}, [{0x2, 0x2, r3}], {0x4, 0x1}, [{0x8, 0x2, r5}, {0x8, 0x4, r6}, {0x8, 0x2, r7}, {0x8, 0x0, r8}], {0x10, 0x6}, {0x20, 0x1}}, 0x4c, 0x1) 08:14:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x8000000000000000) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000540)={0xac, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0c63000010630840040000000000000011634840000000000000000002000000000000000000000011000000000000000000000068000000000000004800000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="8561646600000000000000000000000000140000ff000000008561646600000000040000000000000001000000000000003c00000000000000852a747000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000003000000000000000d00000000000000"], @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="380000000000000018000000000000003daef1982a1601ca280000000000000078000000000000003000000000000000480000000000000018000000000000000000000000000000"], @ANYBLOB="010000000000000011634840020000000000000004000000000000000000000001000000000000000000000000000000000000001800000000000000", @ANYPTR=&(0x7f0000000180)=ANY=[], @ANYPTR=&(0x7f0000000400)=ANY=[@ANYBLOB='H\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="04000000000000000d630000"], 0x12d, 0x0, &(0x7f0000000500)="2d36059da410cbd630053c226e70b39ea5a47ea0"}) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$TUNGETFEATURES(r2, 0x800454cf, &(0x7f0000000040)) fchmod(r0, 0xb0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="0000010000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1556.698835] binder: 13194:13201 ioctl 40046207 0 returned -16 [ 1556.699009] binder: 13194:13201 got transaction with invalid offset (0, min 0 max 0) or object. [ 1556.699057] binder: 13194:13201 transaction failed 29201/-22, size 0-8 line 3199 [ 1556.716499] binder: undelivered TRANSACTION_ERROR: 29201 [ 1556.733378] binder: 13198:13207 BC_INCREFS_DONE node 1495 has no pending increfs request 08:14:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1556.768845] binder: 13208:13211 got transaction with invalid data ptr [ 1556.780140] binder: 13193:13197 ioctl c0306201 0 returned -14 [ 1556.780718] binder_alloc: 6448: binder_alloc_buf size 174739258672 failed, no address space [ 1556.780733] binder_alloc: allocated: 10816 (num: 453 largest: 32), free: 1472 (num: 2 largest: 1464) [ 1556.780970] binder: 13210:13212 transaction failed 29201/-28, size 174739258669-0 line 3137 08:14:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$security_smack_entry(r1, &(0x7f0000000000)='security.SMACK64MMAP\x00', &(0x7f0000000040)='/dev/binder#\x00', 0xd, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 1556.788960] binder: 13208:13211 transaction failed 29201/-14, size 24-8 line 3155 [ 1556.789729] binder: undelivered TRANSACTION_ERROR: 29201 [ 1556.794253] binder: undelivered TRANSACTION_ERROR: 29201 [ 1556.845057] binder: 13218:13219 got transaction with invalid data ptr [ 1556.846279] binder: 13220:13222 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 1556.846454] binder: 13220:13222 transaction failed 29189/-22, size 104-72 line 3014 08:14:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300008000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1556.849074] binder: 13220:13222 transaction failed 29189/-22, size 24-8 line 3014 [ 1556.851485] binder: 13220:13222 ioctl c0306201 0 returned -14 [ 1556.857942] binder: undelivered TRANSACTION_ERROR: 29189 [ 1556.872265] binder: undelivered TRANSACTION_ERROR: 29201 [ 1556.904115] binder: 13221:13226 got transaction with invalid offset (0, min 0 max 0) or object. [ 1556.922102] binder: 13221:13226 transaction failed 29201/-22, size 0-8 line 3199 [ 1556.941648] binder: 13218:13219 transaction failed 29201/-14, size 24-8 line 3155 [ 1556.943764] binder: undelivered TRANSACTION_ERROR: 29201 [ 1556.955422] binder: 13225:13229 BC_INCREFS_DONE node 1504 has no pending increfs request [ 1556.960399] binder: undelivered TRANSACTION_ERROR: 29201 [ 1556.964354] binder: 13203:13227 unknown command 1692594018 [ 1556.964374] binder: 13203:13227 ioctl c0306201 200002c0 returned -22 [ 1556.964617] binder: 13203:13227 ioctl c0306201 0 returned -14 [ 1556.982407] binder: 13225:13230 ioctl c0306201 0 returned -14 [ 1557.003515] binder: release 13225:13229 transaction 1503 out, still active [ 1557.017629] binder: unexpected work type, 4, not freed [ 1557.023000] binder: undelivered TRANSACTION_COMPLETE [ 1557.028739] binder: release 13203:13227 transaction 1506 out, still active [ 1557.035821] binder: unexpected work type, 4, not freed [ 1557.042039] binder: undelivered TRANSACTION_COMPLETE 08:14:08 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/status\x00', 0x0, 0x0) request_key(0x0, &(0x7f0000000200)={'syz'}, 0x0, 0xfffffffffffffffb) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) write$binfmt_elf64(r1, &(0x7f00000000c0)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYRESDEC=r1, @ANYRES64], @ANYRES16=0x0], 0xa) recvmsg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0xf7e9}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x100) 08:14:08 executing program 3: r0 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x105800, 0x0) dup2(r0, r1) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:08 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 08:14:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="00000000000100006eaea4d56bc60ed5fa779dea206f35e01102636fbae0099a1e2b7d2ab362a3065d2f76", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000000c0)) wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, r3) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000100)='tls\x00', 0x4) 08:14:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340000000000000dfffffff000000000000000000000000000000000000000000080000c7af08d150047cc4f2bc37352e", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="00feffffffffffff"]], 0x0, 0x0, &(0x7f00000003c0)}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) write$selinux_user(r2, &(0x7f0000000380)=ANY=[], 0x0) syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) [ 1557.524553] binder: 13237:13240 got transaction with invalid data ptr [ 1557.538406] binder: 13235:13241 BC_INCREFS_DONE node 1511 has no pending increfs request [ 1557.547026] binder: 13237:13240 transaction failed 29201/-14, size 24-8 line 3155 [ 1557.555751] binder: 13235:13244 ioctl c0306201 0 returned -14 [ 1557.561830] binder: 13236:13243 got transaction with invalid offset (0, min 0 max 24) or object. 08:14:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="feab43262d7f0de8", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1557.576251] binder: 13236:13243 transaction failed 29201/-22, size 24-8 line 3199 [ 1557.585959] binder: undelivered TRANSACTION_ERROR: 29201 [ 1557.599046] binder: release 13235:13241 transaction 1510 out, still active [ 1557.605513] binder: 13239:13249 BC_INCREFS_DONE u0000000000000000 no match [ 1557.605850] binder: 13239:13249 ioctl c0306201 0 returned -14 08:14:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0xbfc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000000)={'vlan0\x00', @remote}) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1557.626906] binder: BINDER_SET_CONTEXT_MGR already set [ 1557.633549] binder: 13236:13243 ioctl c0306201 0 returned -14 [ 1557.637120] binder: 13247:13250 ioctl 40046207 0 returned -16 [ 1557.647561] binder: 13247:13250 unknown command 4219648 [ 1557.653453] binder: 13247:13250 ioctl c0306201 200001c0 returned -22 08:14:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) fcntl$dupfd(r0, 0x406, r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0863e755", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1557.674486] binder: 13255:13257 unknown command 641969150 [ 1557.680539] binder: unexpected work type, 4, not freed [ 1557.691632] binder: 13255:13258 ioctl c0306201 0 returned -14 [ 1557.701640] binder: 13254:13260 got transaction with invalid data ptr [ 1557.702500] binder: 13255:13257 ioctl c0306201 20000000 returned -22 [ 1557.715396] binder: undelivered TRANSACTION_COMPLETE [ 1557.715548] binder: undelivered TRANSACTION_ERROR: 29201 08:14:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000400)={'team0\x00', 0x0}) write$P9_RXATTRWALK(r2, &(0x7f00000003c0)={0xf, 0x1f, 0x2, 0x362c2de5}, 0xf) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000440)={r3, 0x1, 0x6, @random="f7a12b69dca6"}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="5b95ff40abd43d928ec07f6e94c863831cfd0c91", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)={0xe0, r5, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0xc0, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5493}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffff7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}]}, @TIPC_NLA_MEDIA={0xc, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0xe0}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1557.725520] binder: release 13255:13257 transaction 1517 out, still active [ 1557.725525] binder: unexpected work type, 4, not freed [ 1557.725528] binder: undelivered TRANSACTION_COMPLETE [ 1557.731669] binder: 13263:13264 unknown command 1441227528 [ 1557.731686] binder: 13263:13264 ioctl c0306201 200002c0 returned -22 [ 1557.731975] binder: 13263:13264 ioctl c0306201 0 returned -14 [ 1557.749898] binder: release 13263:13264 transaction 1521 out, still active [ 1557.749904] binder: unexpected work type, 4, not freed [ 1557.749907] binder: undelivered TRANSACTION_COMPLETE [ 1557.761306] binder: 13267:13269 unknown command 1090491739 [ 1557.761316] binder: 13267:13269 ioctl c0306201 200002c0 returned -22 [ 1557.778004] binder: release 13267:13269 transaction 1524 out, still active [ 1557.778009] binder: unexpected work type, 4, not freed [ 1557.778012] binder: undelivered TRANSACTION_COMPLETE [ 1557.817293] binder: 13254:13260 transaction failed 29201/-14, size 24-8 line 3155 [ 1557.830260] binder: undelivered TRANSACTION_ERROR: 29201 08:14:09 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/checkreqprot\x00', 0x0, 0x0) getsockopt$packet_int(r0, 0x107, 0xc, &(0x7f00000002c0), &(0x7f0000000340)=0x4) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) setsockopt$inet_udp_int(r1, 0x11, 0x6f, &(0x7f0000000380)=0x1, 0x4) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/keychord\x00', 0x60000, 0x0) ioctl$BLKTRACESTART(r2, 0x1274, 0x0) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/status\x00', 0x0, 0x0) request_key(0x0, &(0x7f0000000200)={'syz'}, 0x0, 0xfffffffffffffffb) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) write$binfmt_elf64(r1, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) recvmsg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0xf7e9}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x100) getsockopt(r3, 0x6, 0x1e, &(0x7f0000001400)=""/217, &(0x7f0000000080)=0xd9) 08:14:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socket$inet_icmp_raw(0x2, 0x3, 0x1) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x351, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000080)=0xc) ptrace$cont(0xffffffffffffffff, r4, 0x1000, 0x6) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x4000, 0x0) dup3(r0, r0, 0x80000) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000e8ffffffffffffff00000040081800000000f4ffffffffffffff0000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="f5ffffffffffffff"]], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000000c0)) wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, r3) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000100)='tls\x00', 0x4) 08:14:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="072b6a7300314b6ff1167717c14c668e", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x18100004, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) 08:14:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1558.398992] binder: 13282:13287 unknown command 0 [ 1558.408435] binder: 13285:13291 got transaction with invalid data ptr [ 1558.417948] binder: 13279:13293 BC_INCREFS_DONE node 1529 has no pending increfs request [ 1558.419396] binder: 13283:13290 got transaction with invalid offset (0, min 0 max 24) or object. [ 1558.419464] binder: 13283:13290 transaction failed 29201/-22, size 24-8 line 3199 [ 1558.419894] binder: 13283:13290 ioctl c0306201 0 returned -14 08:14:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x101001, 0x0) mkdirat$cgroup(r4, &(0x7f0000000040)='syz0\x00', 0x1ff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="55b3b03943dd994570a14ea1ccf3696c5e5eec86508cf86e0acff575af63dbb2e754e7951ec44a7e56d31021adb8ed081874d0825490fe5f24fc36ae21b28a7acff600142d0778c67fa8cc7868b95b8ebe0beae603a062716d81f6b5635399ac051ffd90d331e67c58e8e938c5a3b5f6429fa8584a3950836e775a6d866a2ebcf8e1a85e7c5bc11f1459d73631db6653299c766ce1deae4a01f8cbfd4475bc29064e8289ab1ce30e87f187acba5871b2d84e2c3970b077b5d0247d76797745d74e96b6a53a40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() ioctl$FIBMAP(r2, 0x1, &(0x7f0000000080)=0xfa) wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000000c0)) wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, r3) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000100)='tls\x00', 0x4) [ 1558.442170] binder: undelivered TRANSACTION_ERROR: 29201 [ 1558.456055] binder: 13282:13287 ioctl c0306201 200001c0 returned -22 [ 1558.463806] binder: 13285:13291 transaction failed 29201/-14, size 24-8 line 3155 [ 1558.471810] binder: 13279:13296 ioctl c0306201 0 returned -14 [ 1558.477694] binder: 13279:13293 ioctl c0306201 20000040 returned -14 [ 1558.479094] binder: 13282:13287 unknown command 0 [ 1558.479103] binder: 13282:13287 ioctl c0306201 200001c0 returned -22 08:14:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="000718ff4100000077fcf80bb0d6453304155125ea5fdefdd47ab4e259f4b53d302e13c9efdde9a5d8a3f655348b1fb8638931b4fc3f086788ece1b594a93c2ec04984624e686b91e0821b04bd676752e480aaf45acf1dd882db56c9059409b149bf355c4fd55dd92012837681b050415646f241d4d48dd9bdc331738f4b26ab96760d40241df7d376d2c0a8331a2764d71ab5918613e00fecae7926282dc4065c0f68209cade58cc9828f4993ac760aff7e4e07c976310000006aa0c20727c8a34cda8a2befe0939695f497e01696c5f65e9f9d82f6e94930958704ea1d299d3b11b1b093fc575159bb0c5b77792a0e5e96010d639de8a9559ec46343e5589b269ed141c3b5c71f8edf9195b35c99ec993c0e7e8a0e4fd726a3fdc0f1663c12e9"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1558.486252] binder: 13281:13299 BC_INCREFS_DONE u0000000000000000 no match [ 1558.486386] binder: 13281:13299 ioctl c0306201 0 returned -14 [ 1558.498682] binder: undelivered TRANSACTION_ERROR: 29201 08:14:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1558.545193] binder: 13303:13305 BC_INCREFS_DONE u0000000000000000 node 1536 cookie mismatch 4599dd4339b0b355 != 0000000000000000 [ 1558.555558] binder: 13302:13306 got transaction with invalid data ptr [ 1558.555643] binder: 13302:13306 transaction failed 29201/-14, size 24-8 line 3155 [ 1558.568672] binder: 13308:13310 BC_INCREFS_DONE u0000000000000000 node 1540 cookie mismatch 0000000000000000 != 00000041ff180700 [ 1558.568817] binder: 13308:13310 ioctl c0306201 0 returned -14 [ 1558.587413] binder: release 13308:13310 transaction 1539 out, still active [ 1558.587418] binder: unexpected work type, 4, not freed [ 1558.587421] binder: undelivered TRANSACTION_COMPLETE [ 1558.587499] binder: undelivered TRANSACTION_ERROR: 29201 [ 1558.616028] binder: 13312:13313 unknown command 0 [ 1558.642783] binder: 13314:13318 got transaction with invalid data ptr [ 1558.651448] binder: 13312:13315 ioctl c0306201 0 returned -14 [ 1558.658514] binder: 13312:13313 ioctl c0306201 200002c0 returned -22 [ 1558.672661] binder: release 13312:13313 transaction 1542 out, still active [ 1558.673462] binder: 13314:13318 transaction failed 29201/-14, size 24-8 line 3155 [ 1558.694999] binder: unexpected work type, 4, not freed [ 1558.712891] binder: undelivered TRANSACTION_COMPLETE [ 1558.729755] binder: undelivered TRANSACTION_ERROR: 29201 [ 1558.760593] binder: 13317:13322 BC_INCREFS_DONE u0000000000000000 no match [ 1558.770664] binder: 13317:13323 ioctl c0306201 0 returned -14 08:14:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1000000000007, 0x0, &(0x7f0000000040)) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x40004001fc) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="0000000000000300"]], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) timer_create(0x5, &(0x7f00000000c0)={0x0, 0x28, 0x3, @thr={&(0x7f0000000000)="2d3e09ad400d52409ac2a6bc71c9e504113de672a3494182e9b6d7e7ee651ca0a78bc33b631d0b04036b2794d338485226f9fb99a3db2e72496a1e219fda205360af341f95ebbffe511470c77fd6943ad4cd277b53bce4b8784a564d20e4d8e64a2ed9dab2a2313103f9fbd9ec91b9dcc88f02992b891de8059bec8511c17ed45f7f2643689e3972362fca738e929e730cf4db350f0428bfef7d59f3f9ab40848eb747", &(0x7f0000000380)="0e0aa6118a0c5cd9fe649cd25b73ecc33f5abd6c8df82e47ddec39cf57fbc9f160a559c411355624e7fbb5bc8ddc606c0179458fff02d075526d22d076cf3e39231e35c6eb32cd5f5621a712a5f92291a317204f53e8914c5d9677aa0ea4595683f1900a664a0d79ef260576d703d0abae3443e6678e4f73da360a5cd3f084982510d125c543f00da720e9873f14c19c4d9b08fb501cbeed8a969ea1b3904f8730da07d3fce686a6a4a80576026bb4dea7705ef6241a2c7c9e63dbbf4e95a7a96f94f2bc28ef93918626881721434711011eb85385f3"}}, &(0x7f0000000180)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000480), 0x1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x4001fd) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BLKFLSBUF(r2, 0x1261, &(0x7f0000000100)=0xfffffffffffffffc) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r3 = gettid() tgkill(r3, r3, 0x3f) wait4(0x0, 0x0, 0x80000000, 0x0) setxattr$trusted_overlay_opaque(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='trusted.overlay.opaque\x00', &(0x7f0000000540)='y\x00', 0x2, 0x2) socket$nl_route(0x10, 0x3, 0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x2400, 0xfff) 08:14:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:10 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = accept(0xffffffffffffffff, &(0x7f0000000480)=@nl=@proc, &(0x7f0000000500)=0x80) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000540)={0x0, r1, 0x24000000000000, 0x7, 0xffffffff, 0x1}) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r4 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x7f, 0x0) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f00000003c0)=""/10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$VT_RELDISP(r4, 0x5605) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write(r5, &(0x7f0000000400)="65e44c7190e31bf758a6a1cc49da7f1947f23f579376b1bcdc69894320ffdeeff9f5e62f31ed9fb4beae131384de7d30cbed5d8f0e85942e7e242340d4b14b90fe3cfde1a776a92aa90fb3a3d7d4c50e49b84d7a370c7b104859730383fdfa247c8d4dc73d", 0x65) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)=[&(0x7f0000000080)='/dev/binder#\x00', &(0x7f00000000c0)='/dev/binder#\x00', &(0x7f0000000100)='/dev/binder#\x00'], &(0x7f0000000380)=[&(0x7f0000000180)='/dev/binder#\x00']) 08:14:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000000c0)) wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, r3) [ 1559.025603] binder: 13330:13331 got transaction with invalid data ptr [ 1559.032539] binder: 13327:13329 transaction failed 29189/-22, size 24-8 line 3014 [ 1559.043296] binder: 13330:13331 transaction failed 29201/-14, size 24-8 line 3155 [ 1559.052816] binder: 13327:13329 ioctl c0306201 0 returned -14 [ 1559.061856] binder: undelivered TRANSACTION_ERROR: 29201 08:14:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000180), 0x5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="086368d525a0cc6b36f7183ee44231037f5731a4b02a01badeffde9d6c9d7eed1ddb1f4164da7e26bf77976f14bee69b645da2664ecab88333839a96e84ce626954cc0fa508862c67516e8a528098b2e60e97c37d87bb1efe0645d49d2e60e244278061e423205b396e41281afa1c232f1dee92b584ac9a41655af322db24c52856152160589dfe7592c904986a74d", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1559.073161] binder: 13326:13328 BC_INCREFS_DONE u0000000000000000 no match [ 1559.095850] binder: 13326:13338 ioctl c0306201 0 returned -14 [ 1559.107910] binder: 13324:13325 got transaction with invalid offset (844424930131968, min 0 max 0) or object. [ 1559.108057] binder: 13332:13334 transaction failed 29189/-22, size 24-8 line 3014 08:14:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400201) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000058000000010000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1559.114948] binder: 13332:13334 ioctl c0306201 0 returned -14 [ 1559.148126] binder: 13324:13325 transaction failed 29201/-22, size 0-8 line 3199 [ 1559.148231] binder: undelivered TRANSACTION_ERROR: 29189 [ 1559.171205] binder: 13344:13347 BC_INCREFS_DONE node 1557 has no pending increfs request [ 1559.178237] binder: undelivered TRANSACTION_ERROR: 29201 [ 1559.187099] binder: 13346:13349 unknown command -714579192 [ 1559.189384] binder: 13341:13345 got transaction with invalid data ptr [ 1559.189449] binder: 13341:13345 transaction failed 29201/-14, size 24-8 line 3155 [ 1559.199128] binder: 13344:13352 ioctl c0306201 0 returned -14 [ 1559.203352] binder_alloc: 6448: binder_alloc_buf size 4294967392 failed, no address space [ 1559.203360] binder_alloc: allocated: 11296 (num: 468 largest: 32), free: 992 (num: 2 largest: 984) [ 1559.203405] binder: 13351:13355 transaction failed 29201/-28, size 4294967384-8 line 3137 [ 1559.204674] binder: 13351:13355 ioctl c0306201 0 returned -14 [ 1559.206463] binder_alloc: 6448: binder_alloc_buf size 4294967392 failed, no address space [ 1559.206471] binder_alloc: allocated: 11296 (num: 468 largest: 32), free: 992 (num: 2 largest: 984) [ 1559.206514] binder: 13351:13355 transaction failed 29201/-28, size 4294967384-8 line 3137 [ 1559.207622] binder: 13351:13357 ioctl c0306201 0 returned -14 08:14:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000080000000000000800000000000000000000fb00000000006988a51b64bd8d59f52361e200000000000000000000000000008c8e669f9211b1daf752e86cbbc89947501970d51c96880124e0912bb1ebcdbeacab0ec0314a864f9ad79710e5f08d9f4d3ad9c33b81b8d0913e94ba5ddbdabdfb5d70a936ee580b2968bb3ca2c56122b27c321810f5a5ad6492f2e507b80dd7ffac80398bbe9d5fa01967fc252d2ce1bd97da0347c9dee6f41d271a075513a925ffa6ecf777959296d10f1dc3f55dcfcd5ab3d2582c", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x40000000000000, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r1, 0xc06855c8, &(0x7f0000000380)={0x8, 0x0, {0x53, 0x7, 0x2, {0x7, 0x2}, {0x6, 0xfffffffffffffe01}, @const={0x200, {0x9, 0x6, 0x9, 0x100000001}}}, {0x57, 0x4f02a279, 0x4, {0x868}, {0x1, 0x4e3c}, @ramp={0x1, 0x9, {0x20, 0xc17d, 0x800, 0x1}}}}) fcntl$getownex(r0, 0x10, &(0x7f00000000c0)) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) fcntl$dupfd(r0, 0xa442e04782abbe2a, r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_FIOGETOWN(r4, 0x8903, &(0x7f0000000000)=0x0) fcntl$setown(r2, 0x8, r5) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000140)={0x5, 0x7, 0x1, 0x3c84, 0x200}, 0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x20, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="000000000034722a9adbfa4472bc86f4000000b4de67607451b0bee81249730a6c4c6b0553fe6984ca8d6cec4de4f95bb9d178edaf4f09a5395aa8593e62dc3e212a32ad1396825f8b6fe3faee260183fc"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0xfffffdf8, 0x0, &(0x7f0000000000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffd3c, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="08631040569f7ad38cb3b8d52c0feefbbd931c539ae881e80ad8f836ff77039afb9b67b302f49dbb44eb9d28fb7c12c5d9187ed9ff027d6c67df822ef6fafdabe605c6b251bea4aa20c18215df544e7870ab73d1b2d0a250aac4510ee7cd58695ad8ee59a5fcf35e34a9d44eb6826ca39aa7090956d0568694441aef32da2786566e13b3848b3cca65483c0ffa252ec5160677d3d2d904355dfcef45dab6e221111b7655e697514167e14a95cd453e6b4e74f4102b2cd22adb2b4f3b9cdc2afa1ce024a7329f2440367f6b7cfe54bb5d4bfa84dccc62efa4cae660ff8b8beadc9100f195901a3fd074a6ba66746b732a262638f982892c1ebc460d53763ff693c45ef25d5283038b53e5c4fdf7", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1559.227653] binder: 13359:13360 unknown command 0 [ 1559.227664] binder: 13359:13360 ioctl c0306201 200001c0 returned -22 [ 1559.248172] binder: 13361:13362 got transaction with invalid offset (0, min 0 max 0) or object. [ 1559.248221] binder: 13361:13362 transaction failed 29201/-22, size 0-8 line 3199 [ 1559.249271] binder: 13361:13363 got transaction with invalid offset (0, min 0 max 0) or object. [ 1559.249318] binder: 13361:13363 transaction failed 29201/-22, size 0-8 line 3199 [ 1559.267434] binder: undelivered TRANSACTION_ERROR: 29201 [ 1559.267492] binder: undelivered TRANSACTION_ERROR: 29201 [ 1559.267648] binder: release 13326:13328 transaction 1551 out, still active [ 1559.267653] binder: unexpected work type, 4, not freed [ 1559.267659] binder: undelivered TRANSACTION_COMPLETE [ 1559.267751] binder: undelivered TRANSACTION_ERROR: 29201 [ 1559.267823] binder: undelivered TRANSACTION_ERROR: 29201 [ 1559.267892] binder: undelivered TRANSACTION_ERROR: 29201 [ 1559.334698] binder: 13367:13370 got transaction with invalid data ptr 08:14:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="0015040010b6487b"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000014, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) getsockopt$inet_tcp_buf(r2, 0x6, 0x1e, &(0x7f0000000080)=""/98, &(0x7f0000000100)=0x62) 08:14:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1559.335885] binder: 13367:13370 transaction failed 29201/-14, size 24-8 line 3155 [ 1559.336327] binder: undelivered TRANSACTION_ERROR: 29201 [ 1559.368272] binder: 13368:13369 transaction failed 29189/-22, size 24-8 line 3014 [ 1559.382637] binder: 13368:13369 ioctl c0306201 0 returned -14 [ 1559.396539] binder: BINDER_SET_CONTEXT_MGR already set [ 1559.396551] binder: 13364:13366 ioctl 40046207 0 returned -16 [ 1559.396893] binder: 13364:13366 got transaction with invalid offset (0, min 0 max 0) or object. [ 1559.396942] binder: 13364:13366 transaction failed 29201/-22, size 0-8 line 3199 [ 1559.422227] binder: 13371:13376 unknown command 0 [ 1559.422237] binder: 13371:13376 ioctl c0306201 200001c0 returned -22 [ 1559.439451] binder: 13371:13376 BC_INCREFS_DONE ud5b8b38cd37a9f56 no match [ 1559.441293] binder: 13346:13365 ioctl c0306201 0 returned -14 [ 1559.445759] binder: 13346:13349 ioctl c0306201 200002c0 returned -22 [ 1559.460864] binder: BINDER_SET_CONTEXT_MGR already set [ 1559.469395] binder: undelivered TRANSACTION_ERROR: 29189 [ 1559.481730] binder: 13364:13379 ioctl 40046207 0 returned -16 [ 1559.484242] binder: 13371:13376 ioctl c0306201 0 returned -14 [ 1559.510292] binder: undelivered TRANSACTION_ERROR: 29201 [ 1559.525851] binder: 13380:13384 got transaction with invalid data ptr [ 1559.532330] binder: release 13371:13376 transaction 1570 out, still active [ 1559.532335] binder: unexpected work type, 4, not freed [ 1559.532338] binder: undelivered TRANSACTION_COMPLETE [ 1559.551766] binder: 13380:13384 transaction failed 29201/-14, size 24-8 line 3155 [ 1559.552443] binder: 13378:13383 got transaction with invalid data ptr [ 1559.552506] binder: 13378:13383 transaction failed 29201/-14, size 24-8 line 3155 [ 1559.554563] binder: 13378:13383 ioctl c0306201 0 returned -14 08:14:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000000c0)) wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) 08:14:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a6273000025b0", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() ioctl$EXT4_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x44) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) read(r1, &(0x7f0000000000)=""/108, 0x6c) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='numa_maps\x00') ioctl$TIOCLINUX7(r3, 0x541c, &(0x7f00000000c0)={0x7, 0x9}) 08:14:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="0015040010b6487b"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000014, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) getsockopt$inet_tcp_buf(r2, 0x6, 0x1e, &(0x7f0000000080)=""/98, &(0x7f0000000100)=0x62) [ 1559.579628] binder: undelivered TRANSACTION_ERROR: 29201 08:14:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1559.605872] binder: 13390:13391 BC_INCREFS_DONE node 1576 has no pending increfs request [ 1559.606658] binder: undelivered TRANSACTION_ERROR: 29201 [ 1559.623980] binder: 13390:13394 ioctl c0306201 0 returned -14 [ 1559.632010] binder: 13393:13396 BC_INCREFS_DONE node 1579 has no pending increfs request [ 1559.641764] binder: 13393:13398 ioctl c0306201 0 returned -14 08:14:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\b\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="4000000000000000bfc118b4e56c61695ee1ea88ebb331727bab152302737b33f4f57960752561829c922dc4997dffffff7f9a2ccd71b7d7fe753c361102e5da53292a5b4d89dc9887f4da80f735ca0491e535b5da9d81c09c14b5eb5192d9bb3efaf2df4926efd71ba0db4b57c2747e1cd3182f87b66d6dc8e2e2fbfd5a54844f48be12f5ee263b61299a93020abe498b0c74b2b68a04fafd7d100c9519fcd01bb5f2601321afee1e01"], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="00007f7fbcb9e8b65c1a19343ecbc8ffffff7f00000000000800"]], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000000)) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) fcntl$setsig(r0, 0xa, 0x8) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1559.650902] binder: 13388:13399 got transaction with invalid offset (0, min 0 max 0) or object. [ 1559.660306] binder: release 13393:13396 transaction 1578 out, still active [ 1559.664831] binder: 13392:13400 BC_INCREFS_DONE u0000000000000000 no match [ 1559.664942] binder: 13392:13400 ioctl c0306201 0 returned -14 [ 1559.696513] binder: 13395:13397 got transaction with invalid data ptr [ 1559.712768] binder: 13395:13397 transaction failed 29201/-14, size 24-8 line 3155 [ 1559.721003] binder: 13404:13409 got transaction with invalid data ptr [ 1559.729212] binder: 13388:13399 transaction failed 29201/-22, size 0-8 line 3199 [ 1559.736544] binder: 13405:13411 got transaction with invalid offset (134217728, min 0 max 24) or object. 08:14:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$sock_TIOCINQ(r2, 0x541b, &(0x7f0000000000)) 08:14:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1559.736624] binder: 13405:13411 transaction failed 29201/-22, size 24-8 line 3199 [ 1559.746659] binder: 13405:13411 ioctl c0306201 0 returned -14 [ 1559.762232] binder: 13395:13402 BC_INCREFS_DONE u0000000000000000 no match [ 1559.765616] binder: unexpected work type, 4, not freed [ 1559.765619] binder: undelivered TRANSACTION_COMPLETE [ 1559.766116] binder: release 13390:13391 transaction 1575 out, still active [ 1559.766120] binder: unexpected work type, 4, not freed 08:14:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000000c0)) wait4(0x0, 0x0, 0x80000000, 0x0) 08:14:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="0015040010b6487b"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000014, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) getsockopt$inet_tcp_buf(r2, 0x6, 0x1e, &(0x7f0000000080)=""/98, &(0x7f0000000100)=0x62) [ 1559.766123] binder: undelivered TRANSACTION_COMPLETE [ 1559.766363] binder: 13404:13409 transaction failed 29201/-14, size 24-8 line 3155 [ 1559.777283] binder: undelivered TRANSACTION_ERROR: 29201 [ 1559.820336] binder: undelivered TRANSACTION_ERROR: 29201 [ 1559.841587] binder: 13422:13423 got transaction with invalid data ptr [ 1559.850881] binder: 13410:13412 got transaction with invalid offset (-5266755544965775360, min 0 max 24) or object. [ 1559.854997] binder: 13415:13417 got transaction with invalid data ptr [ 1559.855063] binder: 13415:13417 transaction failed 29201/-14, size 24-8 line 3155 [ 1559.856205] binder: undelivered TRANSACTION_ERROR: 29201 [ 1559.872694] binder: 13416:13419 BC_INCREFS_DONE node 1592 has no pending increfs request [ 1559.872856] binder: 13416:13419 ioctl c0306201 0 returned -14 08:14:10 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:10 executing program 3: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0xc, 0x0, &(0x7f0000000280)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1559.897105] binder: release 13416:13419 transaction 1591 out, still active [ 1559.909477] binder: 13410:13418 unknown command 0 [ 1559.923571] binder: 13410:13427 ioctl c0306201 0 returned -14 [ 1559.924703] binder: 13410:13418 ioctl c0306201 200002c0 returned -22 [ 1559.928338] binder: unexpected work type, 4, not freed [ 1559.928341] binder: undelivered TRANSACTION_COMPLETE 08:14:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000000)={0x9, 0xe69}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1559.947069] binder: 13422:13426 BC_INCREFS_DONE u0000000000000000 no match [ 1559.953739] binder: 13422:13423 transaction failed 29201/-14, size 24-8 line 3155 [ 1559.962074] binder: 13410:13412 transaction failed 29201/-22, size 24-8 line 3199 [ 1559.976513] binder: 13410:13412 got transaction with invalid offset (-5266755544965775360, min 0 max 24) or object. [ 1559.991268] binder: 13422:13423 ioctl c0306201 0 returned -14 [ 1560.009556] binder: 13410:13438 ioctl c0306201 0 returned -14 [ 1560.016429] binder: 13410:13412 transaction failed 29201/-22, size 24-8 line 3199 [ 1560.030918] binder: undelivered TRANSACTION_ERROR: 29201 [ 1560.057989] binder: 13439:13440 BC_INCREFS_DONE node 1599 has no pending increfs request [ 1560.065970] binder: 13439:13443 ioctl c0306201 0 returned -14 [ 1560.076440] binder: 13420:13429 BC_INCREFS_DONE u0000000000000000 no match [ 1560.083303] binder: release 13439:13440 transaction 1598 out, still active [ 1560.083309] binder: unexpected work type, 4, not freed [ 1560.083311] binder: undelivered TRANSACTION_COMPLETE [ 1560.104768] binder: 13420:13429 ioctl c0306201 0 returned -14 [ 1560.112429] binder: release 13420:13421 transaction 1594 out, still active [ 1560.120087] binder: unexpected work type, 4, not freed [ 1560.127779] binder: undelivered TRANSACTION_COMPLETE 08:14:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TIOCGLCKTRMIOS(r2, 0x5456, &(0x7f0000000040)={0xc8a, 0xd54, 0x7639, 0xff, 0x3, 0x160, 0x7, 0x80000001, 0x9699, 0x40, 0x7fff, 0x7}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:11 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="0015040010b6487b"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000014, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) listxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/130, 0x82) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) accept$inet(r2, &(0x7f0000000400)={0x2, 0x0, @dev}, &(0x7f0000000180)=0x10) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) mkdirat(r2, &(0x7f0000000380)='./file1\x00', 0x29) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) socket$nl_xfrm(0x10, 0x3, 0x6) 08:14:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000000c0)) wait4(0x0, 0x0, 0x80000000, 0x0) 08:14:11 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1560.398043] binder: undelivered TRANSACTION_ERROR: 29201 [ 1560.437082] binder: BINDER_SET_CONTEXT_MGR already set 08:14:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x2000, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="52a2c6eb05000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:11 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1560.449292] binder: 13447:13453 got transaction with invalid data ptr [ 1560.452255] binder: 13450:13455 BC_INCREFS_DONE node 1603 has no pending increfs request [ 1560.452382] binder: 13450:13455 ioctl c0306201 0 returned -14 [ 1560.473360] binder: 13449:13451 ioctl 40046207 0 returned -16 [ 1560.494028] binder: 13447:13461 BC_INCREFS_DONE u0000000000000000 no match [ 1560.503458] binder: 13456:13462 got transaction with invalid offset (0, min 0 max 0) or object. [ 1560.516210] binder: 13449:13459 BC_INCREFS_DONE node 1607 has no pending increfs request [ 1560.516248] binder: 13447:13464 ioctl c0306201 0 returned -14 [ 1560.521262] binder: 13463:13468 BC_INCREFS_DONE u0000000000000000 node 1610 cookie mismatch 00000005ebc6a252 != 0000000000000000 [ 1560.521381] binder: 13463:13468 ioctl c0306201 0 returned -14 08:14:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000000c0)) 08:14:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8000, 0x0) ioctl$HDIO_GETGEO(r2, 0x301, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="0015040010b6487b"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000014, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:11 executing program 3: r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@ethernet={0x0, @dev}, &(0x7f0000000080)=0x80) recvfrom$inet6(r0, &(0x7f00000000c0)=""/213, 0xd5, 0x10020, &(0x7f0000000380)={0xa, 0x4e21, 0x6, @empty}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="0100008000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f00000003c0)) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:11 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1560.532199] binder: 13456:13462 transaction failed 29201/-22, size 0-8 line 3199 [ 1560.537359] binder: 13447:13453 transaction failed 29201/-14, size 24-8 line 3155 [ 1560.563692] binder: undelivered TRANSACTION_ERROR: 29201 [ 1560.565198] binder: 13470:13471 BC_INCREFS_DONE u0000000000000000 no match [ 1560.565324] binder: 13470:13471 ioctl c0306201 0 returned -14 [ 1560.567450] binder: 13449:13451 ioctl c0306201 0 returned -14 08:14:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f00000000c0)=0x1) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="86b95b1e97ca9dc0fbdcf8c121cd36dbed14308b15df505a0b9979", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BLKTRACESTOP(r2, 0x1275, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)) wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1560.630773] binder: 13473:13480 got transaction with invalid offset (0, min 0 max 0) or object. [ 1560.653226] binder: 13475:13478 got transaction with invalid data ptr [ 1560.668237] binder: 13474:13479 BC_INCREFS_DONE u0000000000000000 node 1617 cookie mismatch 0000000000000000 != 0000000080000001 08:14:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x50003, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000004000000000000000800000000000000000000000000000091f5ec95415be4dbacd6a5bfd5d1540a8692a7d19acf8fe68e2d4c68ac1cf9ae7f0e66093c631b9e80342799292ca4ec77810c74c67d9383392f5c825479569dbbb884eb3f9e6501b533896b509947f4b39d5727b1df5fbdb3b3e1b165ebeb38d5e3a5da207c3689626527291df184300d11a133a573cd257b1ee0ad1dd53856c5551fd53b83a6", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1560.669014] binder: 13474:13483 ioctl c0306201 0 returned -14 [ 1560.681358] binder: 13473:13480 transaction failed 29201/-22, size 0-8 line 3199 [ 1560.707126] binder: 13475:13485 BC_INCREFS_DONE u0000000000000000 no match [ 1560.711200] binder: 13475:13478 transaction failed 29201/-14, size 24-8 line 3155 [ 1560.712513] binder: undelivered TRANSACTION_ERROR: 29201 08:14:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() 08:14:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2000001, 0x0, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x20000e84) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="0000000000000004"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(r0, r0) [ 1560.712600] binder: release 13450:13455 transaction 1602 out, still active [ 1560.712605] binder: unexpected work type, 4, not freed [ 1560.712607] binder: undelivered TRANSACTION_COMPLETE [ 1560.712822] binder: release 13463:13468 transaction 1609 out, still active [ 1560.712826] binder: unexpected work type, 4, not freed [ 1560.712829] binder: undelivered TRANSACTION_COMPLETE [ 1560.737471] binder: 13490:13491 BC_INCREFS_DONE u0000000000000000 no match [ 1560.737588] binder: 13490:13491 ioctl c0306201 0 returned -14 [ 1560.755459] binder: release 13490:13491 transaction 1620 out, still active [ 1560.755465] binder: unexpected work type, 4, not freed [ 1560.755468] binder: undelivered TRANSACTION_COMPLETE [ 1560.774503] binder: 13475:13478 ioctl c0306201 0 returned -14 [ 1560.803974] binder: 13493:13498 BC_INCREFS_DONE u0000000000000000 node 1624 cookie mismatch 0400000000000000 != 0000000000000000 [ 1560.815788] binder: 13489:13495 ioctl 40086607 200000c0 returned -22 [ 1560.825271] binder: 13493:13499 ioctl c0306201 0 returned -14 [ 1560.833209] binder: 13489:13495 unknown command 509327750 [ 1560.834090] binder: 13493:13501 BC_INCREFS_DONE u0000000000000000 no match [ 1560.834187] binder: 13499:13499 ioctl c0306201 0 returned -14 [ 1560.836299] binder: 13486:13497 got transaction with invalid data ptr [ 1560.836371] binder: 13486:13497 transaction failed 29201/-14, size 4-8 line 3155 [ 1560.838856] binder: undelivered TRANSACTION_ERROR: 29201 [ 1560.860866] binder: 13504:13505 got transaction with invalid data ptr 08:14:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="0015040010b6487b"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000014, 0x0) socket$nl_route(0x10, 0x3, 0x0) 08:14:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="0015040010b6487b"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000014, 0x0) 08:14:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="0015040010b6487b"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() 08:14:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) perf_event_open$cgroup(&(0x7f0000000040)={0x1, 0x70, 0x3, 0x3, 0x5, 0x6, 0x0, 0x6, 0x4000, 0x4, 0x5, 0x0, 0x200, 0x0, 0x4933, 0x7ff, 0x1, 0x8, 0x200, 0x2a, 0x20000000000000, 0x0, 0x9, 0x20, 0x1, 0x8000, 0x6, 0xb7, 0x4, 0x3, 0x8, 0x8, 0x7, 0x80000000, 0x4, 0x55, 0x712, 0x1, 0x0, 0x0, 0x6, @perf_bp={&(0x7f0000000000), 0x9}, 0x0, 0x0, 0xffffffffffffee34, 0x9, 0x4, 0x4, 0xfffffffffffffff9}, 0xffffffffffffff9c, 0x8, 0xffffffffffffff9c, 0xa) openat$keychord(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/keychord\x00', 0x180, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x80000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001ff) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_void(r2, 0x1, 0x1b, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1560.861039] binder: 13504:13505 transaction failed 29201/-14, size 24-8 line 3155 [ 1560.862515] binder: 13504:13505 ioctl c0306201 0 returned -14 [ 1560.882055] binder: undelivered TRANSACTION_ERROR: 29201 [ 1560.886168] binder: 13507:13508 got transaction with invalid data ptr [ 1560.886235] binder: 13507:13508 transaction failed 29201/-14, size 24-8 line 3155 [ 1560.887909] binder: 13507:13508 ioctl c0306201 0 returned -14 [ 1560.905786] binder: undelivered TRANSACTION_ERROR: 29201 08:14:12 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1560.936130] binder: 13489:13511 ioctl c0306201 0 returned -14 [ 1560.964082] binder: 13510:13513 got transaction with invalid data ptr [ 1560.972644] binder: 13516:13517 BC_INCREFS_DONE node 1636 has no pending increfs request 08:14:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="0015040010b6487b"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 08:14:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB='\v*bs\x00\x00 \x00', @ANYRES64=0x0, @ANYBLOB="00000e000e002937285e4ead4e089dbbc623f73ee0306af0d85d13792414c85e920d7ca7bab5620829c7aaf5829e8a26da04c4ece2fa6717c0756f06345c513bd76ff108bcf8d4ec4ec69bd97567311531a7e663f2f68fd4f5ecfdde97a50fdcc23b4e82f276a6539a94b444e0025fa4bb00e05c05042f83c56b866730045d9a0888cfe75c120ad944"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="c8c2518871800000"]], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="4b43c75089d710dbc4406f00ee013a8063e6e726ad5e358c3db85d", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) lsetxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64IPIN\x00', &(0x7f0000000080)='/dev/binder#\x00', 0xd, 0x1) lsetxattr$security_selinux(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='security.selinux\x00', &(0x7f0000000140)='/usr/sbin/cupsd\x00', 0x10, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000440)) 08:14:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() r4 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000040)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="000227bd7000fbdbdf250100000014000100210200000000f80300000000000000010800020007000000"], 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x40004) wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1560.983398] binder: 13516:13519 ioctl c0306201 0 returned -14 [ 1560.989491] binder: 13510:13513 transaction failed 29201/-14, size 24-8 line 3155 [ 1561.002408] binder: release 13516:13517 transaction 1635 out, still active [ 1561.004464] binder: 13510:13513 ioctl c0306201 0 returned -14 [ 1561.009570] binder: 13489:13495 ioctl c0306201 200002c0 returned -22 [ 1561.024252] binder: 13523:13524 BC_INCREFS_DONE u0000000000000000 no match 08:14:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 1561.032890] binder: 13523:13525 ioctl c0306201 0 returned -14 08:14:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1561.057813] binder: 13514:13527 got transaction with invalid offset (0, min 0 max 0) or object. [ 1561.083352] binder: 13514:13527 transaction failed 29201/-22, size 0-8 line 3199 [ 1561.097611] binder: 13530:13532 got transaction with invalid data ptr [ 1561.112521] binder: 13514:13527 got transaction with invalid offset (0, min 0 max 0) or object. [ 1561.123384] binder: 13533:13536 got transaction with invalid offset (141225106719432, min 0 max 24) or object. [ 1561.141927] binder: 13535:13538 got transaction with invalid data ptr [ 1561.142717] binder: 13530:13532 transaction failed 29201/-14, size 24-8 line 3155 [ 1561.144879] binder: 13530:13532 ioctl c0306201 0 returned -14 [ 1561.145230] binder: unexpected work type, 4, not freed [ 1561.145233] binder: undelivered TRANSACTION_COMPLETE [ 1561.145471] binder: release 13489:13495 transaction 1626 out, still active [ 1561.145476] binder: unexpected work type, 4, not freed [ 1561.145478] binder: undelivered TRANSACTION_COMPLETE [ 1561.145807] binder: undelivered TRANSACTION_ERROR: 29201 [ 1561.154007] binder: 13514:13527 transaction failed 29201/-22, size 0-8 line 3199 [ 1561.154955] binder: undelivered TRANSACTION_ERROR: 29201 08:14:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="0015040010b6487b"], 0x0, 0x0, 0x0}) 08:14:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r1, 0x9, 0xb1708f740, &(0x7f0000000000)="f571133d63f2d8e9163f43c27cb3bed796de307cfce3a03aea28c685454df0f7", 0x20) r2 = accept(r1, &(0x7f0000000900)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, &(0x7f0000000980)=0x80) ioctl$sock_ifreq(r2, 0x891d, &(0x7f00000009c0)={'erspan0\x00', @ifru_names='ip6gretap0\x00'}) writev(r2, &(0x7f0000000040), 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="80000000000000000000000000000000000000d410000000000000000034a4930558eb1b0088307b7712881706c865f5be0000000800e802541bd32e724fb28845099bacf5e1468d2425dd272bfb9a51a47979fb0428c381ac14e100000000ffffffff057e", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x78, 0x0, &(0x7f0000000140)=[@dead_binder_done={0x40086310, 0x4}, @enter_looper, @acquire={0x40046305, 0x4}, @reply_sg={0x40486312, {{0x1, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x18, 0x28, &(0x7f00000000c0)=[@fd={0x66642a85, 0x0, r3, 0x0, 0x3}], &(0x7f0000000100)=[0x78, 0x0, 0x78, 0x48, 0x48]}, 0x2}}, @decrefs={0x40046307, 0x2}, @exit_looper, @increfs={0x40046304, 0x1}], 0x87, 0x0, &(0x7f0000000280)="6da88b7eb349b4a2ef08f403f00a92ce162f101ac2c90e5d160f7d0e337ad970c2b7d38f2f38379309ef4abcd46a96232c00fb29a49a47de0621045b9d82bf6249cff450ea2315d0f61404edf80c5aa98eca4d7f175def5010e6ab1054c9a33b141573ffbb96a8b7ae5876022ba4a5a2813fd7e28af44774c52f22f983070224ebbcb2f5e796f0"}) 08:14:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) [ 1561.155029] binder: undelivered TRANSACTION_ERROR: 29201 [ 1561.178887] binder: undelivered TRANSACTION_ERROR: 29201 [ 1561.191782] binder: 13533:13536 transaction failed 29201/-22, size 24-8 line 3199 [ 1561.221462] binder: 13533:13536 ioctl c0306201 0 returned -14 [ 1561.226174] binder: 13542:13544 got transaction with invalid data ptr [ 1561.226388] binder: 13542:13544 transaction failed 29201/-14, size 24-8 line 3155 08:14:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000080)={0x100000001, 0x0, 0x2, 0x7fffffff}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="086310408518cc732281e2b884571001f8c45289fcb6e82e52986266d0983912c517231a6bbb6ac52b0e3d50145faac3b552dd724b4929d76f3409b550397ea279bc8172594347f38881c4f6ecaed151a099484f99ea772c3d7b", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) fstat(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getgid() fchown(r2, r4, r5) [ 1561.260594] binder: 13534:13537 BC_INCREFS_DONE node 1649 has no pending increfs request [ 1561.275486] binder: 13534:13549 ioctl c0306201 0 returned -14 [ 1561.286604] binder: undelivered TRANSACTION_ERROR: 29201 [ 1561.294975] binder: 13551:13553 got transaction with invalid data ptr [ 1561.298968] binder: 13545:13548 unknown command 128 [ 1561.298982] binder: 13545:13548 ioctl c0306201 200001c0 returned -22 08:14:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0xb56d) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, 0x400) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$TUNSETVNETLE(r3, 0x400454dc, &(0x7f0000000040)) [ 1561.299060] binder: 13545:13548 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 1561.299073] binder: 13545:13548 Acquire 1 refcount change on invalid ref 4 ret -22 [ 1561.299081] binder: 13545:13548 got reply transaction with no transaction stack [ 1561.299091] binder: 13545:13548 transaction failed 29201/-71, size 24-40 line 2922 [ 1561.303566] binder: undelivered TRANSACTION_ERROR: 29201 [ 1561.353205] binder: 13555:13556 ioctl 401845c0 20000080 returned -22 08:14:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2f, &(0x7f0000000380)={0x80, {{0xa, 0x4e21, 0x1000, @remote, 0xffff}}, {{0xa, 0x200, 0x80000000, @mcast2, 0x9}}}, 0x108) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) init_module(&(0x7f0000000000)='security.selinux\x00', 0x11, &(0x7f0000000040)='security.selinux\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) [ 1561.366696] binder: release 13534:13537 transaction 1648 out, still active [ 1561.373401] binder: 13551:13553 transaction failed 29201/-14, size 24-8 line 3155 [ 1561.373729] binder: 13535:13538 transaction failed 29201/-14, size 24-8 line 3155 08:14:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/checkreqprot\x00', 0x400000, 0x0) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000180)={@empty, @rand_addr=0x5}, 0x8) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNGETFILTER(0xffffffffffffff9c, 0x801054db, &(0x7f00000000c0)=""/14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000003ae92d90d40483ea81116047f9baba64f95d5c6a9197a91385c7d66cbad0d7"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) getsockopt$IP6T_SO_GET_REVISION_TARGET(r3, 0x29, 0x45, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f0000000080)=0x1e) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) gettid() fcntl$F_SET_RW_HINT(r3, 0x40c, &(0x7f0000000100)) dup2(0xffffffffffffffff, 0xffffffffffffffff) nanosleep(&(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000380)) [ 1561.430770] binder: 13557:13566 got transaction with invalid offset (0, min 0 max 0) or object. [ 1561.431981] binder: 13555:13561 BC_INCREFS_DONE ub8e2812273cc1885 no match [ 1561.456110] binder: 13565:13570 got transaction with invalid data ptr [ 1561.473107] binder: 13565:13570 transaction failed 29201/-14, size 24-8 line 3155 08:14:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1561.474827] binder: 13560:13568 BC_INCREFS_DONE node 1659 has no pending increfs request [ 1561.475246] binder: 13560:13568 ioctl c0306201 0 returned -14 [ 1561.482992] binder: 13564:13571 got transaction with invalid data ptr [ 1561.483041] binder: 13564:13571 transaction failed 29201/-14, size 24-8 line 3155 [ 1561.510907] binder: 13557:13566 transaction failed 29201/-22, size 0-8 line 3199 [ 1561.522193] binder: unexpected work type, 4, not freed [ 1561.528258] binder: undelivered TRANSACTION_COMPLETE [ 1561.540343] binder: undelivered TRANSACTION_ERROR: 29201 [ 1561.546567] binder: undelivered TRANSACTION_ERROR: 29201 [ 1561.552953] binder: release 13560:13568 transaction 1658 out, still active [ 1561.560248] binder: unexpected work type, 4, not freed [ 1561.565854] binder: undelivered TRANSACTION_COMPLETE [ 1561.574721] binder: 13574:13578 BC_INCREFS_DONE node 1663 has no pending increfs request [ 1561.580437] binder: 13574:13582 ioctl c0306201 0 returned -14 [ 1561.586807] binder: 13581:13583 got transaction with invalid data ptr [ 1561.586872] binder: 13581:13583 transaction failed 29201/-14, size 24-8 line 3155 [ 1561.614509] binder: undelivered TRANSACTION_ERROR: 29201 [ 1561.620213] binder: release 13574:13578 transaction 1662 out, still active [ 1561.627517] binder: unexpected work type, 4, not freed [ 1561.632924] binder: undelivered TRANSACTION_COMPLETE [ 1561.638209] binder: undelivered TRANSACTION_ERROR: 29201 [ 1561.644089] binder: release 13555:13561 transaction 1653 out, still active [ 1561.665137] binder: unexpected work type, 4, not freed [ 1561.670891] binder: undelivered TRANSACTION_COMPLETE [ 1561.676223] binder: undelivered TRANSACTION_ERROR: 29201 08:14:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="f0620060c860d7bcc2e354def1538bf87963f4a3a7a6aba58f1875790d5b7aa4093e905a93d400aec3e3b64bea0a288465caacb77ff060478fd59d0bb93c27837692198d677aa152d669eaf9df0fe124ad9cac37a052cc1f12870d08b348a3dd72354a1fa5b23ae7a63cae3ed171e0867336232b12497710e322dac8fae13c0b6cc134cc68825f69d76c7e841f5d941c022b5a694d75c3c617c281c58ee9240e2b9db378801f791eddd60b932c0313aaf70314bb7d975724f46f1cf409bc81d07b5fdd355ef930c487f4b9a617045640aa1a51ffb1922e729061c06c8e6a6472d24a029bfab1535ff9a060d4455f117fca1bf22fa43e1670661e3b33249b61a0ab705aa26b23c971aab8281fba655a341913256479889153a1d20dc20c5fc53db3a0f03502987e0bfe65fc0672f084620bfadc3b321d2a3d511bff5e8b022494c945f14b4f00c6e9ae644021c90973c065c4246363e296b3b2251eac640f9014e0cf568ae12a96ce53e2e9437336c49ffdcf0c074dce9aa3c1390b63a382a95cf6e23aa3ba4d645d14f98369c6ef9892509b85fbe542f01f2bd1ea15c5d65503a1b138e5a5eceb816084b76b6c6148cd5fbf62bd872393c2edc29e8b70bbb5325d887e5e9e3f0b4a49508833aca072f05e25da1fe6d2acf466edc6d1633acc6ec74eb33c7718d1bdd0b6924ce9749ecc5f704aa2ac32dd3c33d3a2bf2b60", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r4 = gettid() wait4(r4, 0x0, 0x7ffffffe, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000040)=0x1e) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f00000000c0)={0x4, 0x3, 0x4a3, 0x8, 0x13, 0x9, 0x0, 0x6, 0x4, 0x446, 0x1, 0x5}) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000100)={0x5, 0x5, 0x8, 0x0, 0xf, 0x9, 0x80000000, 0x4, 0x4, 0x0, 0x2, 0x100000001}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) 08:14:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="03000c4071cd11aeeea8ae18d3ad30b320fc457a99e33a746c2a16007964cb925e902f712fcf45e0ea5619f316e93de4bc5afd6d320aae314790fe08a991302e34a179ea0353c84f16cfed7753b0ce478ee7e4e0130752717a4565d954ee42632c96eb7569d5ffb52698b96039f91d1f4cb6c23b2c4d4cc1", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1561.682588] binder: release 13523:13524 transaction 1639 out, still active [ 1561.686328] binder: 13586:13587 BC_INCREFS_DONE u0000000000000000 no match [ 1561.686451] binder: 13586:13587 ioctl c0306201 0 returned -14 [ 1561.718820] binder: 13590:13593 unknown command 1610638064 [ 1561.724508] binder: 13590:13593 ioctl c0306201 200002c0 returned -22 [ 1561.731301] binder: 13592:13595 got transaction with invalid data ptr [ 1561.736140] binder: 13594:13596 unknown command 1074528259 [ 1561.736151] binder: 13594:13596 ioctl c0306201 200002c0 returned -22 [ 1561.736258] binder: 13594:13596 ioctl c0306201 0 returned -14 [ 1561.739239] binder: BINDER_SET_CONTEXT_MGR already set [ 1561.739247] binder: 13591:13598 ioctl 40046207 0 returned -16 [ 1561.741739] binder: 13591:13598 got transaction with invalid offset (0, min 0 max 0) or object. 08:14:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x71, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 1561.741788] binder: 13591:13598 transaction failed 29201/-22, size 0-8 line 3199 [ 1561.745982] binder: 13589:13599 got transaction with invalid data ptr [ 1561.746050] binder: 13589:13599 transaction failed 29201/-14, size 24-8 line 3155 [ 1561.799655] binder: unexpected work type, 4, not freed [ 1561.805082] binder: undelivered TRANSACTION_COMPLETE [ 1561.811947] binder: 13590:13606 ioctl c0306201 0 returned -14 [ 1561.813061] binder: 13594:13596 unknown command 1074528259 [ 1561.813069] binder: 13594:13596 ioctl c0306201 200002c0 returned -22 08:14:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="008a55000000000041428d357563d82545bbd596317441c0e9a7ef1c74b1c830d9fbc9db3a80dc355ba9094818223eb40c767ff2e66bd75a7c3ffb2b598bd234"]], 0x0, 0x0, &(0x7f00000003c0)}) [ 1561.813149] binder: 13594:13601 ioctl c0306201 0 returned -14 [ 1561.815274] binder: undelivered TRANSACTION_ERROR: 29201 [ 1561.815424] binder: release 13586:13587 transaction 1666 out, still active [ 1561.815428] binder: unexpected work type, 4, not freed [ 1561.815431] binder: undelivered TRANSACTION_COMPLETE [ 1561.815823] binder: 13607:13608 unknown command 0 [ 1561.815832] binder: 13607:13608 ioctl c0306201 200001c0 returned -22 [ 1561.820141] binder: 13592:13595 transaction failed 29201/-14, size 24-8 line 3155 [ 1561.823048] binder: undelivered TRANSACTION_ERROR: 29201 08:14:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) fcntl$getownex(r2, 0x10, &(0x7f0000000180)={0x0, 0x0}) ptrace$getsig(0x4202, r4, 0x1f, &(0x7f0000000080)) rt_sigpending(&(0x7f0000000000), 0x8) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() setsockopt$sock_int(r2, 0x1, 0x3f, &(0x7f0000000100)=0x401, 0x4) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="dc468a56", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1561.884965] binder: 13612:13613 got transaction with invalid offset (5605888, min 0 max 0) or object. [ 1561.906761] binder: release 13594:13596 transaction 1678 out, still active [ 1561.921016] binder: 13611:13614 got transaction with invalid data ptr [ 1561.929015] binder: unexpected work type, 4, not freed [ 1561.940250] binder: undelivered TRANSACTION_COMPLETE [ 1561.946053] binder: 13611:13614 transaction failed 29201/-14, size 24-8 line 3155 [ 1561.956024] binder: 13612:13613 transaction failed 29201/-22, size 0-8 line 3199 [ 1561.956060] binder: 13605:13615 got transaction with invalid data ptr [ 1561.956102] binder: 13605:13615 transaction failed 29201/-14, size 24-8 line 3155 [ 1561.984414] binder: 13617:13620 BC_INCREFS_DONE node 1685 has no pending increfs request [ 1561.990006] binder: release 13594:13596 transaction 1672 out, still active [ 1561.990011] binder: unexpected work type, 4, not freed [ 1561.990014] binder: undelivered TRANSACTION_COMPLETE [ 1561.990317] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.017658] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.020398] binder: 13619:13622 unknown command 1451902684 [ 1562.020407] binder: 13619:13622 ioctl c0306201 200002c0 returned -22 [ 1562.022699] binder: 13617:13624 ioctl c0306201 0 returned -14 [ 1562.026908] binder: 13625:13625 unknown command 1451902684 [ 1562.026917] binder: 13625:13625 ioctl c0306201 200002c0 returned -22 [ 1562.057994] binder: release 13617:13620 transaction 1684 out, still active [ 1562.080604] binder: unexpected work type, 4, not freed 08:14:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x200000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000000)={0x0, r1, 0x85, 0x7, 0x2, 0x4}) 08:14:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = accept(0xffffffffffffff9c, &(0x7f0000000000)=@vsock, &(0x7f0000000080)=0x80) setsockopt$packet_buf(r2, 0x107, 0x0, &(0x7f00000000c0)="af1e612630df7eea7c7324bb9c58838b30aa662092df9d56cc23b734d85d630c54fadcc2172136a10636f153139df60c30304343fa59b6ed000c169b53dd90fa576abb6a0a014017b1d2e89c840cf0747d836f3ce9fe075eb46389977afc4d335538d84ba3b58535", 0x68) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r3, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1562.086462] binder: undelivered TRANSACTION_COMPLETE [ 1562.102793] binder: 13628:13629 BC_INCREFS_DONE u0000000000000000 no match [ 1562.112897] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.119608] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.148454] binder: 13636:13640 got transaction with invalid data ptr [ 1562.155793] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1562.164414] binder: release 13628:13629 transaction 1690 out, still active [ 1562.171939] binder: unexpected work type, 4, not freed [ 1562.178025] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1562.183763] binder: undelivered TRANSACTION_COMPLETE [ 1562.192586] binder: 13637:13641 transaction failed 29201/-28, size 24-8 line 3137 [ 1562.193005] binder: 13638:13644 got transaction with invalid offset (0, min 0 max 0) or object. [ 1562.193095] binder: 13638:13644 transaction failed 29201/-22, size 0-8 line 3199 [ 1562.193266] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1562.193276] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1562.193336] binder: 13635:13643 transaction failed 29201/-28, size 24-8 line 3137 [ 1562.193533] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1562.193542] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1562.193620] binder: 13639:13642 transaction failed 29201/-28, size 24-8 line 3137 [ 1562.194378] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.194800] binder: 13638:13644 ioctl c028660f 20000000 returned -22 [ 1562.217406] binder: 13639:13642 ioctl c0306201 0 returned -14 [ 1562.239701] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.281140] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0xfffffffffffffffe, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="dd00000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) flock(r2, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB='(A>4p\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) lstat(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)) r4 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) request_key(&(0x7f0000000380)='cifs.idmap\x00', &(0x7f00000003c0)={'syz', 0x1}, &(0x7f0000000400)='\x00', r4) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)="9025a5e8ec75631e54811827e5491445bcc57dc268f8457e8f9c40ebdfb6b07233344847b390591c5640e2fc9deb7aa4d6a2defdfef0f33c6c317da0fd304dfae4f6f29641c70958a50179335fd1530210cb984e8192b471e69a6e7053f2ba079d68aa2f3b3cd26ac9d3505fd096f8c2d00fabdbccc1d8a411138db4733f656fa0a836d9c55dc17736759ec6dce267f62a4342784fc9e099deedc71616cd5e7f0d28e39cba272cb53ef4a04bf60c902b116d", 0xb2, r4) gettid() chdir(&(0x7f0000000440)='./file0\x00') dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x400000, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000040)) getsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x3) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r2, 0xc0c0583b, &(0x7f0000000380)={0x0, 0x0, 0x7, 0x0, [], [{0x65, 0x1, 0x10001, 0x100, 0x8, 0x100}, {0x81, 0x4, 0x4, 0xfffffffffffffedc, 0xae9b, 0x6}], [[], [], [], [], [], [], []]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$UI_END_FF_ERASE(r2, 0x400c55cb, &(0x7f0000000040)={0x1, 0x3ff, 0x411}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$RTC_ALM_READ(r2, 0x80247008, &(0x7f0000000180)) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280)='TIPC\x00') r4 = getpgid(0xffffffffffffffff) fcntl$lock(r2, 0x27, &(0x7f0000000080)={0x2, 0x4, 0xffffffffffffff80, 0x5, r4}) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x26, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000814}, 0x20000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="0500176100000b00"]], 0x0, 0x0, &(0x7f00000003c0)}) [ 1562.281149] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1562.281198] binder: 13649:13654 transaction failed 29201/-28, size 24-8 line 3137 [ 1562.281413] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.284444] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1562.284452] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1562.284500] binder: 13651:13655 transaction failed 29201/-28, size 24-8 line 3137 [ 1562.291704] binder: 13651:13655 ioctl c0306201 0 returned -14 [ 1562.303589] binder: 13653:13656 got transaction with invalid offset (0, min 0 max 0) or object. [ 1562.303978] binder: 13653:13656 transaction failed 29201/-22, size 0-8 line 3199 [ 1562.344375] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.370568] binder: 13636:13640 transaction failed 29201/-14, size 24-8 line 3155 [ 1562.376453] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.384962] binder: 13637:13661 BC_INCREFS_DONE u0000000000000000 no match [ 1562.396730] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.397403] binder: 13637:13658 ioctl c0306201 0 returned -14 [ 1562.419970] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1562.440149] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.449353] binder: 13664:13669 transaction failed 29189/-22, size 24-8 line 3014 [ 1562.450300] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1562.450349] binder: 13660:13662 transaction failed 29201/-28, size 24-8 line 3137 [ 1562.461293] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.461333] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.488386] binder: 13666:13672 got transaction with invalid offset (3096226372714501, min 0 max 0) or object. 08:14:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xfffffffffffffe6d, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="000000000000f600"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000000)={0x0, r3, 0x1, 0xffff, 0x0, 0x1}) dup2(r0, r2) [ 1562.496802] binder: 13645:13646 BC_INCREFS_DONE u0000000000000000 no match [ 1562.500600] binder: 13664:13669 ioctl c0306201 0 returned -14 [ 1562.501331] binder: release 13645:13646 transaction 1698 out, still active [ 1562.501337] binder: unexpected work type, 4, not freed [ 1562.501340] binder: undelivered TRANSACTION_COMPLETE [ 1562.505351] binder: undelivered TRANSACTION_ERROR: 29189 [ 1562.540022] binder: 13666:13672 transaction failed 29201/-22, size 0-8 line 3199 08:14:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="00000019e3e24480100c2ab189903ca7e16a6d86205640ac5759cebfd9fc216428"]], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r4 = getpgrp(0x0) ioctl$TIOCSPGRP(r2, 0x5410, &(0x7f0000000000)=r4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$LOOP_SET_CAPACITY(r2, 0x4c07) fcntl$setown(r0, 0x8, r4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1562.566382] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1562.580558] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.582778] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1562.582843] binder: 13678:13681 transaction failed 29201/-28, size 24-8 line 3137 [ 1562.584504] binder: 13678:13681 ioctl c0306201 0 returned -14 08:14:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1562.616323] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1562.628746] binder: 13679:13688 ioctl c0306201 0 returned -14 [ 1562.630927] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1562.631153] binder: 13677:13683 transaction failed 29201/-28, size 24-8 line 3137 [ 1562.651487] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1562.670515] binder: 13679:13689 ioctl c028660f 20000000 returned -22 [ 1562.679871] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1562.692158] binder: 13679:13684 transaction failed 29201/-28, size 24-8 line 3137 [ 1562.692250] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1562.692261] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1562.692321] binder: 13680:13682 transaction failed 29201/-28, size 24-8 line 3137 [ 1562.692515] binder: 13686:13693 got transaction with invalid offset (-9203982273433567232, min 0 max 0) or object. [ 1562.692564] binder: 13686:13693 transaction failed 29201/-22, size 0-8 line 3199 [ 1562.692855] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1562.692874] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1562.692920] binder: 13690:13692 transaction failed 29201/-28, size 24-8 line 3137 08:14:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8000000000a) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000040)) 08:14:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1562.713333] binder: 13690:13692 ioctl c0306201 0 returned -14 [ 1562.747681] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1562.747693] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1562.747741] binder: 13696:13697 transaction failed 29201/-28, size 24-8 line 3137 [ 1562.791282] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1562.791299] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1562.792060] binder: 13701:13704 got transaction with invalid offset (0, min 0 max 0) or object. [ 1562.792109] binder: 13701:13704 transaction failed 29201/-22, size 0-8 line 3199 [ 1562.792248] binder: 13700:13703 transaction failed 29201/-28, size 24-8 line 3137 [ 1562.839261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.850579] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.856127] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.876997] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1562.891155] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.896717] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.902944] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1562.913078] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.919001] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1562.927112] binder: 13707:13710 transaction failed 29201/-28, size 24-8 line 3137 [ 1562.935953] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1562.942206] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.942594] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.958534] binder: undelivered TRANSACTION_ERROR: 29201 [ 1562.959388] binder: 13709:13711 transaction failed 29201/-28, size 24-8 line 3137 08:14:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="a5b6025e3a7495c3"]], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000000)=""/234) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0xfffffffffffffffc, 0x0) ioctl$VT_ACTIVATE(r2, 0x5606, 0x4) socket(0x10, 0xa, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000d79577d921662b610000000000000000000000000000000000000000000008000000000000000000000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x802) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = getpid() write$FUSE_LK(r2, &(0x7f0000000040)={0x28, 0xffffffffffffffda, 0x2, {{0x1f, 0x0, 0x0, r4}}}, 0x28) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000000)={0x51, 0x7fff, 0x3, {0x3, 0x9}, {0x5, 0x7}, @const={0x8, {0x8, 0x1, 0xa29, 0x100000001}}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000080)) dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$FIBMAP(r2, 0x1, &(0x7f00000000c0)=0x1) 08:14:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1562.959514] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1562.959523] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1562.959570] binder: 13715:13716 transaction failed 29201/-28, size 24-8 line 3137 08:14:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(0xffffffffffffffff, r1, 0x80000) syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x80001) openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x404000, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x101000, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x10000, 0x102) write$P9_RXATTRCREATE(r2, &(0x7f0000000200)={0x7, 0x21, 0x2}, 0x7) io_setup(0x1ad1, &(0x7f0000000180)) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x48000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x7) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="00000000000000ce"]], 0x0, 0x0, &(0x7f00000003c0)}) [ 1563.040368] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.058346] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.076654] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.082570] binder: 13721:13727 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.082686] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.082695] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.082777] binder: 13723:13728 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.083096] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.083104] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.083163] binder: 13722:13729 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.083908] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.083917] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.083963] binder: 13725:13730 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.089047] binder: 13722:13729 ioctl c0306201 0 returned -14 [ 1563.089489] binder: 13725:13730 ioctl c0306201 0 returned -14 [ 1563.163738] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000000)="baf2665b2db263e3ad4783c886031cd6eee97631073770e2c2974d4963624e9afbcbb74e24c3ee4116d68b3c8af387242ebed1190076c6f2fb94920cc899c2d12423444829d4ce4c5aa54f81566d252b5d11ea5bcc365bae6ae91485747c6bcfc9b844b89e3cdfc1426e026db6cad80788a94810675568ad47f3941b0ea718c4a55c6158fba323261b5f2380a159db0537726c41f1b0fba09cdb9b18cea5df10e7f46549a714b842b58f416ddc2b92c8865ab4aa069b", 0xb6) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$PPPIOCGNPMODE(r2, 0xc008744c, &(0x7f00000000c0)) ioctl$PPPIOCGNPMODE(r2, 0xc008744c, &(0x7f0000000100)={0x29, 0x2}) gettid() dup2(r0, r2) 08:14:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x47, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="0000000000008000dbab2f26213d8cce7ddb71f03cd8aa304d6e56c2a30a1a8993e6b49b0f8402b801f9993ed40c4539b703912037bb951a0f9bac"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1563.163746] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.164926] binder: 13740:13741 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.172507] binder: 13740:13741 ioctl c0306201 0 returned -14 [ 1563.189337] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.189346] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.189404] binder: 13742:13743 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.252175] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.258840] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.259011] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.259180] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.259296] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.261441] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.261577] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.295996] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.301571] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.312354] binder: 13746:13750 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.312928] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.312938] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.313001] binder: 13747:13753 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.313088] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.313097] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.313232] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.313240] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.313322] binder: 13749:13751 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.313398] binder: 13731:13732 got transaction with invalid offset (-3602879701896396800, min 0 max 0) or object. 08:14:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x802, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) fcntl$setstatus(r0, 0x4, 0x4400) [ 1563.313448] binder: 13731:13732 transaction failed 29201/-22, size 0-8 line 3199 [ 1563.314247] binder: 13733:13754 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.338060] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.358888] binder: 13747:13753 ioctl c0306201 0 returned -14 [ 1563.371503] binder: 13733:13760 BC_INCREFS_DONE u0000000000000000 no match [ 1563.376955] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.380801] binder: 13749:13751 ioctl c0306201 0 returned -14 [ 1563.391498] binder: undelivered TRANSACTION_ERROR: 29201 08:14:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) pipe(&(0x7f0000000000)) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1563.465652] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.473037] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.487042] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="08000000000000d3aade5b289200"]], 0x0, 0x0, &(0x7f00000003c0)}) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$SIOCGIFHWADDR(r2, 0x8927, &(0x7f0000000080)) 08:14:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1563.514879] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.515499] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.534043] binder: 13765:13774 BC_INCREFS_DONE u0000000000000000 no match [ 1563.536498] binder: 13764:13767 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.549438] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.557038] binder: 13765:13776 ioctl c0306201 0 returned -14 [ 1563.571437] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.572759] binder: 13766:13775 BC_INCREFS_DONE u0000000000000000 no match [ 1563.573214] binder: 13766:13775 ioctl c0306201 0 returned -14 [ 1563.599566] binder_alloc: 6448: binder_alloc_buf size 18014416763092992 failed, no address space [ 1563.610537] binder: 13765:13768 transaction failed 29201/-28, size 24-8 line 3137 08:14:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) r3 = gettid() ptrace$getenv(0x4201, r3, 0x4, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$IP_VS_SO_SET_DELDEST(r2, 0x0, 0x488, &(0x7f0000000040)={{0x3a, @loopback, 0x4e21, 0x4, 'none\x00', 0x5, 0x0, 0x4c}, {@multicast2, 0x4e21, 0x1, 0x0, 0x401, 0x7}}, 0x44) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="086310c0", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r5 = gettid() wait4(r5, 0x0, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = request_key(&(0x7f00000000c0)='rxrpc\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000180)='/dev/binder#\x00', 0xfffffffffffffffe) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000380)={{{@in6=@empty, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6}}, &(0x7f0000000480)=0xe8) r8 = getgid() keyctl$chown(0x4, r6, r7, r8) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1563.618686] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.628867] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.630993] binder: 13766:13769 transaction failed 29201/-28, size 9007207844675584-9007208918417408 line 3137 08:14:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) write$P9_RAUTH(r1, &(0x7f0000000000)={0x14, 0x67, 0x2, {0x17, 0x2, 0x1}}, 0x14) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r4, 0x520, 0x70bd29, 0x25dfdbff, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0x3}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x4) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:14 executing program 4: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1563.670048] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.670642] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.691240] binder: 13785:13791 BC_INCREFS_DONE u0000000000000000 no match [ 1563.693224] binder: 13777:13781 got transaction with invalid offset (-3242591731706757112, min 0 max 0) or object. [ 1563.693278] binder: 13777:13781 transaction failed 29201/-22, size 0-8 line 3199 08:14:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) pipe(&(0x7f0000000000)) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1563.693423] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.693433] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.693531] binder: 13779:13784 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.711553] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.711564] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.711680] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:14 executing program 4: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1563.711690] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.711742] binder: 13789:13790 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.713368] binder: 13789:13790 ioctl c0306201 0 returned -14 [ 1563.718277] binder: 13772:13773 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.761509] binder: 13785:13786 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.792958] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.792969] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.793017] binder: 13798:13799 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.827412] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.827471] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.827509] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.827548] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.875387] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.892445] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.899355] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1563.909921] binder: 13805:13806 transaction failed 29201/-28, size 24-8 line 3137 08:14:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) pipe(&(0x7f0000000000)) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:15 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:15 executing program 4: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f0000000000)=0x5, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0xf4890e46168a9156, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) ioctl$sock_proto_private(r1, 0x89e4, &(0x7f0000000040)="f33f6949d42cbe3b0b2af687a3e58ef9c6c989fbf10034860b88a82c56ea413017c59252e065c6625dde0c45e24adb969cdbec7967383b5dfecfde50537c319706de322c8d1165b6653d9f2661143d1f06e8c94c97d94f3b678d78f930d4179f2906eb4acb159efe7926d1f4921cf949da36f102") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair(0x3, 0x800, 0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000280)=0x14) ioctl$sock_inet6_SIOCDELRT(r3, 0x890c, &(0x7f0000000380)={@mcast1, @mcast2, @empty, 0x1ff, 0xffffffff00000001, 0x6, 0x400, 0xffffffffffffff81, 0x201, r4}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 1563.921178] binder: 13805:13806 ioctl c0306201 0 returned -14 [ 1563.938946] binder: undelivered TRANSACTION_ERROR: 29201 [ 1563.952064] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1563.965152] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="006340400000000000000000000000000005000000000000000000000000000000000000179322b86c4a18000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$LOOP_SET_DIRECT_IO(r2, 0x4c08, 0x5) dup2(0xffffffffffffffff, 0xffffffffffffffff) r4 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r2, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x5c, r4, 0x800, 0x70bd2b, 0x25dfdbfb, {}, [@SEG6_ATTR_DST={0x14, 0x1, @mcast2}, @SEG6_ATTR_SECRET={0x8, 0x4, [0x3]}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={[], [], @rand_addr=0x4}}, @SEG6_ATTR_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x21}}, @SEG6_ATTR_SECRET={0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x2400c840) r5 = dup(r2) setsockopt$IP_VS_SO_SET_EDIT(r5, 0x0, 0x483, &(0x7f0000000000)={0x2, @dev={0xac, 0x14, 0x14, 0x16}, 0x4e22, 0x1, 'sh\x00', 0x5, 0x0, 0xa}, 0x2c) 08:14:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1563.985110] binder: 13811:13812 transaction failed 29201/-28, size 24-8 line 3137 [ 1563.995714] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 1564.027280] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1564.053156] binder: undelivered TRANSACTION_ERROR: 29201 [ 1564.058091] binder: 13819:13829 BC_INCREFS_DONE u0000000000000000 no match [ 1564.058211] binder: 13819:13829 ioctl c0306201 0 returned -14 08:14:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="0000000000000000c2fe3c3b30c97d75da6e8b306b612935949e3ec3c6d37c2c1197351329c1ffff67cead601120178e5648a1ca37e0bff2b387b260c4b9c91af9a72afede47294c20df40cdfa0809f7fcf9616e5d66"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) prctl$PR_GET_ENDIAN(0x13, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="15cf34e673089222ab6e6a5dfe32bbfc5c123f27192a28977ece4ab739cf51ce9fad50da986e34161da0e5c03c4d46d30ff0a4f4ddb9ebfa4d117134168b1153679c7a6a4c7315499230a89a90f214a6", @ANYRES64=0x0, @ANYBLOB="0000000000000000432bee59ef7a8775c5b12e0116266bb8fa10ae18e730c0dd920b045185f82d8a0921e3f4c8e24c40394463da32e1e221d212835018b30899b7a0b84b2de31f8ce102b7f48060ca3f8da4caa9201dd9a9be1e1a0a0b570e2bc4f72a58953b79ebecf2b92e16a9cff0e95bf83b39051eec456231114828727051497e5ce4d0ff422a98d5cdd1ba609f41f95f709907b290f635705f0f6bfb9d0ab153eca4f4fd9af045f2d9cfb9c2d6baf2baea6aa022a90dd564ab9becde8bba866148fa6fab1854bca0709704d5e929edd4"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(r0, r2) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1564.059743] binder: 13819:13822 transaction failed 29201/-28, size 24-8 line 3137 [ 1564.080917] binder: 13815:13832 got transaction with invalid offset (0, min 0 max 0) or object. [ 1564.104194] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1564.112634] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1564.122381] binder: undelivered TRANSACTION_ERROR: 29201 08:14:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:14:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) clock_settime(0x1, &(0x7f0000000040)={0x77359400}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) [ 1564.122494] binder: 13833:13837 ioctl c0306201 0 returned -14 [ 1564.137115] binder: 13815:13832 transaction failed 29201/-22, size 0-8 line 3199 [ 1564.144481] binder_alloc: 6448: binder_alloc_buf size 9089030060938008 failed, no address space [ 1564.144492] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1564.144566] binder: 13834:13838 transaction failed 29201/-28, size 6837230247252759-2251799813685248 line 3137 [ 1564.148265] binder: 13834:13838 ioctl c0306201 0 returned -14 [ 1564.148638] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1564.148648] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1564.148698] binder: 13836:13839 transaction failed 29201/-28, size 24-8 line 3137 [ 1564.155481] binder: 13836:13839 ioctl c0306201 0 returned -14 [ 1564.210078] binder: 13831:13835 transaction failed 29201/-28, size 24-8 line 3137 [ 1564.221202] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1564.238787] binder: undelivered TRANSACTION_ERROR: 29201 [ 1564.244005] binder: 13843:13849 ioctl c0306201 0 returned -14 [ 1564.263495] binder: undelivered TRANSACTION_ERROR: 29201 [ 1564.270817] binder: 13847:13852 BC_INCREFS_DONE u0000000000000000 no match [ 1564.278607] binder: 13847:13852 ioctl c0306201 0 returned -14 [ 1564.293320] binder: undelivered TRANSACTION_ERROR: 29201 [ 1564.310588] binder: undelivered TRANSACTION_ERROR: 29201 [ 1564.310759] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r3 = getpgrp(0xffffffffffffffff) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000006c0)={{{@in6=@empty, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@loopback}}, &(0x7f00000007c0)=0xe8) r5 = getgid() getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000800)={0x0}, &(0x7f0000000840)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000880)={{{@in=@loopback, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@dev}}, &(0x7f0000000980)=0xe8) lstat(&(0x7f00000009c0)='./file0\x00', &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000a80)=0x0) fstat(r2, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x7, &(0x7f0000000b40)=[0xee00, 0xee00, 0xee01, 0xee00, 0x0, 0xffffffffffffffff, 0x0]) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000e00)=0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000e40)={{{@in6, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000f40)=0xe8) fstat(r0, &(0x7f0000000f80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000001000)=0x0) r16 = getuid() lstat(&(0x7f00000027c0)='./file0\x00', &(0x7f0000001080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000001440)={0x0, 0x0}) lstat(&(0x7f0000001480)='./file0\x00', &(0x7f00000014c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r20 = getegid() r21 = gettid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000001740)={{{@in6=@remote, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@remote}}, &(0x7f0000001840)=0xe8) lstat(&(0x7f0000001880)='./file0\x00', &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000001c00)=0x0) fstat(r1, &(0x7f0000001c40)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000001cc0), &(0x7f0000001d00)=0x0, &(0x7f0000001d40)) r27 = getpgrp(0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000001d80)={0x0, 0x0}, &(0x7f0000001dc0)=0xc) r29 = getgid() getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000001e00)={0x0}, &(0x7f0000001e40)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000001e80)={{{@in6=@initdev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}}}, &(0x7f0000001f80)=0xe8) stat(&(0x7f0000001fc0)='./file0\x00', &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000002080)={0x0}, &(0x7f00000020c0)=0xc) lstat(&(0x7f0000002100)='./file0\x00', &(0x7f0000002140)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000021c0)={0x0, 0x0, 0x0}, &(0x7f0000002200)=0xc) r36 = gettid() r37 = getuid() getresgid(&(0x7f0000002240), &(0x7f0000002280), &(0x7f00000022c0)=0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000002300)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000002340)={{{@in=@dev, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000002440)=0xe8) lstat(&(0x7f0000002480)='./file0\x00', &(0x7f00000024c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r2, &(0x7f0000002680)=[{&(0x7f0000000000)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000000640)=[{&(0x7f0000000080)="941b0382af969ea6bff5d67e61ff7a823c24ee6a4b1c419d2324778b8de752ceabdffe7a6ab061be", 0x28}, {&(0x7f00000000c0)="581d31a2d6e2a79f1c53f510c8af514c8af1cbd95133be04df3c65edd989d94e1516acf02bb283dd3e1252790419f087af03ce7a839f814ae5af5c55c07067b1900410192e27b5d6ea7c5e9590b5f9afc2361c604b27c6d3f84c47f251fb39b0ed907b607857ef976f9299318d1c15ac45cc0d4f7358e22a7beacf8028849ae9dc8606fdda2c5d1101c4b7e81a8494eae8cf444abfcc686077b37dd433dce313f307a7aba4ca3b5f79e9eda783bb23f843a92e759d3557caffa9cb86f3339d9abc886b2f781442678d0361c9f86e82296e4a91c98a3a9cb074aee3b20644", 0xde}, {&(0x7f0000000380)="ac816fc5e36a0905272d49eb9059a522794d1c89329668661471d9ab12464cf887dee8a7a67e89ddd69342e91b509823b8eeeb114496c20549584963dbb68a468856b4b9402e176a2684fe2a4fe28f94d52b20d0870be1bc2efeb6f330bd647bee6d184faf5dbc550fa5e4f8a6ff61775a8d0b0a2e5c3be172258aec7bf629c687c96e41b0ee2830d7588dd59bd7d04cc97df4c7b1924c953f71ea84094dacb224", 0xa1}, {&(0x7f0000000440)="84bd9990b889f5e23cc1b9f0c54f5395b37b99798f3cb019ef9c3314efba8f16d46a66d99d8471664fd52ded29f8a9b0d22f31abed11aa9a5e7e3f5a5c01c2e947185d698041d6edffeaee7a128c0a9fe3fd69045f97b5d24e4f66bb2392d49ba9cb2ab2e31703110272518de3e2e8c019f70eb7e0c814486168e096ed9998eddb6ab366fe2ec8db8bc5e16463aeeee6b6e24352ea4c3e26434d55bde834a42471d26bc2fe35da27485b84e511527f49d543b1c601c42bbe202560f09450ad5df575752dd8709cd917a849f262413cc32eaed8260671642ffc85587e", 0xdc}, {&(0x7f0000000280)="edb1cd788fd683ee393dc7811b92601aa2ffb5cd6596c43117afeaede6f8b9a8a64b8ed05fe8b875037591fcb0819e81d95dcfa248ed0d4a6649ed52bd00de7d7a4a896615d724cd66129e5e6a304f06b6dca763b32190d66da000c2be698a71019f699f", 0x64}, {&(0x7f0000000200)="9ec7af0bc40b67ac751bcb72944838006a5a87e8c674800f6637fdf4ff2d", 0x1e}, {&(0x7f0000000540)="3a66393736ff6e51a1040943de2fb84ae0f5156558358e86b3fc7870f7a4884ccf6b59ab8ac46337cd45a66a5c318522fc79258269d0932603291e7046b3b345ada96dbba04eb2bedec1214619a6b13b1e88befd3166811762b4df49d8f44ab0bb17c548da3eb1d9dff45ddb8a9eb21baf2063a0d0d04be8e241b78caeba485a7f8094a9106d950ea88473d2c2e820e6c9efc70e0a72471a5bd0171ff4ea95ef81fa3e7fc211198a2fb22d4aff5d9faca5", 0xb1}, {&(0x7f0000000600)="eb1d99ed31361a24b2eed206", 0xc}], 0x8, &(0x7f0000000b80)=[@cred={0x20, 0x1, 0x2, r3, r4, r5}, @rights={0x18, 0x1, 0x1, [r0, r1]}, @cred={0x20, 0x1, 0x2, r6, r7, r8}, @cred={0x20, 0x1, 0x2, r9, r10, r11}, @rights={0x20, 0x1, 0x1, [r1, r0, r0, r1]}, @rights={0x30, 0x1, 0x1, [r0, r1, r0, r1, r1, r1, r0, r2]}], 0xc8, 0x8044}, {&(0x7f0000000c80)=@abs={0x1, 0x0, 0x1}, 0x6e, &(0x7f0000000dc0)=[{&(0x7f0000000d00)="0976fbf86f9ecdd552914511b97f7af036d1f7c2472e2474ad1f5cf191ef9e81de21b815540fa75b2f1313be767fa5285a236ffa78c34d0acc6e2c5a5c1be00e402a2352010276bd2a0ea9affa9a795016415c299b4e11df56f8464e40906c726b6fff3ec6155c32574545e4059db1654be797ab321939110c3f878b7ae6c97aadf05a1b94", 0x85}], 0x1, &(0x7f0000001100)=[@rights={0x28, 0x1, 0x1, [r0, r1, r2, r0, r1, r2]}, @rights={0x30, 0x1, 0x1, [r0, r2, r2, r2, r2, r2, r1]}, @rights={0x10}, @cred={0x20, 0x1, 0x2, r12, r13, r14}, @rights={0x18, 0x1, 0x1, [r2]}, @cred={0x20, 0x1, 0x2, r15, r16, r17}], 0xc0, 0x4000}, {&(0x7f00000011c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000001400)=[{&(0x7f0000001240)="5bbe36ccbd2a41a6180b8875a04304f07ba0c10add8233e0d0ec22a613a1745445cee85ad26b68d06cd4f0356dc5ed9e6add81b2f9d68ba99927edda9cba153d9ed36cbdfa737ed281971fce97a3b7587e0e4c12fe6242f28a151fe9c83f61a911a78c665505eebfc054dcf5685ecf13b7cafc64a9864350f3f346fd2ad874bcb100ed2d9bc2600cfad8fa1c4ae553ee26750ff2e7a6c3802faea51c391c07aeeb66a6aa2bb4d7ab5430e7031cca6ce574cbc260289821502a2e74fcbfbd3efa7a7d", 0xc2}, {&(0x7f0000001340)="76cfaf803be23aa1f54a76c5c66b8e2b4979307b871a5b36b7d2a8d0be54ce2ca501163fdb5686835faef3e56ccd29c38ad59727a81ed70ea7e62a8a876b9fa2fed1fb4b6f6c8c6273caaec3efe006a926b0d5a3273368a7c4916b9b6674ec3b87457171a93802b962e3a5ae086511fadbfe79f4643026aa4364a2e812a15b6a6165321e9beff1595becb50323dce2b9f3e21c9f57e9b113a95d37d36f451e0ac0aa7117ffc23e46bad151489385ad1f6b59fd661b83f00827d44fb9", 0xbc}], 0x2, &(0x7f0000001540)=[@cred={0x20, 0x1, 0x2, r18, r19, r20}, @rights={0x30, 0x1, 0x1, [r1, r2, r2, r1, r2, r2, r1, r0]}], 0x50}, {&(0x7f00000015c0)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000001700)=[{&(0x7f0000001640)="f7d3cb3a8a3c3ab3834a3824c3f52be521d80afc44ef39bca5e344391bde73b041631cec70b28c98d12efd33763fdd594066b4c1b1b7bcc2a0463f8db6675e36a66ba0a74d3b5f398c0f49fe1c0473b38aab62cb05fa4c8d31be86faacc3b0be1e39ca9da2d76d5cb62b88e4dc883077cfb611fec468dbb9725365214e79c2a1c4e7b4fce4c3e750c056e748ff9d1697bb44c56dfe16088889fe1d487339ef9a0cfa9afb2828cd8af5", 0xa9}], 0x1, &(0x7f0000001940)=[@cred={0x20, 0x1, 0x2, r21, r22, r23}, @rights={0x20, 0x1, 0x1, [r2, r1, r0, r2]}], 0x40, 0x4000000}, {&(0x7f0000001980)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001bc0)=[{&(0x7f0000001a00)="8989b39103cc27b1f8cedec5326f3ea7c3271b97293b41e57bf08a191486d4933dc0303a23be2dd039648bf707e925b122c6a882e404d43f0b83a2f9d16aaf2ad05a5705e44b9b16cfc5b5d8dce8991de9080d181108f198bbd98c0c2cb45978c786cfc7bbcbd5c2371ef6ca09c47c11ca2f2a595be207e834ed827b354bc11851db08976a4624bc33a41388d458a230575c1cd1cd51da1aef5f1920474a8d1ca2852b997fdca5029bf6f7a68171d06b3cb8968d", 0xb4}, {&(0x7f0000001ac0)="6ba26afc53ace037543f99c1bdcf3d225c91754e8683343f4c81b4a9e6af1324963c5f39c360bd1e8543e8331702302a027dfc341998af51ce96fb7f5b916c341e7e32b75bf5c5f740ec37306feb619ee4539a420bb524ce41d2934a5e021acbeaef3e89af167b02c354e39375959056c4d584185f68cd66f9b311643041c2bcec8564e9c187a4a967c973b56ce566bcd648d17d82e839e13a7c1f6b9817765aa1b4324d136ff8466b33927287051a8f79c505d95c16c38d7022bf5a9a0245081075ba692eefcdbaa7f7ec0734559fd140a4dad0c6b4512a34c8933f24", 0xdd}], 0x2, &(0x7f0000002540)=ANY=[@ANYBLOB="20000000000000000100000002000000", @ANYRES32=r24, @ANYRES32=r25, @ANYRES32=r26, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r2, @ANYRES32=r0, @ANYBLOB="20000000000000000100000002000000", @ANYRES32=r27, @ANYRES32=r28, @ANYRES32=r29, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r30, @ANYRES32=r31, @ANYRES32=r32, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r33, @ANYRES32=r34, @ANYRES32=r35, @ANYBLOB="0000000030000000000000000100000001000000", @ANYRES32=r1, @ANYRES32=r2, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r2, @ANYRES32=r1, @ANYRES32=r1, @ANYBLOB=' \x00\x00\x00@\b', @ANYRES32=r36, @ANYRES32=r37, @ANYRES32=r38, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r39, @ANYRES32=r40, @ANYRES32=r41, @ANYBLOB='\x00\x00\x00\x00'], 0x108, 0x8004}], 0x5, 0x4000) 08:14:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:14:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000600)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000000f3d2660b8bef6000a8f54c818627ea4a9bf1a4a176cd27f2d40816378617bd8beadb207fb8f0260b1522e3991df0d1a103a00b58d6a29e122de9dbdd6cbfadfa131a87077e7b654c6a1cb497bbff7dd17e5c6a65652baa62b5108d548c18d8c52a2b4965635a1f8eb2c17a27e89ec5a73a04b4ba8f6ace1891ff43bc85c41089d6da03fb971730be8f35481113ec0a7809913bc0399340d5fa98755d4e3b680fcbc5f753753189c91cf80a6fc95b7ebf581768a49377e180de37bd7f6843b91e2f93381b0994049c3fea88f5acf3ab5143f1bb7e5824afca4518e52b3a7c835a058a4d5339ff69663417f5f46767017b6cb2cb0b3d5b4644e69c22169c9c23865dc5adc0331730e77401dab929199625afe7a9bcdbe7712bfa52bbdff1caf80fe637b6bc09a5a93e31a004c165346b0c20bd47fa94e695613df4e7288750247c26b692b0eb1eeff1dd6a48a37503ae4ad33ab63"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffefb, 0x0, &(0x7f00000003c0)}) openat$cgroup_ro(r2, &(0x7f00000003c0)='cpuset.memory_pressure\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000100)="b94ac237384ab6fe0c35afa845609b3506447cbf0aa8ee4d6f885dd5f0f2aafedea2d2d4", 0x24, 0xfffffffffffffffb) r4 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f0000000380)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, 0x0, &(0x7f00000004c0)=@keyring={'key_or_keyring:', r4}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() ioctl$EVIOCSMASK(r2, 0x40104593, &(0x7f00000005c0)={0x16, 0xb9, &(0x7f0000000500)="1218176994f6884e8771451cdf679b808029a09f09e0f38c7573c5f33ffbe993a23784c9f637ace2f1c52cdc3e6a47bf9f79bad2f254322cd89d48d7706326a1f4a33824ae767261877af32c878efeea8373545022c09b28da11dc625eb3471229b7487ee86c986b1fb664cf8e665ee906636b473750db6af207fdc31d11b8bef40bc4dfc684e06869605588e8629afe73ef6684eb2a0f8c014a359532308149ffed48e99b3538fc8560e2ba4789e2d34156c5a509179cc302"}) wait4(0x0, 0x0, 0x80000000, 0x0) rename(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x3, r5, 0x4) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1564.310810] binder: 13847:13848 transaction failed 29201/-28, size 24-8 line 3137 [ 1564.332289] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1564.332298] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1564.332349] binder: 13855:13856 transaction failed 29201/-28, size 24-8 line 3137 08:14:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1564.370742] binder: 13857:13860 got transaction with invalid offset (0, min 0 max 0) or object. [ 1564.392094] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1564.404651] binder: 13859:13866 ioctl c0306201 0 returned -14 08:14:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 08:14:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000000)='trusted.overlay.redirect\x00', &(0x7f0000000040)='./file0\x00', 0x8, 0x3) [ 1564.426916] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1564.454078] binder: undelivered TRANSACTION_ERROR: 29201 [ 1564.458045] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1564.458055] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) 08:14:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="0000000000000000300d9115cce122380dbf8d6b5f69cff9e873cbda6652a04ec4bae990094ae4d48d32028820fbdf8057a6fc25a7a35bddb5dbbd3e819bb601088d6f1be1bdcf351124d93afb0d5980fffcf690d0f993595ee4bbefd74f856d00656a65a5e9a4128ef0639ff39705021efd8fcdc6ff4f99718d2b9a5fd4c52ed751c45bddb30105f4af26c0fe0f8eb28831291791f9420efb8472f4ed25c3c02d190cd48f83ae87bc49e3"]], 0x0, 0x0, &(0x7f00000003c0)}) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x8040, 0x0) write$uinput_user_dev(r2, &(0x7f0000000380)={'syz0\x00', {0x100000001, 0x3, 0x4, 0x7}, 0x24, [0x4, 0x9, 0x3, 0x3, 0x81, 0x7, 0x200000000, 0xffffffffffffff1e, 0x6, 0x81, 0x0, 0x7ff, 0xff, 0x1, 0x1f, 0x0, 0x6e52, 0x101, 0xfffffffffffffc01, 0x9f4, 0x3, 0x16a, 0x9, 0x7fffffff, 0xfffffffffffffcc0, 0x3, 0x7f3ee775, 0x1, 0xffff, 0x7, 0x8, 0x20, 0x3, 0x2f9, 0x1, 0x6, 0x2, 0x0, 0x14f, 0x2, 0x10001, 0x4, 0x40, 0x6, 0x6, 0x7, 0x50, 0x3, 0xfffffffffffff000, 0x2, 0xfffffffffffffffe, 0x25000000, 0xeb2, 0x100000000, 0xd29, 0x1, 0x6, 0x80000001, 0x80000001, 0x3, 0x80, 0x9356, 0x277d, 0x1ff], [0x0, 0x1, 0x24000, 0x8000, 0x3, 0x1, 0x9, 0x5, 0x3, 0x101, 0x4, 0x7f, 0x1, 0x7, 0x8, 0xd1, 0x7fffffff, 0x3, 0x53f0, 0x8e92, 0xfffffffffffffff8, 0x9, 0x5, 0x6, 0xbb1, 0x9, 0x75d6, 0x400, 0x80, 0x836, 0x200000000000000, 0x3ff, 0x4, 0x5, 0x3, 0x1, 0x20, 0x7, 0x8773, 0x0, 0x7, 0xda33, 0xfffffffffffffbff, 0x8001, 0x2, 0x5, 0x3, 0x4, 0x3, 0x40, 0x718, 0x5, 0xfffffffffffffff8, 0xa83, 0x5, 0x1ff, 0x0, 0xd31f, 0x8, 0x1000, 0x9, 0x1000, 0xa58, 0x80000000], [0xffffffff, 0x10001, 0x0, 0x4, 0x24e0, 0x800, 0x8, 0x4cb9, 0x6, 0x9, 0x81, 0x4, 0x8fd4, 0x4, 0x1, 0x1, 0x401, 0x0, 0x0, 0x3, 0x4, 0x5, 0x7f, 0x4, 0x1ff, 0x1, 0x4, 0xffffffffffffff48, 0xffffffffffffff9b, 0x7, 0x5e38, 0x1, 0xec0, 0xa914, 0x7, 0x3, 0x7, 0x4, 0xfffffffffffff001, 0x3, 0x100000000, 0x101, 0x0, 0x3, 0xcf, 0x2, 0x4, 0x3, 0xffffffffffffffff, 0x1, 0x1, 0x0, 0x4, 0x774, 0x9ad, 0x3000000000000000, 0x36, 0x5, 0xfe00000000000000, 0x401, 0xe7, 0x6, 0x1, 0x6b5f], [0x0, 0x3, 0x1, 0xfffffffffffffffc, 0xfff, 0x6000000000000000, 0x100000000, 0x6, 0x9, 0x5, 0xa4, 0x5, 0xdc1, 0xc6, 0x3f, 0x6, 0x7, 0x4, 0x8, 0x1, 0x2, 0x200, 0x2, 0x6b, 0x6, 0x7ff, 0x6, 0x8001, 0x3, 0x7, 0x0, 0x81, 0x2, 0xffffffff, 0x0, 0x2, 0x2, 0x1, 0x4, 0x1, 0x7, 0x4, 0x4, 0x80, 0x100, 0x9, 0x400, 0x0, 0x6, 0x9, 0x6, 0x4, 0x3, 0x0, 0x2, 0x5df7, 0x12bb4f18, 0x4, 0x1, 0x2570, 0x3, 0x0, 0x0, 0x1]}, 0x45c) [ 1564.458118] binder: 13862:13867 transaction failed 29201/-28, size 24-8 line 3137 [ 1564.458418] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1564.458433] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1564.458512] binder: 13868:13870 transaction failed 29201/-28, size 24-8 line 3137 [ 1564.458847] binder: 13857:13860 transaction failed 29201/-22, size 0-8 line 3199 [ 1564.473610] binder: 13862:13867 BC_INCREFS_DONE u0000000000000000 no match [ 1564.474638] binder: 13862:13867 ioctl c0306201 0 returned -14 08:14:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x4000, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = accept4$inet6(r1, 0x0, &(0x7f0000000000), 0x80000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="0000e00000000000"]], 0x0, 0x0, 0x0}) ioctl$EXT4_IOC_SWAP_BOOT(r4, 0x6611) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB], 0x0, 0x0, 0x0}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000380)="acbe75401470e65729206a37f08bd0ebb64bff2fa28b43ebf7e93e7d7a7cbe4a7401ed5ecb939b452685411a7a1065557bd1cecb2401243e223e340cb6c7e1b30ee7a475fa4a6f396974ddba30d7a6bc2069017c05f7fd19330c00963baaadea1fce71c5b27802d5a3208d77714f54c419cf280279c6f3533e43ee86294487a6968c04013f692f9438634c495f43924d33669db928f45bf7fe6d6d9dc30205487bbb904d5cb5fa67bf3314d01c6d211fcedc98c7633787cba617125f0b1063f51799231916a21ce41e800cea0b3cebc61b799c5b67359172d7204a8f74756489499bfa005c4948007923f85adfcf7963772f98a8a88926c6330d0cdbce539083617b838fe232248901c32e5d079a2dcd89a91a87803b8a1080c19f3981a8c5a03d84ebad7f7c23b1200d06df623bb80b90b982c9c2c5bfdf804f6c14296ab45a3235bcc91836735855ae50887452424c0081fcee082af30ac95c8883dd4e690c19000cab7cc5008c68e60e40dafea8e9264f97ef3a8ce68e060e82b6ad06ed9387e0a2a42f8a5e28666804ee8591133407a7ac1c9095b2d15f6f430c3c13ca44adf72067d4219c86f6dcb597eae4e1461676c4e83358ae5cd51c9a59cdd25a2c50a7fdc87f3d8adec77312403de2b6059d209c54448ced39ce37ce0654e500001a5744ace75ff1d447a0177bd95b51de20378616f3117886e0dae0550f04004c4aeba62a3b76944e94a03e4d8400936fb4c1a6bb0ba4a797bf8823cf5bee2aebe283c756a947fa569d6ec47d9a350837ad68ca123a5a991a92778088f254b29a742c8e2c0336a56df1c265451819bd41c8f3e4097998fcbddb434b8eb60f21ef0a75c2105eee821c2b3493780eae391f58182fae36bfb1f875a66389bc98481dea14ad6382d6d10d144728fcc7125b696555abc7a653c980679b74bab66744221cac1ca766ffce1c453c2a74e4e3d0ebadaf74265fd13acf92f773f04197cf0114883b7661352e517c63940ba8219673fb78aa778f7291c921b6f93b85c4894d91a122dcbe7421259d1b812d4ae6323366b7116ca04257ef42b53eda7ddfa4cc99b185e2cbed7838b9f4abfcc23024cf28e2b30a61c3413a65a6004a5de7f5aa08d8dabc5e2789c618cc732e0c47b446657ede2f8b3abad277e8fe39f3febe52d2a769265c835b133d8ad160586cb82ac90dd436b529fdd97afd9e3498a99d1fbc4c82c73c9e21fe800aa15229e3ddaa9825fc434ce9ff02decb6e1521d44f77a443c6af2b5a71d1057c85c6c575a4d9d66cdd702842b6515c805b52667b6c8e9f221ec3fe19ac1e2eb723e90df9b344a4199a24d25a0a9879cdc007c24defe9ebba5af0eb5f5ea2b6a1384defea80f550ac77760248c43460fe19411296b51d539e1cd902ed9bf83126a47fcc99f991f43ebeb27170458095e028bd41142be02b871fe58e3cc94dccf74c28bf5f25ba425e9ab93b7a494e55544e79ce1d5d747726ab3248eca108ad78e73e2d14ed92cba52d1e494c6158fde6d3c7130d47ce9daa2ac58e7d0f02728f63d79544dcdf8a59be5c38d4093bee1de0e16458b8031570370fac49789279b94b22342c1852e063078e6ce435e187a3d9fc4054cfbf2d607ba58b47409d70a348084b290bfce06e55000ac47403498605771b771018056499e0a7ceafa814c2c6746c24bc3581842b985cfbd688627a46daf92ee8beba6729f913547636cc0c46cfb6fc6c48021b6991af9c58d449192bf4e637076b0afe0ffa4dd356d87b89fae0536d001a73ff66c22dcb6d0293a5e05be711bc163d11e625b23f8d8abdbf540ca111ffd98fa0ad7eb7c80c5c453fe88ec08e603a427ed4fbee6accc5b1e95ff79b659159ec229e3aa5d9b5c3bea7b36c02b6617f34ed81eb926a71fe737e141dae4641ae86ae16cb08e56c52b7b169e0b739117691103c8949b00dc3309a19a3128828e0e6c87b99d2ee84dd387a04a90a29d7202abb2065b5f5aa4daefad1e644f59a343e0c8f07e04519b8856edc3c060a7cdda44995b18365d8b28e1be65de4d4a1da26d99b4e0aa4a72aa6b2f65e1d09447981044b68367efa569203cc6fbdd6d980e4b6ab76e3125655013b2267a30573108bc8cb94ec206d5e50cfdff06a8a10ddd8e76e383c0325b258d7dc615cc0fca03c92c365dbd9ea9cbab78fee549b56602fd836b87fbdd706577dc7175991faeb94ea9098de156bc2fd7d8cd7784084b0e7baf4d644b39e2dc3cb2a728d5082e4f708fba02740d1e6e963278006fc4856bef3a0f25cd8eb07de9b3c5531d9276d35a593a508d133394904d92840ddf454d42bc9770493fe62177e13e8c070fca00792fbc38574f6325520b831bdf8bca2c557da69b1164da73481c2e5f48bc437de69d21d84f0478c47e8467180e3e9063662a6cd868ca1c6cf6efc4ab69cd7b74a5de94898823721e3f1d52b8b355b24dc8892b74d6c6081fa6c000dc38d9607e05f5c36bd23afc7f84a436e91ae02537ee1c8d5596124b7e45547fa677aa3164271c81507ecab39751e4b488519f57d24682a1f61b2614c160091891d3c5910c859d2490cf5f3a4139e4c7e13c5d9fc06fd7c403536e9b5dc2972730f80ac8eaff6b441aa9a8b1ab6beab7edf8e6af6e35eca296c9542658ccabe0e92c2128567a4185332e962a8c633a8dd6631b2b60de2244a6e142e7878329299b7a01736d2a927b8e1d059b04b7775ae4d51c9e8c2a5cda09c3a37b5da098dbbe81f78f19047436dd32314c126499f702c35394be6f534da03f142ff3db0c9feab925a7a1672ecf07d934fd260e9110fd3df7cbe80c5f7bc361c606f9be89ae055625686e0fcee47acf7ba0e7bcb5244025ec2d51370673d7cd7db3436d5864a780d8ca69c14934c3b3213b3d2cab22bcf0954c9efdebfd3baaf1651eb6c7d6852c992768270d1619e5b09f34fe3704f60f6bd3dc773cfb55b634bf4df3605ef8487d565c4d2926860a3943985bc19dcfd1f5d85761d2ff045cf4de3f1931f083fdc2fa788a6c3a6025632fd1d1bb913a9e823415e9d5d971009f0ba258e4b016f611c46a19d7b0260dad72cf605090bda3b51fff0c67f6b6b80fd1c7b76e903ffd036c0f1be45f4e16e202119018a93b8307536e431399f45bf2bf35d629fd14a53a26ef1799b3cac372a8c0417d909db9fe62ea6dfeaf0837cf6675174d2d27fcf7f84507b897c302d4fb690541958d811051cdeba659f5efa9fef903eb146cfc796a13ee68eec2dc464221d7d46072d6214c30942e11ad8ddf8e221ce1569c7a6c19f27d8265756f1d0fa42c198089eaeee6efe14271ecdffdc036050f033dcf6fd9e9d23aa8dd90b2a433f22a4979e86da54478da8ecca855a788fccb78157a135a0f73f3337dcf008c3023ddca4213459530fb3c6245964a248fdaea5d64f03f9eb9b30e6698d03ae0358720c5fc6485d22441edeb0384a8fb4556878188b87ca00f5a5082a05f69bb4db27f5c99269c61a1fbbe7b28a24d4acebd8101c55cab6dddbfc846b88a867f22705400602fd0aaf5115c40951dab0a2be97b091a9f3d5b8d7cd97ccc1dc2c42dec6221f2348b841291d1c25b768e32ac01d0f017750039663212739c373bbc5382faede7c09127c9673c091dd70c3a1d3e67bf19988dd2a36f6335fae28af59cc33dee848446541651e955d74b7616ce2dda1ed6bf534ce6bed5cd415870d58cfb294f2929ecc110e05602664b43f6018c56d1ca42b2d7768dad9e31edd382c4342f7868aab6b257eb712ede6f342f42f7fa62e6eb4aadcc4e01465806258f22b6dfe05cd0c41c05f6ae642ccd8f88d3a5e6190e69cad22f5d7873e53cd8414706e447638e90c401d25954df952d98d48fa2f34a5c2114fc0e262ea08bc21f1c8a4ebb905780c147a3894947579628d807306af671e43ab4dcc1725e32906a6a8c8a28bcdfaf2c67f5738024dbff9a8b9c7ca21f05a09a9ff6f12fd94d889fd2b4ab1c832ed87e8c79dc06df8ee661827d801f9311e7803f632b06dc908fcc8b8adef57907fb6830a20e6b6dba48f00cd9e065db8c7c8b5bdee9bc68bc46df1c1fb3579ff71111389d18cbbceb4769e9681f964b9283f0af79cf18eeac8d75cde5fcd9b7eb9ee37ba4af5b2c117c05afa59abbf2d4b4b92fea50f69dfb7ed85b5c88845dd5d23a9f1ebfee2645c65b8421ca1dafccbabdfe409f7bf4df71c37b0def50017c0f1f5b09dc451c4ad4513e127ef9b186e8a0380515c723e0215dcca249f5168ff1520028707bb4eaa051ea06d7b3bbdfe64a74561a22198247cbbff8dd2cdf7c54188ca2b7c506f72dd5b0e21e02e1297fbe86b88823ef9e874d4cfae915d8bb7742865e7219c22688475d53c660792e8ca62e54b09491560e08e1e67df03f63bcdc918bb3b014879abbb5f693e994b66388e51a2eda89308e76ec7f0be29a67109f2d3d914522e6eee2d0fd1fdadca02077535b10a502e8a79afce455f766ecca4d67db82ecffeae6aaa43595166235ce3242deda9a3db70708c8ed942f304928db1b1930283204124d06257b5f33a122c8e964dbf146972b4356bd70e3379c8dcb9e4442f5c748d5835fd1dfb9a2b45385ad08a80e22efcd98955d9ae7a47839408ba933f436580f7455b71530e0613dbd90017ec871da79d318c9e734848febfc3122ba36ff990b1b619611db869a5e8365f516ad01df3874eca529719181fd8190e01d57b91d376bccfffe3361f9c06340bc8d12a5943594d1ac1f56b809ffd459a79e07fc277ed6101241646213ae71b9630e01e2a4f1f538302f50b943e2db8e68aa53a678cb0a0369212ae83b01a0862e6d7a92bb86c1a77c099309a51eacf13f61e033f95a3a188cf3e9094e6cf9a082d26f7d8fb76235832b1e2e6dadfed4514a485486b713e2b9437fabacd484aa04d598d488d32e5cc98d0b4654c25b55f23088ec8e0104bb6653cc85bb9d3d456d6d31a244bea3694cab97a53197cf2a4c53c41faee57d4e20198dbc6931692adc9fc1efa5306ad0de3b6306b29bdccc5fff950e4835fdf4d2e796f13f3dda3cc0aebf16616c862950e6135795b9a99d324a22e7d63076875baeeb087a223586a6b74147ea6af40e06e514c3535bd09bc12831fd45e62f9bb95fcb26ae44742a63d9a78a33f32edeed3f10e0c62c2b14612804f9108ab2d74643008a38f27994068c89e23dc61804ec7ef9d65f7d87fef8483f911af2e4156dec82c1865b4cf1b1c4033641f23c10867d234cc62b0e855442f6e7083b6d68c96ccfc481f68318f32bc378e2fd9382ee9bddd6bc3bf1c24b49f88fc37bb42b6c9459bb66cc25a666a7437184290de9015dbaa94ff90518d84a6d1c88ef52d90e631dcd6373ea9e04e6917b26b7be5ad24f49c6d5444c826b04d1c5f1f236804c2d7f04297b7541a851363c399b8cbb75c61f238f0acc1e8fc665f7fbe4bc68090a98d7ab1b56a235406d12b57ec5d41243535341baadeeba9aeda9576ec0ab1347c575f100fbe21a99aa1c77290ef982ede44b129a8596e4aac940955f64b4e0c8c5bb3f5992203b1e29d43185675800c7d48277ba8359a16e459719998317f31fd0f3a6c2ce348c1aedc3d6bfd48024c4948cb16aa4f49fb9c02ab528125e51faef46fb37d461836625abd90d73ad882a2603a76d74ebb346d24c43ecf10cb4098418d86cc2202fb5eca416852320350fadfeca13bd550846eb3ccbce319aecfa66f90649a987fb37c7ecd3fb24d6041c817b6b62483bd84d3b28323a9a779e41faf6ab69ee4", 0x1000, r2}, 0x68) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) gettid() ioctl$TIOCLINUX6(r1, 0x541c, &(0x7f00000000c0)={0x6, 0x6}) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r2, 0x0, 0x82, &(0x7f0000000000)={'broute\x00'}, &(0x7f0000000080)=0x78) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) listen(r3, 0xfffffffffffffff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000ff00000018000000020000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a620500000040", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1564.475748] binder: 13858:13861 transaction failed 29201/-28, size 24-8 line 3137 [ 1564.493354] binder: 13876:13877 got transaction with invalid offset (0, min 0 max 0) or object. [ 1564.493414] binder: 13876:13877 transaction failed 29201/-22, size 0-8 line 3199 [ 1564.519985] binder: 13868:13870 ioctl c0306201 0 returned -14 [ 1564.598673] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1564.609845] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1564.633188] binder: 13880:13885 transaction failed 29201/-28, size 24-8 line 3137 08:14:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) [ 1564.638269] binder_alloc: 6448: binder_alloc_buf size 8589934624 failed, no address space [ 1564.638278] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1564.638354] binder: 13881:13887 transaction failed 29201/-28, size 8589934616-8 line 3137 [ 1564.640772] binder: 13881:13887 ioctl c0306201 0 returned -14 [ 1564.655368] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1564.655377] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1564.655425] binder: 13891:13892 transaction failed 29201/-28, size 24-8 line 3137 08:14:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 08:14:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000000)={{{@in, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@initdev}}, &(0x7f0000000100)=0xe8) ioprio_set$uid(0x3, r4, 0x1) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1564.698343] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1564.705989] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1564.715675] binder: 13879:13888 got transaction with invalid offset (0, min 0 max 0) or object. [ 1564.729760] binder: 13882:13886 transaction failed 29201/-28, size 24-8 line 3137 [ 1564.737623] binder: 13879:13888 transaction failed 29201/-22, size 0-8 line 3199 08:14:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x6, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = accept(r2, 0x0, &(0x7f00000000c0)) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000200)={@empty, @empty, 0x0}, &(0x7f0000000300)=0xc) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000340)={@local, 0x7d, r4}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) lseek(r2, 0x0, 0x0) connect(r1, &(0x7f0000000280)=@l2={0x1f, 0x80, {0x8000, 0x8, 0x80, 0x1ff, 0x0, 0xe80}, 0x0, 0x8}, 0x80) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000fd188668df0c4a58000000000000000000000000000000000000000000000000000008000000000000000000000000000000e95a632f081e20250cd7f009704fed0872842732f008ff5a73d17be9c4f889caa7ac60e4a06b5ec3244a253d453af4472aa2e9a6d57437667cc74b24e3f371df19827eebc6d809e08126d605c54d6bea2a7cdbde8ef868e2f9a4711d0b930e", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00Kq\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1564.750424] binder: 13880:13897 BC_INCREFS_DONE u0000000000000000 no match [ 1564.790352] binder: 13880:13901 ioctl c0306201 0 returned -14 08:14:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1564.800408] binder: 13906:13908 got transaction with invalid offsets ptr [ 1564.810635] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1564.821644] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1564.830764] binder: 13906:13908 transaction failed 29201/-14, size 0-8 line 3164 [ 1564.836941] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) ioctl$RTC_UIE_ON(r2, 0x7003) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname(r2, &(0x7f0000000000)=@pppoe={0x18, 0x0, {0x0, @dev}}, &(0x7f0000000080)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1564.836950] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1564.837001] binder: 13909:13911 transaction failed 29201/-28, size 24-8 line 3137 [ 1564.843416] binder: 13909:13911 ioctl c0306201 0 returned -14 [ 1564.879686] binder: 13904:13907 transaction failed 29201/-28, size 24-8 line 3137 [ 1564.889074] binder: undelivered TRANSACTION_ERROR: 29201 08:14:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$TIOCMGET(r2, 0x5415, &(0x7f0000000000)) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = accept(r1, &(0x7f0000000000)=@isdn, &(0x7f0000000080)=0x80) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = dup3(r2, r0, 0x80000) ioctl$TIOCSTI(r3, 0x5412, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r4 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$VT_DISALLOCATE(r4, 0x5608) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 1564.903143] binder: undelivered TRANSACTION_ERROR: 29201 [ 1564.916990] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1564.924872] binder: undelivered TRANSACTION_ERROR: 29201 [ 1564.931207] binder: undelivered TRANSACTION_ERROR: 29201 [ 1564.945022] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1564.956547] binder: undelivered TRANSACTION_ERROR: 29201 [ 1564.973646] binder: undelivered TRANSACTION_ERROR: 29201 [ 1564.981030] binder: 13919:13928 BC_INCREFS_DONE u0000000000000000 no match 08:14:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cgroup(r2, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="f062114175e9f6cbe0833b9f65b9ddffffb42c1358508ce4743f42dd3f6ff8d72dba573165c4599885f46269be4b9e088a45ef620f17b683d3900026be1ed7badefe396606bca785f56f7a6faaa811cb7c1345a17156f290b8d2d3f07dec80810372d2414cf0dcae21ec0184153ee42c3e11361fe7b4b67abb61e15c5cd89137c28b7329d2c299b5093acd66d5bbb946702da9ffc3b381eb5a2c1ed5b275840c9db9bd3c5c51873e8de019a09785c6c315e033e5a085a89977496c3c67d9f453776d500d12d509f50527c8500329bcc658a77f3871f75ad07ebd18def2093a7f04d6e1e4cab9bbd1f699371c033dbcb66bb9b1c14d770bb7eda7c3f065a5f1209529e8bfd9ec2b8bad1d27dd4354b59692916da7f5cc8efde7bc44b0ded46dc79b38787d9439298d7b8433", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xf) dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$LOOP_SET_DIRECT_IO(r2, 0x4c08, 0x5) [ 1564.998241] binder: 13919:13921 transaction failed 29201/-28, size 24-8 line 3137 [ 1564.998447] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1564.998457] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1564.998521] binder: 13913:13917 transaction failed 29201/-28, size 24-8 line 3137 [ 1564.999118] binder: 13925:13927 got transaction with invalid offset (0, min 0 max 0) or object. [ 1564.999169] binder: 13925:13927 transaction failed 29201/-22, size 0-8 line 3199 [ 1564.999265] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1564.999274] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1564.999319] binder: 13924:13929 transaction failed 29201/-28, size 24-8 line 3137 [ 1565.001233] binder: 13924:13929 ioctl c0306201 0 returned -14 [ 1565.018495] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1565.018505] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1565.018554] binder: 13930:13932 transaction failed 29201/-28, size 24-8 line 3137 [ 1565.078633] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1565.078641] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1565.078688] binder: 13935:13937 transaction failed 29201/-28, size 24-8 line 3137 [ 1565.081172] binder: 13935:13937 ioctl c0306201 0 returned -14 [ 1565.119287] binder: 13919:13936 ioctl c0306201 0 returned -14 [ 1565.144094] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.150971] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.156640] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.162648] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.168920] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.174516] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.180820] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.186623] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.193231] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.199200] binder: undelivered TRANSACTION_ERROR: 29201 08:14:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000040)) 08:14:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockname$unix(r2, &(0x7f0000000380), &(0x7f0000000180)=0x6e) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1565.205122] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.211128] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.212062] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1565.212070] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1565.212146] binder: 13943:13944 transaction failed 29201/-28, size 24-8 line 3137 08:14:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$binfmt_script(r1, &(0x7f0000000400)={'#! ', './file0', [{0x20, '/dev/binder#\x00'}, {0x20, '{'}, {0x20, '/dev/binder#\x00'}, {0x20, '/dev/binder#\x00'}, {0x20, '&wlan1GPL\xa3cpuset%'}, {0x20, '*bdev\xacs'}, {0x20, 'posix_acl_access'}], 0xa, "bb827f24f2bca84876c04e197ef7a0aa08e139b4dd6d17af2cc8e26f66586745309cc11805284300b6a4217ef159ed635800fea46e5a294c56c72f19dbccf0dae9912081054015672dd62540406b0fdde8b0cb9c30060f555a7906f8c1954ed58302b2aff749f771a6756cb95355283f88539550cec2efb26191928fdfeced"}, 0xe1) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$TIOCLINUX2(r2, 0x541c, &(0x7f0000000000)={0x2, 0x25c2, 0xe5, 0x80000001, 0x8}) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) recvmsg(r3, &(0x7f0000000180)={&(0x7f0000000080)=@un=@abs, 0x80, &(0x7f0000000100)=[{&(0x7f0000000380)=""/66, 0x42}], 0x1}, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) write$P9_RLOCK(r2, &(0x7f0000000040)={0x8, 0x35, 0x2, 0x1}, 0x8) [ 1565.248429] binder: 13946:13950 got transaction with invalid offset (0, min 0 max 0) or object. [ 1565.259281] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1565.267005] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1565.276548] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.287639] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.297623] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1565.305385] binder: 13948:13951 transaction failed 29201/-28, size 24-8 line 3137 [ 1565.313456] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1565.323565] binder: 13946:13950 transaction failed 29201/-22, size 0-8 line 3199 [ 1565.328075] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1565.328084] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1565.328150] binder: 13947:13952 transaction failed 29201/-28, size 24-8 line 3137 08:14:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) [ 1565.328595] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1565.328618] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1565.328666] binder: 13954:13955 transaction failed 29201/-28, size 24-8 line 3137 [ 1565.334522] binder: 13954:13955 ioctl c0306201 0 returned -14 [ 1565.355836] binder: 13957:13961 BC_INCREFS_DONE u0000000000000000 no match [ 1565.380148] binder: 13947:13963 BC_INCREFS_DONE u0000000000000000 no match [ 1565.380402] binder: 13947:13963 ioctl c0306201 0 returned -14 08:14:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1a6eacc390fc4d22fc5f3cb0e1a6e8e808478caf", @ANYRES64=0x0, @ANYBLOB="003cfd76ab38b90f405b82407c9ec6ced6"], 0x0, 0x0, 0x0}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_STATS(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r4, 0x204, 0x70bd2b, 0x25dfdbfc, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x14000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1565.407616] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.413386] binder: 13945:13949 transaction failed 29201/-28, size 24-8 line 3137 [ 1565.436510] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.447144] binder: undelivered TRANSACTION_ERROR: 29201 08:14:16 executing program 0: unshare(0x12000000) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 1565.466502] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.487579] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1565.505097] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1565.516383] binder: 13967:13972 BC_INCREFS_DONE u0000000000000000 no match [ 1565.524350] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1565.532871] binder: 13971:13974 transaction failed 29201/-28, size 24-8 line 3137 [ 1565.541326] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1565.553951] binder: 13971:13982 unknown command -1012109798 08:14:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1565.558162] binder: 13976:13980 got transaction with invalid offset (0, min 0 max 0) or object. [ 1565.558265] binder: 13976:13980 transaction failed 29201/-22, size 0-8 line 3199 [ 1565.558397] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1565.558407] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1565.558452] binder: 13973:13981 transaction failed 29201/-28, size 24-8 line 3137 [ 1565.581351] binder: 13975:13979 transaction failed 29201/-28, size 24-8 line 3137 [ 1565.590913] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) [ 1565.590922] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1565.590969] binder: 13988:13989 transaction failed 29201/-28, size 24-8 line 3137 [ 1565.621129] binder: 13971:13990 ioctl 40086602 20000000 returned -22 [ 1565.621825] binder: 13971:13990 ioctl c0306201 0 returned -14 [ 1565.633091] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.633131] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.633187] binder: undelivered TRANSACTION_ERROR: 29201 08:14:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000e300000000bd5bb9cfb12a6b1a000000000000000000000000000200000008000000ffffffff3a9f6f8a0c000000741fb1fdb093a6711e283bf28a0362ffb7d5144e9124777d1a5d029b10502401014be29e545213ba0347c3dbfe1978c907b0f420cfc5dea2acc704e21610fea251e1b982", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x6, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) pselect6(0x40, &(0x7f0000000080)={0xa5e, 0x4, 0x1000, 0x3, 0x1, 0x6, 0x4, 0xffff}, &(0x7f0000000100)={0x2, 0x2, 0x9, 0x4, 0x1, 0x3, 0x0, 0x8001}, &(0x7f0000000140)={0xfffffffffffffffb, 0x28, 0x9, 0x3f, 0xba5, 0x800, 0x1, 0x6ed}, &(0x7f0000000180)={0x77359400}, &(0x7f00000003c0)={&(0x7f0000000380)={0x5}, 0x8}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000000), &(0x7f0000000040)=0x30) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1565.666187] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1565.673648] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.673883] binder: 13971:13982 ioctl c0306201 200002c0 returned -22 [ 1565.698515] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/user\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x7}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) prctl$PR_CAPBSET_READ(0x17, 0x21) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 1565.711142] binder: 13996:13997 transaction failed 29201/-22, size 8589934592--4294967288 line 3137 [ 1565.721507] binder: 13992:13994 transaction failed 29201/-28, size 24-8 line 3137 [ 1565.725179] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.742699] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1565.750867] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.763687] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1565.772974] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.784628] binder: 14004:14005 ioctl 40305828 20000080 returned -22 [ 1565.786891] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1565.786901] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1565.786950] binder: 14002:14003 transaction failed 29201/-28, size 24-8 line 3137 [ 1565.787047] binder: 13995:14000 transaction failed 29201/-28, size 24-8 line 3137 [ 1565.788328] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.833296] binder: 14002:14003 ioctl c0306201 0 returned -14 [ 1565.840227] binder: 14004:14008 got transaction with invalid offset (0, min 0 max 0) or object. [ 1565.848293] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1565.848305] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1565.848353] binder: 14002:14003 transaction failed 29201/-28, size 24-8 line 3137 [ 1565.850855] binder: 14002:14010 BC_INCREFS_DONE u0000000000000000 no match [ 1565.850982] binder: 14002:14010 ioctl c0306201 0 returned -14 [ 1565.877722] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.879757] binder: undelivered TRANSACTION_ERROR: 29201 [ 1565.900214] binder: 14004:14008 transaction failed 29201/-22, size 0-8 line 3199 [ 1565.914796] binder: undelivered TRANSACTION_ERROR: 29201 08:14:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ioctl$sock_SIOCDELDLCI(r2, 0x8981, &(0x7f0000000000)={'ifb0\x00'}) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000009c0)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000a80)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000a00)={0x34, r5, 0x300, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1ff}, @NBD_ATTR_SOCKETS={0xc, 0x7, [{0x8, 0x1, r2}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x48c5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0843104330492870c050e440", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000940)='/selinux/policy\x00', 0x0, 0x0) gettid() shutdown(r4, 0x1) recvmmsg(r3, &(0x7f00000008c0)=[{{&(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/31, 0x1f}, {&(0x7f0000000100)=""/96, 0x60}], 0x2, &(0x7f0000000380)=""/82, 0x52}, 0x85}, {{&(0x7f0000000400)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, 0x80, &(0x7f0000000800)=[{&(0x7f0000000480)=""/143, 0x8f}, {&(0x7f0000000280)=""/54, 0x36}, {&(0x7f0000000540)=""/98, 0x62}, {&(0x7f00000005c0)=""/225, 0xe1}, {&(0x7f00000006c0)=""/6, 0x6}, {&(0x7f0000000700)=""/96, 0x60}, {&(0x7f0000000780)=""/81, 0x51}], 0x7, &(0x7f0000000880)=""/21, 0x15}, 0x6}], 0x2, 0x2, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 1566.098619] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.128152] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.136519] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 1566.151821] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.155353] binder: 14015:14018 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.167653] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.174546] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1566.183907] binder: 14016:14020 got transaction with invalid offset (0, min 0 max 0) or object. [ 1566.184113] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.184122] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1566.184187] binder: 14014:14021 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.185817] binder: 14013:14019 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.193030] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.201662] binder: 14028:14029 BC_INCREFS_DONE u0000000000000000 no match [ 1566.223338] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.223425] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1566.223476] binder: 14031:14032 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.235249] binder: 14013:14034 unknown command 1125139208 [ 1566.235260] binder: 14013:14034 ioctl c0306201 200002c0 returned -22 [ 1566.235380] binder: 14013:14034 ioctl c0306201 0 returned -14 [ 1566.236547] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.248413] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.248422] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) 08:14:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) [ 1566.248469] binder: 14035:14036 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.265920] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.271988] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.271996] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1566.272043] binder: 14038:14040 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.284936] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.297281] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x4) r2 = accept4$inet(0xffffffffffffff9c, &(0x7f0000000000), &(0x7f0000000040)=0x10, 0x800) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000380)={@in6={{0xa, 0x4e24, 0xa0000, @ipv4={[], [], @multicast2}, 0x6}}, 0x0, 0x8, 0x0, "80a29099a128e3d6a1a6c861a8b37b0aebdbf970f937f4dcde3f848bff99a50fa9ad49b266e8cc700b8caefbc17c738ad78b9aac598e2cfecfe7ec43487ae79aacfc501729232bcbb6e78fab2c1e46f6"}, 0xd8) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r3, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() get_thread_area(&(0x7f0000000080)={0x7fff, 0xffffffffffffffff, 0x0, 0x7f, 0x1, 0x7, 0x4, 0x400000000000000, 0x1, 0x100000000}) wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xfffffffffffffe52, 0x0, &(0x7f0000000280)=[@increfs_done], 0x9befacd46388a68, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0xffffffffffff7fff) [ 1566.297289] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1566.297336] binder: 14042:14044 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.319013] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.319023] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1566.319077] binder: 14022:14023 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.357508] binder: 14022:14023 ioctl c0306201 0 returned -14 [ 1566.365914] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.410090] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.425041] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1566.438577] binder: undelivered TRANSACTION_ERROR: 29201 08:14:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 1566.446428] binder: 14046:14051 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.455443] binder: 14016:14020 transaction failed 29201/-22, size 0-8 line 3199 [ 1566.463809] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.468581] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.491604] binder: undelivered TRANSACTION_ERROR: 29201 08:14:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00g\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1566.508160] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1566.537272] binder: 14049:14054 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.537345] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.537354] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1566.537414] binder: 14058:14060 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.538821] binder: 14058:14060 ioctl c0306201 200002c0 returned -14 [ 1566.538958] binder: 14058:14060 ioctl c0306201 0 returned -14 [ 1566.539551] binder: 14062:14066 got transaction with invalid offset (0, min 0 max 0) or object. [ 1566.539599] binder: 14062:14066 transaction failed 29201/-22, size 0-8 line 3199 [ 1566.545305] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.545313] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1566.545358] binder: 14063:14067 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.546878] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.547070] binder: 14063:14067 ioctl c0306201 0 returned -14 [ 1566.552224] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.594998] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.595007] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="ff6210ea04d084406325d7e4e3c9522f5431f1f0f4da25bee34d436817ccda3f1c9953c33d364977d245f03eb7e2ef14f508885e2e9c1bd2007838bdee35e0c0f065d6c04210c0f8fdec81b873d4b0ac83d119dea56b8b39d9c2cbeefa62d1027751f65259c1296de219d515140c4e9eff6de4985f996ab2ff3a94afd5ef2efd1d5749d71b9503e0b86988cfa93728929985fc21c0abfaacbce067e14af4acee21bb", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) fsetxattr$trusted_overlay_upper(r0, &(0x7f00000000c0)='trusted.overlay.upper\x00', &(0x7f0000000100)={0x0, 0xfb, 0x42, 0x0, 0x8, "8825604fb3d7cb1925fe4fa9bafb1a18", "59bf457d46b4f817ebdeaf09d401c64387c7b34b2524e857637242590b1c74dbcb72cd338caa84e6b3e9bcf787"}, 0x42, 0x3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) io_setup(0x7, &(0x7f0000000080)=0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x400000, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x101200, 0x0) r4 = creat(&(0x7f0000001600)='./file0\x00', 0x9) r5 = openat$zero(0xffffffffffffff9c, &(0x7f00000016c0)='/dev/zero\x00', 0x10040, 0x0) r6 = eventfd2(0x7, 0x0) io_submit(r1, 0x6, &(0x7f0000001840)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x6, 0x9, r0, &(0x7f0000000380)="d08a9fbe11830e7d5ab70b8a9666f93861fa8fce74f91c3445451b547e33b677a8775fad32c63b7e88400b8d43221fab7a99da57237628339cc493abf9700a09e2996d1ee8e9491407dff0c619c1bd599758020ef3bb751fb199871f003dc9cf724d22e359433df3ff8e6623772337736316b242cc00993c49b6d64fe97cd0238112585c882d2d94e30b2acad56d005ec4ec6436ba6e5b89c5ff6cace0b3b696dfb95d972f700765362ad136d8e111208a95f4fa983c909703f549dca1cacb6a80cb12875a42c178af02e627225cad4e1e626a21e5838cc39c420f8915c24d8dbeb093b372952b2c812d379a372740b8cbd0ad485b356776240e2ac687ba6b5475fc4528a807aff71308fed3c735212b71b353f1ee65b5006e4e9130497ab33ca02538c517eccc612583fcfe439228beff07a5fbc904c7b4b6452f416e041285823bdceb171c7415b55438685ba5f4db23c03fd9a92212b7f721b406db26105c58053d9b6e8d25281fec2d36f4ef6bc6edca97f9ffee471dab691736ccae4bca0ce812d40277fb45f82a1eb79ade28be453c34cac5caad06b73fc4ad6fdc14b273bd18d6d02608b0aed494b8361cb7ea1e0519ad4b073c208b357a7af0d3fc2a45b8efb3401583458f1be1288cab9ecc30c352da3aa568e660076659697b68cac3fa2eddef190f374882f6f9460d4a4b27b7e8344de5384f8f2168f5dffdff5884a60fcae2aec1174021eb038853a966b746febc799f5a08b8c17bf3ec68e3b764012defc4f08e5c8c2adcafc8d98d9a9902d5b4f4d08a9f0f84c76f2cd095a5cebc2f2879535951cfaa761333ff1e184809786da0cfdc1fadf8740a64b033c466c27f505cb89f6c6e02ac4a6cd45e7157e8d3b1958ac26b6d3a40ac69ab66143d4c77c9c03b6dcf5eb7f75a58ec5ac664e73f364b2bab970a8cd61728a4e70a58b25a1cb40fdfb4e5a705dd6f2d36ac0b76cb0b914646ba4935f494f6ffeb2a3741e873f188fb3baff158f19e28475f40f8fabbb4d951cdfb666bcba45dce1fde8820db08683a4bf18ad13bc669da2cb62730e94b4aa3d436b42fd6acfca32905854f18a4544b6f7a615840d7f11d8aee78a0a7067346c50d8afe8ccd53bd2931cace58ff3b17090b9fe89e4f99b70119cf23137250b32b9e9cb4f27116674b4a2cb6474920fc0ccc471ffe976d8860757c058b5de1ca7e60f971fecd9f5493148e3120744fc7f027accc3b4085dba478b9b36eb611b90dbb0033f5c41f11ff9690adeb9d61ebe8ee6a38843e926a651ce34841ce88ef23158df8655f6a71dc0240d25752bf4060ec43f432bd1c800acb978c043ec7c7d6d59aaee1047f8a8fb148113a99b76e65a7776ce98362c5d8f5cf3ae76238a5a7a4c628259feaf2544753ccfd33af1f4af8191d05a9cd1b145c1353e6a5b66ef18ab5384118da1c4ee9cffd000f53fb51a9cb6d65f264e7c22e1e329a1fe075d6a5f4dc4914d31b6342dd2ce1bd8ab9d6e0eeb28b376c20eeed84a509fe6722781071f8511ab7637afb48ac132c8288fbae9595faffbb628e023361032d82708c2e343cfffc97c50c068546e7391ff80ba04bfcfa5277050bda134babc0ce577fb1a39fb8a4233c40a6a5a9775e456d453898affccf51baaa016c44a2bc2801fb6cb6da6554d43738224c0bc19528dabfce8ca12b647d82bae67aae72272edeee59604e59e2f1e1e6cc4be8e8bdde3435d981e41ab562f1e27785f9a6c45c22dca0e823d594e97703256d99fb22cf07045e9b218011f9b0563b86891728de472ad7ce3146aa90d873c7b63008f5846b54999093a86e4f8627c4b4da8f47550e44879d5f6365de8f1e03179223231a1b24c8fee57a715c325c5b3c98e1bb0f57b43c4bba57e8068cfe770e5fae7139b31303e2adbebbf4e31aa12c31f75dd056bfb0dd6b42f7a3e56713524b055779f1eaee867513f01921b485a72c4d5b80e506959fd7ca4e10a037d6a96c4ae7d8d8621f9a41ef525b255610cab91cc811700ce1ec8a2112369d05d7b7b48dc2b934cd428cb571d2dd34adb427d769a35fa63ab8408a6ecab8119748189b22c1ee1e069a259c8edfbd95599f80b99efa76ecef360c77a93ac762887225709608b0441146d96c6268ff4f93e66dae678312f21d92560080eb83d5b3970edddbd7693f336ecc00ef632a9ba40b53bb6fcfbc5b41ee47719727f9de386fd5ef7447b5bab5bbf386e3c62ab684ee3efef45bc9c2bfeaf023856564b07aaf273acc91da5a4fce59516324041be912cbf40564e02a3ec93b23c699d743cde99f2c414b5921ff8a1e435ea6de66148645ed6be6cc5097dfcad08ae70c7c6391b288ead71456c6f5482b0f376efe8dbb7bb36ab20950e9d417eb5ca6b5d5219fbcdde59e500d1fa177e78add74c4a03838bae20f324562027f8bb10898e93b32fa0f11889b6a4785b53adde6cfc4ecaa93c35cf1196ed0aa3ade40b21cfe3cff49f718e467bc2488e50946fbf47163f4b7c72dbe09acb1c8203ec136a03771dff22f438f5dd1c1a9338265fe6d3dbb2e45800509b6579894bc25e2e0441068eff33c784d04f234c2d36227fa19db56bd697cb4d069925b9ddec91bcd3d2edcf2873a21c363cd205b0b70357e15bbec00393f63aad805311effa0fbf4fd77e2a042d3e98acf34c4ce5ce3921520fe0781c42e7397599da99de982a83c36fd692b1869108601f01895c54541e71968d8a02a9343f92ec99211afa01316c46d759c1b2925a4661d54cb81d5a6508ad0774dd1b43bb5f40fbdfc0db9df2dc2dbd8f2843d125c011c33e878937bca294c6fe35f486a916da100e65d7f88ed86069b9616deab34ca7b8d6aeb29309bd7730e06b965c02a54749e1112061b7c98f9491aa94489e6f3d7ee3d7d92109e6b4dec99b65bd2a33698890134a24c1e0f0586d3c96842f328bcf1be304a04a0769eb0e8a99236ef3af428413a7c9cee5ca14e7b2e008464147bd9340a40311a1cd01549a1efbe33b5805f775c8c5bb854c952fade1416ccea0c73fd1eef03258fa182365bb1a3a6e510230b40f40b8bf3586edd71397529510e589c24cd48d3f3baeba82a0cc4d948c1db08b94aaaa697941800daf6251e547e97ec6312c51831ad7f4190208e05cea4e68fef476f7e9357ba177a120094d7f49adc406c60bd94d6621ee0ef23deac98fcfeb8037a88478cde216c491f7fe8339749116db6f7ec14c216498191b485b34fa45647d0e671f912cbe49e041137731615f99ce38f41383281d58c54bb2c55d96ec82e9aa988a77fe7a8c8e46e0e7d1d3f3b12881ce3fcaf1997265a5b62f8662b9c70fc209eb39ef9e0c1769eab5e7c0d4a80789160c09605435bbf8e11c543fa72cc76d1528eb00779e47e1b05762a92f9c18ac9f610f7987be31ecc2382a1302201d04736f7907672d4ffa7981ad3f66e67ef24674a15d8592509dfbcacab37653f9a8502cfad73e24bcf27a7681de779efc9c0618394513f3ea1fd24859c978c5e06c28f134dc2147aaa5e3a93734373825d8f7c9bd97f45eea959318092835ee9a996bbfe027a87f07525cfc42ec143faea94f11f2d09b5b0434d487a4546ea25837a6462b0dd406e25f7d1d97fd17afc985bb6e947e3802054f921f57024cfd8caa66b192bb6bfe7e856d8603e520144f9c3f5f78ade2f135952100f637bbec4ff0e237e92c6f7425a24d7ef625255cd0cd493adba575fa1ebcb1349708e1466fc118ba9db3f4acc42b2650002c08c836ae21e3e2767624b88b4b48f785f3445e09ace7ce4c101bdd746891541d17a27a146e5e6e03a08a8c3399bc05c0d730a564bc6b5c544d8de8a1e5b95e1b678975ab75617194e62a07f85a806e07973d5a81e89b47e7366550a8b0a9882ba868f849664124aa873b820906e5d9fb3377f0e51e7eb784ab8bb17fb678a1db650a6bc9c51a6a62c864ccabde7aacde70ceea08128092007ffdace97cce067a958b03db428e4a340fdcf74f49bb7696f19ea7a2cb27100c2f580b42cedbbd1b1902f955f7dce380ba5e2c694efd55ef7557bcc4050d419f6284e924186a75975e875bbeb23e594db4888f7e0d72694b99a25b37ecea6789ef663b2233e295f692bf8f63d4abd2ab0cb9e886e073f6ecbef262cf3899e26d02f47b99631d2ceb371bc61c3967e967be75b18393ff041de42774840f983e0c1fb7e466e9817cea78eeb9bb70c5cba089f976c9be49e905382ef68ad45061e9233e1bc84fcd299d93afd9f9e2e814df95784222e0eabc8a5bc56d7ba8df488bc7c735fb8ab42540d1b26a4759bfdc3d170c29bd4a813c283f6eb2cbf6cfe1a897756737126049246d7d5ae0205bd5b5f46a1d8f31d6877f4085f73cdc875a6b8bba82daf880ffbddf17679f7c78cf046b09fd9e6ad7f3e2f9a3ac5505d7f48bffc1b0895581d96a2f13f0fbd607dddcfa66b9cdbbccbed439a6bf0204dd3c2d54a6e80c8b957f70fb533806a671689f8be4a5dd318af4e2e41f69f62577574e998b4f461cf46916f0fe8ea21eb137c55e38899caa5954d8c7870cb844128458ebe4180f029a24296ab4f4cdcedb3db3f62e74959b809a6e30d8afd2660e79c04d5e14ad19be75f1cd6edd187eb6d6d81debb9570137431cd1f1b976e1b13424eb62fcbab44507d43cd5d9dbda16e2e916440adfb790750c71872726a2a61419caffae1f66a89ca3a1a50a282d6864d7c29f7db1c78067d051c7ff338b68331c1b5502de28b9f23fe848cf5d7df121d1a70db389c0c27c2335c00c761e340d7a901c89a4171ca368fd657d716f703accf0bc7d9f0402605a29092c138c78085dda9750368bc237546f4d8201805f114c0a4be631c8023c610f9305f33db67d87f7973774b8eea60df5dd7551c308f8119cc5e48e4362e3de7ebdc293bf6040aa5a476ca1f71fe0a3602345cee6ad6048d17b5225716bd5bdcbc5fcd1b826552d1a3140a88831772d1dc03c847e48b9868a35e5052100ab24e4302e05a25123d9cc89852c742e128a38a80de2eedb18e29aacf690a9c852ebfbb159d974181302a0fabaf451248aedeb3b4297fc6e569e1341b96c595fadc4c2982fde888f519805ee67bd8ee12e0b803bb1d22b9037c8845d77f3b8e5445df555b4783cc68cf9a8dd094e3de6135de5a0075635ea712476c9d9c4355334d2c7b02164314128d23257f3900f4d26ddc783f94c7f523e0cc7e826920d133187da567a5e98daba9cf68d26deb2b7b00b887732827c0ccad881e535924cacd1afb192228b29c784e7e35d5f3a101cdd02f26fb9a89b9d3d4b111415186eb5e42a4a2f354aac22cac4efc977edbae0ecd11103cc935310b5e111b00e72338d146b4c87b651fbd5875301c98c01f98a17ac2372e24cb6ea26721256262f75d906ea01456051f56323f4d6b2abf92acde1cda0f08f18a4b1cc092115905674eb82bbb69b0db896662ea3fc27eed31adf416b339fb0ae956f576f73cf3578f4c20e0ffd39b2a3935fb5233b81183c38c0b98123df318e8f1faf934db3acb0eeb2f284d50cd6ba0c4a043c2424d9306cc1f6e687d1d84edca628fb61a009bb20672d8895b6c774b4a26e5951dab65f5c0f5329c099a3e85fbabc519aba16e7a13eeae5cb84fd40c689776af50b994cbef015cf053f03920b648475a450ec534c7067061c1e833610a3fb07d2714aa0daa60a5367dc20c599bd6ed510d5fb3fefe751fc6426f70a49c098bd884934b750d98b1a38c1e9895af3e72428e647cf64dd688659e606a1ad07947", 0x1000, 0x2, 0x0, 0x0, r2}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x1, r0, &(0x7f0000001380)="ed64a61ce1897fc18a07bf32f7bf15feca8d9d13d1fd3c5f435ab51a562ffc93923f8f8ebb9a7174c46a80b1c917eac425fc02211b2049bacb5328da8a5969212509df8a80dd56990ddb01794c31862e8178ded8132800a96c97ea7b050de2e3e2ed9d96d88ac4e72adc45798e304fc7af2b6d9ce7f34906d487f7511d0aeeca4653e93f854ddb48cc095d2db233b37adfe24cedfdeaff3d2dd8f369344e", 0x9e, 0x8, 0x0, 0x2, r0}, &(0x7f0000001500)={0x0, 0x0, 0x0, 0xf, 0x401, r0, &(0x7f0000001440)="0545a655237a4bde7aff2da6396a9730714a92aa2bdeb816432794cac6b4d0340efebda71782057dc41e05af6138ea23eda42b594de9766c32390c6964291b069ca2a9bced816930e41d19cb150311557f4faf09658e40195bc57553832452b5188a2ee7265d336a9fb6217a89dae6c4d264b5b7a1f286192adf14d8c086d1204929129126c2b3c8fe6595da5c1965d6762ab43762e5f1cf96", 0x99, 0x2, 0x0, 0x0, r3}, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x3, 0x3, r0, &(0x7f0000001540)="e6fe776fb2c42ca1fa673cf16073fee219117a10390f05e7ff218eb54d707c04961cd6c8ce76d3f73d212fe0f4ca0a6da5aaf57756feb0c1fa876d7631152cdfbe3e5418a1fa4f6a8028da6585f670735fe7e5dca7a745cb5e51f792f55fcc295be5f60e7600c8e7fae264c0aaa817a018e7bbffd5877d555803b6ddb7cd84347fc697949af5639e22536df7f721ccd770892c7082b6dd8af3b61ca18068a604e45b3b85", 0xa4, 0x6, 0x0, 0x1, r4}, &(0x7f0000001700)={0x0, 0x0, 0x0, 0x2, 0x100000000, r0, &(0x7f0000001680)="704ca723c57c81f151e94805f6c87b0a80151ea89803d0ba3dcf", 0x1a, 0x1, 0x0, 0x2, r5}, &(0x7f0000001800)={0x0, 0x0, 0x0, 0x0, 0x6, r0, &(0x7f0000001740)="e92561ef95996bad9d8e969a6f0e66b041879c88529dfd895711a92ec93541ec056aa3312bf1deab0f92a40a8ae0979622fa55a4556f1bf94308f47477059025fb8439e293af971d4601f5fd57bc03b8e349f0c1ff95edc5c258cffc45fb563803e795728c1f48917cdfd1a89932b913a8412a7aa7c946d061aaa9e545780b51ef4d07cae9c23382c597be01681d201c47be1fdf6ecd23e4a37338e4aa220eacd80a88fb84e017316880fb67d3ab1ec6d3b619f9f1b5521355c7477547d72fb6", 0xc0, 0x80, 0x0, 0x3, r6}]) r7 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r8 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, 0x0) gettid() openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200000, 0x0) ioctl$EVIOCSKEYCODE(r8, 0x40084504, &(0x7f0000000040)=[0x2, 0x101]) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x4001fe) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BLKRRPART(r3, 0x125f, 0x0) readahead(r2, 0x8, 0x8000) 08:14:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x802) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000080), 0x4) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="f1a6fd33ae57001000000000000066212ef14facfbe6714a63bdd8aaaf4d28917fd669ab376b93251c06df408eb03df64735125bf5b8852aedf5bc3613a7c09843acdf1373f04af7c8bfc515a40d25f08974c2a05eb6d03d032f6791e42b18cd9eb566fcfcde436cf959e5702ff6dd2090bdb84b"]], 0x0, 0x0, &(0x7f00000003c0)}) read$FUSE(r2, &(0x7f0000000380), 0x1000) [ 1566.595052] binder: 14072:14073 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.596760] binder: 14072:14073 ioctl c0306201 0 returned -14 [ 1566.623988] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.645967] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.645975] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1566.646021] binder: 14076:14077 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.648317] binder: 14076:14077 ioctl c0306201 0 returned -14 08:14:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$EXT4_IOC_SETFLAGS(r3, 0x40086602, &(0x7f0000000000)=0x2) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="c92de9b807ce27933e11b73f770eef8a00f96749909fa430f0d442c5a027bc438aa7cac71656172e75bdf9e5d40831092643", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1566.709937] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.719467] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.725296] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1566.736851] binder: 14064:14068 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.744467] binder: 14081:14084 got transaction with invalid offset (1153017910315034353, min 0 max 0) or object. 08:14:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 1566.746230] binder: 14081:14084 transaction failed 29201/-22, size 0-8 line 3199 [ 1566.764685] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.772457] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.806936] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.831406] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1566.839704] binder: 14082:14091 BC_INCREFS_DONE u0000000000000000 no match [ 1566.839831] binder: 14082:14091 ioctl c0306201 0 returned -14 [ 1566.855529] binder: 14085:14096 unknown command -1192677943 [ 1566.856804] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.857669] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.857812] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.858139] binder: 14082:14086 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.858432] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.858441] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1566.858511] binder: 14088:14089 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.858643] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.858653] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1566.858728] binder: 14085:14087 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.860978] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.860985] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$sock_SIOCGIFCONF(r2, 0x8912, &(0x7f00000000c0)=@buf={0xae, &(0x7f0000000000)="47cfed8261d0c69ae3c3bf3c1f100ec4a4925a51dbe0cde56254c49dde29265e016c7499d48fc5129966e70403250cd11d98858b568792beb2908c436cac99e35533736aa77692bc67d1df253557b1155776677212ed7d71adadfedfed5bd53eb50882e21f1421b7c9f926c42bb5168bf06d82a8eefec9c57030a9b3dbc39ec0a77238be410d8a6097a888699ae4ac449107eb548050535ad6d7a926c74d25c2b9a12c3cd37e01f3d41912bdfddf"}) 08:14:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1566.861028] binder: 14093:14098 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.861559] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.901220] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.901230] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1566.901280] binder: 14082:14086 transaction failed 29201/-28, size 24-8 line 3137 [ 1566.901340] binder: 14082:14091 BC_INCREFS_DONE u0000000000000000 no match [ 1566.901429] binder: 14082:14101 ioctl c0306201 0 returned -14 [ 1566.930266] binder: 14085:14087 ioctl c0306201 0 returned -14 [ 1566.932725] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.933434] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.944551] binder: undelivered TRANSACTION_ERROR: 29201 [ 1566.983236] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1566.983249] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1566.983295] binder: 14104:14107 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.028482] binder: undelivered TRANSACTION_ERROR: 29201 08:14:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ioctl$TCXONC(r2, 0x540a, 0x3) r4 = mmap$binder(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x4, 0x8013, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={r4}) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1567.063380] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.065396] binder: 14085:14096 ioctl c0306201 200002c0 returned -22 [ 1567.110558] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1567.118348] binder: 14105:14122 BC_INCREFS_DONE u0000000000000000 no match [ 1567.118777] binder: 14105:14122 ioctl c0306201 0 returned -14 [ 1567.133152] binder: 14110:14111 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.133542] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.133611] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1567.133672] binder: 14105:14114 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.133930] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.133940] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1567.133998] binder: 14106:14113 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.134079] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.134089] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) eventfd(0x1f) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) [ 1567.134163] binder: 14112:14118 got transaction with invalid offset (0, min 0 max 0) or object. [ 1567.134215] binder: 14112:14118 transaction failed 29201/-22, size 0-8 line 3199 [ 1567.135040] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.163212] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.163406] binder: 14115:14116 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.183049] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.194541] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.252626] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f00000000c0)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) write$P9_ROPEN(r3, &(0x7f0000000040)={0x18, 0x71, 0x1, {{0x4, 0x4, 0x2}, 0x2}}, 0x18) ioctl$sock_inet_SIOCSIFBRDADDR(r2, 0x891a, &(0x7f0000000080)={'erspan0\x00', {0x2, 0x4e24, @empty}}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 1567.266228] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1567.275300] binder: 14119:14131 BC_INCREFS_DONE u0000000000000000 no match [ 1567.284380] binder: 14119:14137 ioctl c0306201 0 returned -14 [ 1567.291563] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.299711] binder: 14119:14120 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.307582] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_udp_int(r2, 0x11, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x4) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x7f, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="00bbd071cf000000"]], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000040)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@loopback, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@empty}}, &(0x7f0000001840)=0xe8) fcntl$getownex(r4, 0x10, &(0x7f0000001880)={0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000019c0)={{{@in=@broadcast, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@ipv4={[], [], @initdev}}}, &(0x7f0000001ac0)=0xe8) r9 = fcntl$getown(r1, 0x9) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000002f40)={{{@in6=@initdev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@initdev}}, &(0x7f0000003040)=0xe8) r11 = getuid() ioctl$sock_FIOGETOWN(r4, 0x8903, &(0x7f0000003400)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000003440)={{{@in, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@dev}}, &(0x7f0000003540)=0xe8) r14 = getgid() r15 = fcntl$getown(r2, 0x9) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000003580)={{{@in6=@ipv4={[], [], @loopback}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @broadcast}}}}, &(0x7f0000003680)=0xe8) getresgid(&(0x7f00000036c0), &(0x7f0000003700), &(0x7f0000003740)=0x0) sendmsg$netlink(r2, &(0x7f0000003840)={&(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000003380)=[{&(0x7f0000000380)={0x14b8, 0x33, 0x20, 0x70bd25, 0x25dfdbfc, "", [@nested={0x148, 0x35, [@typed={0x14, 0x6c, @ipv6=@mcast2}, @generic="5f5682af030d1f4d5c6be1399729a89bc90ad3eaf2dc72a3675488f76fe6587ccc496d674e26ca39a47abd66e3255f9880817c9494b6e18b36af58b5200d6b3f29b6d0b29ae94fa2a18529652406f135c45f311d166efd760d4c8f1357522c230a958f947025cd1f6b5e6d365659adcebf2778bcfcde7154dce4e8d6abb86796fa7c05c5ba5685f42713ed1b67c5067eaaf4e176b502a1b4478a44d561d8509e6624e8f54c73b0512a4af7fc4574bfbeaba72ac4546535e9867c621848656279d1852fa2", @generic="668794e3d451b564783788d6cbcecaabf3792c4800dd28c57ab19557b1e32a7bc314f79bbaaa56e7214ae5ff0cfdd503f8bac73f55c57149b3a1a1bf8f74904308e9d2e45742bc708e37cafdf841bf74f12d82a039ebad801e023c1dc067648a20a14742e4cdae9c61fe"]}, @generic="8806efc46069a6727c6e15cd1b29707a5d59271235e98a1c53e1b4de78e7f8de3cfa81f72b0b1f0d126897f92118df82717144d41f3414dc391a0bcd5047680d9563fae732295b4d1de4883ffd4bf145db55925a16d4038d25cac5d7a98d378046391466aa545349ea8edd8da5400fcb9314de85c35f7ac357661d1277e19c1d0d19", @typed={0x8, 0x2d, @ipv4=@remote}, @nested={0x48, 0x1c, [@generic="88d6a861681968b3e41bb4e8dc5fc4ab451a7f194df54d1ad3b4a6147aad5fd26d38cb29bb208c993ca7f5406b315b470609045ac993125a9685fac1f3f5276a1263dc"]}, @typed={0x14, 0x6b, @ipv6=@dev={0xfe, 0x80, [], 0x19}}, @nested={0x1010, 0x1a, [@typed={0xc, 0x77, @str='bdev\x00'}, @generic="ca39cb8284e88c7be62cec19d9b3008f22479e988a2b35220b410cd6b7b58ae0926337aea51434fa97fbeb5c48dd620c44b637ba046104f402d25fe415ac29a82c84c39196d817beaeb634609d9e62f08f3f737d7c09c17adf85fbbce1c8096f89249b9009ee8d793fd16a95dcb5ebd3ba7850dcc3a1edd75e2639908becd25373d116838a28a706750d43db393718644f836280b43ccc5f5ba1357419deac981a348f10f862966e789e723add0472b2c6ace08698f8e92e9189b748c9c238a4a7ce101bc82244758f891ba591957c53444c7ec318753a3d1febea30aa79728a825ac93ebe27ad64ef40f11607423819d9fe9fd7643e00dafea0f86c64f391631e2e2d1f4db55af285348b549acadc78ec7490b3a4cecd8c88e302f011937a40e5e8b8e84b2ccdf5b17fd150dfa1876e37d51fa73cdddf31f3d8bb604e756003453063b7d9069d21b46a37e904b7f36b8df9325ff39587804037bc2425fe0708620cad884a983231f53ddf22cf17b2948bdd05506e82d686587ccceb8d07c00be1cce1e8d5e4b9cd59cf977d65aa20e62fadeb2151da6f0f140b713dc26c6073b26c67eabfb188bea436f6c8ce30b2af263ffe54e7a1efcdefbfd886a18758c6fcb03abd143d39f9f9249d96ce8c21b267fe352e2d4003e1929da3e75f88aea95c1731fc68ff14df9422b0ecf85bbdfb602bbb315827db9180a429ce75cced7d345918edccb159d38ea4b4721ac3c5fe9bea58e93fd94f96997a75f686f612e382f1cf5946b628641182a5f5e639fe8da4c12d0e1080795bfb5e208bf415a63458abc1261f4010b15fb34935c46893b108a003677c74daef838e41edcee1e9bea5587bb6477f116dac2d5196d7268e2a4f01a438b480bb3d72011397d859f745f7c28caa64a37d6d8144d814c9f01405c11886e549d9d9bca0b8b3ad298f534d6af33f82f969981ec6486c0edb245cf0b325eae4f3802c6743a0f3d890d89f3cd3c1d00842751b2f9e5954b53c8d5b123e4d8dfe5e0115971f33b52882a0e095847e82bf56d44679eed578dc1f77edfe2cbf97e538355e7080ca96cacba4f4d82fef3cb494ee955430f2de06d2e87fb32914e0b0e5b6e0ea5c46ec7d3552686dcdac05200b844fde20b520068c0349562f00b5e8cf80f3474ffbb34f6f58c380e76d00eb36bde5699bec7427ce2c2f8033f88325651f1a0e515720ae2855ccb2df36bf501cd6665f230ee2dbb7ab5ad633350b1f84150c9950af1e63295266731208eaf06582756dbd4452f33860c72f1b176ac88843d470453da4268a29f45a3524d05febe6fb8d26d8a2b8641dfae1469d52321880e9d956836d910de32dbffc61ae357c26b121a523c3c2ef436c2a1ad9113f8b18fc73ab6a44e2bcfc983ddf203563e217cf6e66b7b01bd3a3861043709fd39ac6e45b845f133b487feb9f6b94aa5697c1f303a7769264fa7e541a182e43235584bb84130979808d2bae7b6464d1f4ee1eb0da0ffadcba0a5705d06c02da33600e66e27bc39c7f8f3baca66e61fd1de8e45f8869ffe7abab2c5424aca39f5812114f650dc5baeaf4bbaa63da4be550d7bff2a9b205ca3a72ee54679d381fff2a6c6d00da990568d1ca8edcc7028f52d6ad791d1cf5a4049c27df0b354017fa71dedd70cbdecf4609df9520dadc3e890998f434248f72688f1edafcfa388c4dd3c5d57e1b68c5719a4ddba03ac2549ab22aee9607a71944b79b0e7dc0a19962b538642423b9ba9c1ce68864eda68476e208857db7847f0ed2d102595565057e3dbbd370271a64daaa27f0f10382f2993c32e5aaa4f16eef5fa4709ec555799ed7c42837a49a4f233d99ba28dce836869970b35ade68beb50de93eedc8f1622ff603b6d00dc4235e5beaec894eeec23108a78754b8f3a0bbf67d39d965054736534654e05200c9b2509f048313e8573347a8667f58eccb8dd2736fd477bafbcb07b8a94fef9f83ff8dda5c2114a3582a84794a8eb5faa0926b1b21bedd7ceb5fd3caf5c919cf45135c60a8c679352b4db85647795c3f059d73385fc8185e02a4a823a6468c443e9bbe5bd0ba33ba89a8233a25f98dfe437d1cf4240ed545e2d9afbec33e45250a42961e0e2086aa91ffe52aa5216876acf3fce316a37c576f0cbab778cbba5baa0937c62b387e26c5f1653849fa48c9d2c9f7a408368f56b40b19260c3b2e11837bd28d636cff738af6c489e5cd5b675d3e66a9c3d401ed28c19e95e45fc5234a7bb2a5261d0dfd554547c5711d88bedff601e1fb2ff9edc25cf8ed030cb3cb2fe83be11ca46e0f5cdff7474afc57e565c330a4ba1cb2570cadb8032d7a88d16c59b980efd33849aeeaeab793b949cb5a8e5792aac823efd6b939ea5bc552517a2fcd18c18f1fda9ad34333525fc8007bf140b084546a188e3e5f07bc553e1729fa591d9c3913fdaeda639bcd594c567eb08a13c36df252b9b314913aff9392671547aad0eb116598b88629dbe034ea29a76a752943619da503ddc39b70ff38bdb6d29103f180bbe078a4afec9c5b2dc43a2712c326710a7399b73bb665620d3a6c17d24543f8e3f0673507bc13e347563a16e00b240e99d63f2e28ae098715047924ef0eb17b85640bca24139be344311d4cb4fe7c83127c92011b359937ed998a1ef1d3feb2ec86ff8fdd98a7fe22ba8e8dab80e1fae7ad34a3207eee96a608a25debcc9605e8dea61e6b5d0be246877a42f76eb7c59a78a5eda088a17e6d2ab579441bf8b7e621df61c13e13b9f20d70ad07f127946710ee1a9813a55f92b3cb904434983dc14cd5e7c586144209a4fc6dc8f114f30fc8b5930deabcf8cf560c8be634d7104b7d3e2d5f1ff0fa3325d2306869ae68fcc56b837cf2f4b07afe8608133ca2798cea5d59253cf8af05d630ee31591c4f835f899b4af578e199c88395f8ccf6e0fab397d3dc354464a68b57613be01b88dabca025f9460138ee8aec59250191cf9f98bb6ad34a16803308005d3a928b08ea911ec342f0cef78e4e68e378ec7da24804e1ca4a157e620ab6902f2728625467f7a0259b19c6b8819d8d1cf1187f5584de72bd89eed956f3e46f4c21c0ce842daa7d3b02ca222e2dc23a1f69157bb51ae0c06b5fbd105f5d632c97747315e67a4219cc64cef2dfe8db4852caac5f36f046073564946a8ac556e4704a61e6f0496f04d8143f0fe6af635d7d5c9c2a5da2f9b36d26c63488535dad9e35af58c7e705b728882471427463f3ebf2f7898803cf089ed6dcbbf52c6b3e378c68a6bb07cb4a64167b7b0fd9ff2f4e8a6b6d19fe5ec32469a341ce604a52965966bf499aadc8280edcc8d7cbbcd3023227f280219343c901d97bec6295f5628268622e74a3767e06434a4e3de9db92602b1346e96235cdafdf4bfbbbc8767aa79e5d8716e1bb1d81b0788c9d76cd63746a204545ce2da8e2affc0d0ebcb36d271526192bc40c9a6b9275ef5a6d095e5ad23b53e83874a14f9dae675f4b0eee1ee6998d31ade1dba1f8f5fdf9e7821d6b7226016d79d1f7640bcc14997768f3d3aca647e424e927b4532b119367b3cf3ce166cfceef8d70362022566d29a655eb1461c5d648e753f5c744a1b309d7f1ba2e673ee8c76778679cde644fe510fadc1a8cf099f2e9a1b17b3c4da9f7fc836c25a56808ddb30fea2abd85b4d66df8409f5e7ce2b3f1d00f269c11256cd538cb31770ac7d8da2748fed7fbfc9eed3b6be090ee468c16bfbcf68af6eae89d089e25e1ef19d1fc9cbbfef34f256ed80cec7d7b97a672fe80c327c0e5c33e5e6f469e7f583aadb59852c5141e17f5d708448ff3fb02e5f326eee3e7ea97fb15d86fb9e5c5b1e62fe0e58213a8f85bca44f1e6da26e506fcb7921e943cb6c82f87db9b89e19213772cf11f5bffb38916a945cdc78df90e9f6d102ac44db126945a0b52012b2556e272158da91ff502b3d5900a65947a4b2b8f3b594f5018a7480f6b66c97ca596b346110527a205dfa14b65d015e1810193cb465a7cc73f9738daa73c517d36a1274e361c0601a48d6747e45316efd80cb6c74ffa106ce81253c9946afc01759621189744aef06fd30a0be824f85f107e01634cba404c5fef89df33f46993be4e2aec9b77ecb661291f2a7045e1e9bb63351217360ecd4f54bc6377599679f56a97672405f6202f15d5b8d606e7190502d6c3741b9cdfdaeaf70a303610148e45aff5006ad04a808c5d9841d2e85968286535242fd15092d3ed2b70042cc3881ad4ab97dd1950052c42d62539239fc34d30f9dc69abf87681ec8b1366130c5b27b6811c0d37d3096594bb70316b2cf032f14e058b7d048cfe600ea7cc5e4dcdeeed7b2ce9c1af9b269667f604f4fb298672543f0603218a87fd0cbe8bd2835b53f8f7d7136e153ea88b0b864d8435a220c8dba1612d9a68585da4284b22e4df657cede872507e958e673edef62fd3495de917e0dce662f946c4c53a4f63e02677f768002a1f90316fe966f9bfe50285a7f0dc68d7c595ae5eac8c5016aee9c76e73203dd5bcc2a4bd4cfc02d6d5792de73ba78dc0161b8d044ea1e94d10aef2e02a1fc14c16987dc72662eac02456a0a5046bec8b60ba321e95fcbe23c1012b65c42034187ff6be6ae0d9a8eb9cd336879b98d258c3dd8f649c8974a5915d4d78e583bef188c3ed4e89301a066215f14f4da46504f8cfcf1f3e047455f71d131f12d6d018337660564251f482f24354c9a67f99c1267777caad72027fe5860fa1b363739a06b6aaa13143da8519cb91fac009229c60203cd202975e8779a98c8492de694b80239c1c2deeaf8ddf9c2f0bf4b84637c26826de9ed2a5a873d56afca3fb1c087eeb429b912a954f31e4e2ba433dc37cf25e276a4990a34a3d1ca3adf626f96ed86a2316a591df660586f57e36c31a4e41a4d4f786e167ffd84b0f4e00d2eb3cb185ef980f37c5e1ad212df44476d90298758807a75a575354e2a5cb92a0e3d841c1e4524905429f0d7d656078db5742e5ce4b7bce58333f64913dceefbf9dc879f2f2641c728f5cbf9760243b5a9e5bd163ade558b9672a1bf05aa1454e0e354e785c2db77fd65caf604578553605a168c6494e81b25621457b5e29743d5db3112ca4baa1d3ab251fa9d3409a90cd1f937c37972c44a9ee9174f2477cdd165a6f6a86d08e73c8cab469dc7dd2986ae7500d21fd2bd5ba0ddbac8b1d8621a107e75e8fbd4595d699a39c5cdc51e302202909733fa74fb667d28c37dab21a5132923007b375d0de2780df3c6c899888260841c281bbcddc014ae5ec726b1e356bccd7333c3665d797d222a8f966e0afd29fabccb35d498729c2d398245d44a1f993c9e5726da11a3d56d98a95a8fa77a96ef02090de991cf188d4ebd981b6b11304898c9877d02f08b9917978757d7fb3e406f7410606c0a00ab1778a43fda6b5f44e2bd448427a8b81bb965f0d31d96ff08197f12a75a2985edac609988a4e849727312a282a9ef2f47c02f9c147952090a091404315793d836d21b9c4598155e281cbc1c8464b0b0483c440ece1e10e2a3f89c4d503c8c0e7c789ee54a2b09d5db063644f1f57ac513075319c1fe3c87e5e293d2f4815bc20b33e0f40c47e08d6d4aaa48282d5cf336487f8e3d4b7b152ce030a4ad45857d10c64cf4bf2e30849a55df06f6a5bbb9e7af0e02ab156f8d3f3b6d20edc0d4a6c3c1f4cf483e82ebee1465ddef399b80da48edc6220c19357bb342f0310ec5759f98780bca16950139107c522bdff22777e52219c9c04f3b8d9811379dfd00754"]}, @generic="4b61ba3139d39e0779cce86dc237a6bc011d003e2b7c55d22ea096ce6e268728fff0091b31d4d4e0f76c15af15c43b3fe5f0cc3453e2a2ff825b690284314af2b85f100f138305adb3d37138d5e4915d1462b452b89066237b2f7166fc5f24098ffa173087866c4144ab6077212d40df2559441964a7fee517", @nested={0x1dc, 0xf, [@typed={0x8, 0xa, @u32=0x1000}, @generic="e411850e6bd7e92c70674426ab", @typed={0x8, 0x6f, @pid=r5}, @generic="2a78376729977602ccb93d5763b0fb67e576b1e7c8197030f7a312373120eead955a6c45457f40f6b35254c45f6eaaffe1376d369666101844c87192d513c293febf4a0764f1bd40d207d1caec15b8785176a22afdc24659fa3359dc0587fc5100f5aa415a5c0301a316930810eec37448ddeca8f8bc2f237799770c5165b279135d9d84019dbcf59603d1bedf7a1ad0b2632294fdaac06f3813f4150ac40bb473747cea4d6ed45bba17a9a1e465af66f5baf32293be323a686907b21e7796b6e743be52e7", @typed={0x14, 0x3c, @str='/dev/binder#\x00'}, @generic="2ba81b30051a639586645ce08a19f1a287adb8322163c69350", @generic="353874ea086797e5b7085966a69e749545d386d54a9cded9185337e57a", @generic="1cd7c967dc5b3496e595389c80a0e0437da2966425d75935aeff7ae6e1d6a37083648ed0cc3d6314ae65a522c869b87e583908799b66b203fc4d1117f0c5832defba5dc5f7441c6f97cadbc481be2494859ce3df4949b7c94228f23a226366efeab8024fcf36be23c2376e4e3c3ff1d360a036e62f7978d08cc8ac09131687707935d51cd6223959fa89bbaa40f2f4f9a0bab8eb7577f52229694cc8b4113ed79ce136b4900970f25b"]}, @typed={0x14, 0x38, @str='mime_typeGPL\x00'}]}, 0x14b8}, {&(0x7f00000018c0)={0xd4, 0x37, 0x311, 0x70bd26, 0x25dfdbfb, "", [@typed={0x8, 0x7f, @ipv4=@broadcast}, @nested={0xb0, 0x7f, [@typed={0x14, 0x6f, @ipv6=@local}, @typed={0x8, 0x33, @uid=r6}, @typed={0x8, 0x94, @pid=r7}, @typed={0x48, 0x58, @binary="d5817ec25ae6cb1d65fbb604d2ce67dd31637dba798bada62621875d6d47e928d4213e747c26090a3683abf8b97aae6d555f235b1011fb4a57fd48cf0f2d717517fbcd"}, @generic="d30bcdd7cd4d4091bc98fe5a821cd6aa862fc43d390e94630b60cb54a7bff86b457042e4b5aebcd1ef5683455250b0623ecd47239110930a1308ef015314ba"]}, @typed={0xc, 0x75, @u64=0x5}]}, 0xd4}, {&(0x7f0000001b00)={0x198, 0x2f, 0x408, 0x70bd2d, 0x25dfdbfc, "", [@nested={0xf4, 0x75, [@typed={0xc, 0x61, @u64=0x3}, @typed={0x8, 0x55, @uid=r8}, @generic="2a22ddf7d148cc7010bf112c3cd4a2549038103198cae053d65985d6f50855d5b11b14b4ca659c3b271c36f02c9fa33a4652e3abe6bb1516dd4dac22a785708efee391042d7e6071a2df54c0a3aca19ba98352ee28aee73b41faff809460d828ca863224dcd61a39c4377565970d14477233ff438e0aaa154a48a00399408d89347e2a04fad63c8fd566e48df0e153212dff6586131848be67b6b6a04df7cf96f3c8ceb6cd4a773d3e92068e8b7c63d19b9a4da96bfe69c4a403c9a9f2b83686f27d5aa4173d88b1a8052df805c09e88c391", @typed={0x8, 0x19, @ipv4=@loopback}]}, @generic="b4fa9c7575b60db750f8d805479c678451648fe397e120acc56b6a60bd379e0407b8c8df4ab857e1048dea554d873747835837e576b20c44d6417fffc3778775fa2b180c", @generic="4ba5e866913d2ae4c211a6b1b2f57c0e0ffe56e5ea9557506f141cc91973f3fa3d35440c6084e94fc5afbf6d0808bc25ed91107255b42bf3a8fab907e833708dfabace617e098da499999068b1"]}, 0x198}, {&(0x7f0000001cc0)={0x108, 0x2e, 0x10, 0x70bd2b, 0x25dfdbfb, "", [@generic="7a03528ced982665ff1ae67914f368776b1a78c7b2eaa4f5186603f5402ce44645fa24d1d9995953301edb2c0a426959ece17aad50d9b6f5709587e16605e2923071a070736848a553367f62f79c3a482e4e8fac274ccb906b94d04fc8038b77c8cac8e22c25c3716872406387214a748323582547ccd47b1858e821bb85cf475cf155460a7387a368995bd41ce66d10ae5db32c62e54fabfebb90b6765ea922e7f3f726e707e94f06bd260e71a3b64ca3d276adc8ba9afa72423f024a33c38cc0a305add2752c33af0b2cbc80083a79197c361acde514a9456304d99384e83b0ac912d1b0d7b753baa8b84e64f504ed7fb6320e4be12637"]}, 0x108}, {&(0x7f0000001e00)={0x10f0, 0x30, 0x800, 0x70bd28, 0x25dfdbff, "", [@generic="c20f826cd5a1c2daa4b96619f95c12c3ccbf9e9827d116471e0b7c708a69e7aea1c5641e1ebb14ed7ea334827d4790673f29efbf8bdb3c41716796552e6055bc69d2539c06760fe4f9b0e40530f91f1c62833363871c137bc9b55ad1576ea989940c02c0eacf868a0f1886ec021700035b6e95b28c38f80d81ef611f4d4ccb110f66faa1a28b1fc26beff74733b0cfbfd3e943708b52ecd35f309f43f0ffed4e86b68b0e8b9d543b976c4f98e2182878d198764af7cb2a7d7ce3a2a7929728c2b46af78e85f3667eed855d52779acca88b31ba5d30f29f6b1f89556ffb384114e1387dba5f0017eb81fb8fb489f435767d87be314cba01962ad188aac0f2dc58039e25a83715fc9a4a6688eb6885854e64b5b77d25dd8af64a31b321e85adb1c507159382990836ee01a299bb10c66f078ed0a6585407b82154e6708d02707f27c26ccb6d3b8ab34bc75ba2343c687bbbb84b9ccb0f9df86501328acb71b9e1434c88729a3b4015ac0c3da2cabf0c7fcbab2e82fca2d38df77f192343cdbcdf574f0f57618911b8b3df290d293b694706546e65c983fc667f0b97fa46e7f7c5f2b68ba92388ede649b2af9817015c35fb6f8f7ef96ace8c8bebac574e0afeca490298198067c9b71da6d39e8b2061ecb2b4ec6ccaa6c61762c4b398ab55de978a747c170d48e9bc25313807c570221901b9f5f8c2b03b6648e53723c7d448e30e8c0c6c17c7f7d8e56cdd7357c351f10070ecbe1293f4f76b3c69da2b94e992f93c8ba9110aac5c501144485d1bf122fd6f92aa89c1f9570ed964d38e693329e3e961dfa4ea97651cd8aca4d84a4415752769e73aa6546eccf16cece53ddff49ca3ef08e6e73d48440b72c2108cade6bd3d261affbbafb1f653d346495929e69c21ed106eadf1ab783ab730f7bcd420d1f64b0815255d38cf3d448be32e872fe43b8e3ecd3a724bf17d5bfaf9e8d9bdfe35fcb41af4b0aa71af6fb50ef199f576cb9b8e2be1d37f8e045a7c88be0b3481326dc0ed1ff8a1c603c8d86357d172e3125ef6957ca2ecc6624926c3b841dbc62eab74cc3c162faf3f257707c4550a747a6aeea2a803e4dd1deec5555a5bc60c95f0bbe8da7fdf971f8756acda5f8d47bff9d51d58fbd3cfc1119143d86f625604e26eb83b015e54e568440bd13d4f46754b48aa8b40a166b7d4bd62d1b0ab025fdc869b44f3fa12355348a4060fc44f5781ed588a700905257023653d92c64ff82bb166cf96a1fb5f4d8157ce3e62fdc2d0b8a3f7e28dc3a8fd8e671fc821756cd84564765612f05eab4433683bfbf33eb1a8339fe8a8f02adf78b85baa42e82fc8594e6b32e74d2408176cb3ca2cfa76b896ff5b1a5ca6bf523a641b716590954e8830ff6fcaee9727ae4a359d52738089df5a0ec8ac70ef10e213cc9ee7c75188288a81e311f86e5c801ebb7e448241c7defdba125fe24ec73c7863fa407a03f9544971248fd079753cc04424a4c8a4bf8123a2818d867aae12770ec70232341cb48bd3606ea88359bce7226ff9e6d22bffa7a1e7368f8cfd3dc43dfa3ef93c6e0e08d5e189969ddb9c81abc4cf271ecbf45e932dd956efa8bb1c060700453c15a4715d81db456effabb84ed09c02cba13ccc031be6b34fa79aad48f12bd2906d5a8a9d4ef167287c8be79a49ac1ad74c7d200bdb72eb9cf3838e777da1235d15fc5e97fea59a5d07b4b6884046e6c738bf408bb376e2cff618940aaa776a2091a8429f1d10b079f5ab938df21d977da5bd26229ae7f5a5c82f5b1e666f58be88af04a73797d9b56af410aaec7323558045530ccdd48f44595678f8796c8a8f05e2d3be5483ff41f3c63e1259610c058215361cf0a2943af5fdfacb78a5d736759c911c4447914f53116a5871ba24813ab2312ec036c0e1aa2d6538fe36188246e83bbdc19665b4f4050219386eb9541b10a60cbabea7756320f6ed71d15527daa4cece72c4f8ee4645956b834ec03f01330d7d21519c5700437427b13690e52a5977cd6160dc2b83a36bda8837911dd907d5cb4ea5a93be5df5da8354bfbf75dd7c223f5eda84ee5a7999e4bcd08b54a6e86ce9103db1a807cf2594e903f02889f8ed72daed620414de6c27d984a3ae94590351cd0b9adf85cbb5bbf777a6fb31a238c458b36a0fa0b97971a599e1a66cc3eed5027c2b93e234fbaedd492ebaedea095e41b08875bb61a331573e33315f54dee1afb43418c57d1bf77ea065a9dc304a5e7ef39cbd93033882dfc366105cf9b69c8c536a22166ddf940490bacb9b5341430c8952d71c8e8e37d7077e06144a24e1da3d52ce17c68fc59b272a2a86491da9c8b381cb223751b823a8604a8fe57405bf94fa6f0cd445c7dc582ecf39d067ddbd9d4f613e765e4219808bce4d1fb5ef3f0fdd95947d1560981740f2bd1edc754d54384d8778b22676c6ac7ebac6af00d5cdd40fa01ad90ae90f92e69cbcc0899d672cac648cbd2e5515be04f44a29acdd0ee7dcaee96e7fe4038b78563e2df2684092629dff6f4f7ca5eb6ece3160eff21283a24888315484db6a406b5543d92fa84ca7de4bb9ff1c49bdbaaff5a540cd6dafeafffc0b4ba7fa484db68845afecb7538ed1fe5d3cd1f67bc07b3f59f8ded9501eb345e99f776babf000a76d301928aa1a63201ca7c639e9bf21cb1f1e8c00cee83eab1525ff80f8dc334f2f6d20cf5d8e32f9ec26d65b804b7ee81828d20c62e1aacfeedc15970fba14a1aab87ed38a2b86b15b606a256bd9f24cbd6a4acbb8f138910541a3a2a4fa5109fcce559a5f1de5b6119c4c2d59f2fd1ee98860c5aa6b5cf54fcf3cc84356caa7addc5063b13868f7d30ef6ed00a516738ed5a363d731e4a607d0986368649b702140b9a0c721136b92f1f8f6e01cf6b3f3184dfbfef0587782c40f3c1bc9eaf071bfca7701dd1be16ded240f2f1129d83f5316e050547603e0a2030d7247b29c67802e3071c4c96b23e5cf4ba8dda6b9da12bb8696d95986b955b477f2ad62b403b2ac48e8f0d82cb68e38581118b3ee7c6fac44bb8c4e5fcff9f0f5f4d7a92a2a61cf15768a49e2dd6d6333b157301231df2154e7220c4df16bc73b055c7cc846971b6ec9f6e4e352cd9f7ba76cb4cb3d360ce9f5a099654660f124f0062c338fc9f49ca3d480c6c9dd4922a9b94476ead60ca86976e4757cacc47658df3b1ac7b23ce190cda2aead73789d13d23b3fac6c704bd2be0caebeaf6624bc3a767e514c73f2c416a842e821502432b6845060604f96365c9e28cc2a0939e89e3ad328406c854985690a9ef98abcbad69099f1468c9e86a1f7f5eb56fdb7f5cccde962ddbb438db4e0333135b8c2116691dc48458f150c20ad37ea08e85ac4ff1bd4ac43524ee934d8c9d636faa0e5c0dfc2a3f6c52feb307909803a6aa3997d6ef7c7ac18f9eb9ad7085feb43aeb0a3cc4f6bf7ce7eff7586542d8567ac8067e075c11d9675e3b8216a8ac26142fb809bd5c124706c8d7c3bcd82ca394a6ca71321fb565fb60359c1b60d0d9adbe411d24c521ccac285e28095ecc95e41fedc0874e40ba569379b70d09b520844c2d6c8544399bf9ec23b9d918ac30a87572873e5f72b40fa775970680f29d5d1feae8633e89b172be4fda7ae848cc4f51e84c0801fb5fbaeb41c12afc51958622ce6bc245b880517f0a57bb9dadbc2cd12857d3d7541a93ed7ef98ca03e243fe5c0c405cbf05409274715be804ca992126acd7b31c02e656361f8c3f29e3fec876bab20eecf93e513e41ac5b8ee6721569d0b150816e6dc60c0712e6f7a54a9ab5c255ad4bdd8c684d629db8aa63f9b5f5624034cf99274043c8e1aa39fcd010892721bb887da42d4f3d3fdabf3e3954f05e349e886d6d595d65a9f15cbb234a6320969090a89b1b4352b891b0fe028eb28d3cfcae2131404ccec45d0350fc10992fee395306608d8c43e9613c638e0da03e9f0feb5e088894a61fef5f293fb2f40cf3b11c0414359b10bfb6c9004ec6d82ae116fcdc38bb0064c3718ccdae6dae63faaa562c5e642598918e5c898fb042680183d7976a96e49354282c5278d5a04ec429aae68c7cfce49e577a6907ff38d28a91a833f805a81db3440a55eecbd8aafd37146c991cb3d548596a321de667b18eda4f597e87d7a74b4b5418a22debf969a2970e0cf46803fcfd3cf55c3f6683acb78b06211a1d2d96cfed63250a1c873f89795faf3461f000ccb22157950fa5fbcdfedbcb8d6228071611b9de1f14cf21d8944d9c5889d66f2a2cc65fbcc7d1175e3ca9a187b51b5a177cf3acb2327edda8f47c9f31b6d323f1e36afc7c7879a4b057ea7b4345aead74239ea58a8e3c1461335ccb9505d074a1ba9874ab59072dee077bba188e5dc6ccc363db32d8aa773332c79fbd9d80fab03aea0fad4ab7d7deb5fc96950095682de164ce52870abc441d96362dd18124deec37dad0fe1434bb55eae103d56c4dad81503a05adbe06722cc05edd0250cb38d0ce4b0d4f982a1ded0f1b4d38c6840e72c2954acd23d5e96354706f2d5261262617e6b5b26937dfe4404de4e301ceffe080f3b94ba6e06cbdcb98958b78169a9986854bb7f33a5b8c5fb6e553ed3029afb0eace50c1b3e8c73d2d09ce0f8395fc84cf47efc620a3460214a85f9cbd66cf7660147f1d7f623bc911eeea53d3057a76a9a11573b2ad411bbde3fa977e5deeb47b86a399352d2dfb18cb8085896cb25df295e9c3da9dcea1b528fbaec2d05ddde2d7cbef97bd96a396fe6a47ee77cac6f28ec014a725556407ec8c61defd0036faa8dc39f12be4158923d8eaf6a5906f726e912719a8a3251ecbd4f07183082be9cedcf1c550c069207d14942316aecf16132f8fd5034f657c5e42c6c157057f3bf9704a42814a4b7440e5ca54e1970273d8b2cea7ac81ceeb5402817b8d789fed87037693e1c671bd4ac882584969e77f2c8cd538899fb6d141b23fbd20f087525df6b52b4ec8267c69ba9c469a5ccd975280de9c024146c404b11a5bd8ad9fb1bb415969b7b153f67cac5c99f95c2cb6c7972bd50a695de32f1c8022c0699f80c62854fd2c0cf0501ed3fa64317f46498a2b9f673309f9887bf3879b9a26917c06650a9c6feb6bfa3fff6bd8ee97bc99aaa8e34dd366382b4c19c55e6b6a7678250c9dbd9ba2f595bec0af53c168fdb3722181e948166059cfd1865e1a4336fa00aba5884d046ebb249b48922b1b7cd743d509e0cdcc7b82afdbdb61e77a8a01efbda7c307caef2319de3c76fc42142d86b14829f87ee0e075d54ef835456654fae36f12c443b7fbbcd6276067c55370eb9c3732e8cca77593b7162fda99a4ec2deb92486549fd93d3927e778eee3b94a2f521d2185ee374b52f3faab95df117657655c70057b1b5f257124081f09454632478394df8ff38da7d7b5b7a7a4fe6016e789792d601f26ea8321bbb47eeeb38b962b0898cc2d6a40c042314e26a15994cde882e703602578b771d981ef5d86ccc85ade371ff1459dbbcd2a865f8d119c82746899c7827159fedcbd9e114188d98bf4afeb75fd890563e0d4276e483570c56ae17432f2bda555af3117735cce3c3864357efba97b7d25d19f008fe53a3336dc777716379edf6c9522bad6c18c10464cd186cd2dbaf7bbd3a77323dbd09bfa2740e0e0803b960ccf489a5b8d4e622fc18b5ea6182d0ad48aa6893ae214ddc6288f252ed258a27da2cdda9b0b71cbcc09598cac65cd59a54d67d0d2a3505ed38a21c63d2235a7f842142bbd0c9ca331d0249ce4206b874d2a0b921dd1b58", @generic="ffbfb649015cd6c4c461f97b72d7a6013748a743a5ae65520c439a4ce1ede4b178af092b9140539f7fe179bc9577e8e1c974353bb471e64fca37d0b11ac5353d5f37687bc0b675b62ed51bbf69459d32afe780a84396c1ae3579", @nested={0x84, 0x79, [@typed={0xc, 0x2f, @u64=0x1f}, @typed={0x8, 0x32, @u32}, @generic="f52ec3e9f99622ab4cb0ada2a9fc8681412eaf9caf93b35535bda22691255fc1006f0d01909b5fcf7fa374e6afdf8ba8eb8a6e67d8d540bfe737c0a0b8808cab4a1c24a6851e183f73c6e46bf2f756bd30546dd49c006588c1a767aba075c3", @typed={0xc, 0x86, @u64=0xfffffffffffffff7}]}]}, 0x10f0}, {&(0x7f0000002f00)={0x20, 0x27, 0x400, 0x70bd26, 0x25dfdbfd, "", [@typed={0x8, 0x1f, @fd=r0}, @typed={0x8, 0x78, @u32=0x6}]}, 0x20}, {&(0x7f0000003080)={0x1fc, 0x2e, 0x4, 0x70bd2b, 0x25dfdbff, "", [@nested={0x1ec, 0x8c, [@typed={0x8, 0x62, @fd=r1}, @generic="3008b1d9ef5076b27df524649b94a3921f7918c6ab8ab0aece51f69d59bb8c7ea2fbee132336967f8814107b6109b79b42672dd743d453f454b2a97ebb7224cd0bdea7d6b24e807e2e17d2bab32ae5a9c0b7cfe691e7da6c11f587f73dbc363ac02fba9a412d3034d05f6c8c837c06cf0239d7bb5d587c32307cc5380e25651e34a1b8e7c193cab8b46f13806ca4da90983432639d5cf84d8883554f446f89c1243f2901fda8c69c015f1f7df6eda951fccda7839aac258a3ccd142edea51a18fef213ccbe71da44695a0f2069e3279ab9d61191b21529faa2016c7c", @typed={0x4, 0x2f}, @generic="c31250ed88b77b81e29c64686a891d7ae40d8decfe42eca7709ecf00d6502af92df5d4e21479aff47f9db6c9bec18f70468879540bcf824457ecdd", @typed={0x8, 0x62, @pid=r9}, @typed={0x8, 0x17, @uid=r10}, @generic="a87aacfa96c0d100afbe4d921ca14af99ab5f6a53430c0f2d1fb65b9a31e254e7354a8be70dcfbfdc523d0528004c8e3dd1f6f3495a6a64de43e677a75e900755695a5a5cc65da00a636c3fffd2b78f0fc69052ed018744c93a702d63e68add4c2ffd7fd8298f46e21732da1b3ec98502138072635624a6d6bc7b0cc24fa9cebd105af952d63effb41c4f1ccc4267913343c1d622b40acc7daa52a7927b69959d6d898e8fd59333389817b5dc2709ece771be532"]}]}, 0x1fc}, {&(0x7f0000003280)={0xd8, 0x30, 0x1, 0x70bd29, 0x25dfdbfd, "", [@generic="99ccb24948", @typed={0x8, 0x6d, @uid=r11}, @nested={0x44, 0x23, [@generic="a84c17972825c22b58e912a3d40b393aa0e5eb97c9dd405e2dcc4da090fa8e24d80c15419d28", @generic="756ad842ca709bef380eb232b3d2bbe0e41f9c4f22a7395eef"]}, @generic="0c1e632b9d66a5a574587a8c5bdae15862b185f5baf0b6fbf31817471049cf8a752591d08cc8aada693d6d78f3a6c1640ad9a3072de82f0772390c414e835303529b2e45dcd1861de51c151659472c8b5497eb2553884397dcae0bff5172536fbefc242da4614ec512aefd6983818ceced64ecf1dba3"]}, 0xd8}], 0x8, &(0x7f0000003780)=[@rights={0x18, 0x1, 0x1, [r4]}, @cred={0x20, 0x1, 0x2, r12, r13, r14}, @cred={0x20, 0x1, 0x2, r15, r16, r17}, @rights={0x38, 0x1, 0x1, [r3, r0, r1, r2, r0, r2, r3, r4, r3]}, @rights={0x20, 0x1, 0x1, [r2, r3, r4, r4]}], 0xb0}, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1567.318270] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.327812] binder: 14130:14136 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.336249] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1567.345369] binder: 14132:14135 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.354153] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.360730] binder: 14132:14135 ioctl c0306201 0 returned -14 [ 1567.394804] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.414305] binder: 14138:14139 got transaction with invalid offset (0, min 0 max 0) or object. [ 1567.418779] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.419899] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.419907] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) 08:14:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_execute_func(&(0x7f0000000040)="c441f9f7ea2e6442035600f2416dc48179748a400000008f093090f8260ffda00900000065652e643666460f38378e05000000d9ea44c1a96556666600c46164599900000020") r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clone(0x4002800, &(0x7f0000000380)="c82939430136c37fb32eb3d0b49fa7c03772b6197764f678ab5b45ba2d84b495b079d834fc81e8cc4145fc6cbe7ae685bb15b90de3a2bcee9a4487c28c981dc4908b441e1592366dabb95e4822c9166eb47bc1930e4d3c041d5efe9d28e4c9e23e446d798925dd2ea91bd15ea8d57ec074a199faa38b0f299316ff658143eb5e1d20d69dec2de3ac3d9a2ed62d0a60e027e88a6b1df26fb1042d53b7044fb87ce43ac4fda566464ffd3fdbf98fdb8de58a9a7ccc47b370a519662345aa91b9115561b2ea3f88c33cbdcbf9aa1eff321c692b19407aba863c96b79b98f47399c9bdd6183cf10db1dd2aceaaa83fed659d2e129639b6c71b4b6ac11173ae10178e360fd3a183442fb39c99677ad6b7f0f455cca9b7a9bcab44e8883e8ccb6f03b8d8f6390511c1105e8e970425c37e91f9dd2c9dab58ce221da097f30c0787a7cf3dc2e3e1a122b4732e1152764c8d92840e212be94e056679334ce01b8bad71e035cbd1d9c2830b35eaf26630a64f28627d9de513067170c2ca142384d6ec546f32a21589d3036384dce2da5ffb701e410b604491844ee6519667201ccb1b1c4b091acef4d18069054ef9a2bc77fcb10479658cf5fff6d0de955c4e0b67a7a1e5cc1e553a6c64bad8aabd6cf2a631233f3c99bfb3cf1cde71274b7e1c71512aca8eab25dfe474d823e3219da35ab913ba33e58a560c0c3fbc956a5b890cf0fe17d485970de57d7f50c570668861f30921f838fa2a37b092b4bf2c301b8df37e0c23831e80fb3e90fc92413837f6e6ab6e0a051d2e2a2e4cfc31b46095b5986cce4533fe1bf8839a84e8c2c3241f5500cc02ec3b587ea11b197f96c9e8b96cde5aae48642d2011851aa8e61d94ba336da953ece4493db8fcb69130ac93b55ae4d8db55d1e194ef3db108c680e1febc720f85ecaff82c8ff2fdc864a566f81934afcc507e5923bbbc920af4af43e6e18ad1c6cbaedc420e8487634c96cba140deef48e7df161bdc2479f966baf6e0e56816866618f8c67b8e4eeea923ed35928f40601337abe0b2c81c0b5621ac26d23252b3191642d25325dd5137d9a1f21335f7f4f7e330bc525c3cfb7164eb649ad589b25052dec1552398b7e8b610191a055e83aa223ab3fbed5080b9d74e1abf0fe7373cc4983a817b27b32dda2dab90af684423410e3bdc0c77cadc5da0831a359ae1dc6db5e313ce0445f935713537e437dbd68ebf9dae54b7b3e7119fa0a961342757ff0de9cb566da3e673e804bdec45a08df1f60b4e168a4d965570124654c105780129b0b60dde49fbd38869a68bafd168ce501be003210f1adbf2f38a9d42d0f839cd5e8a35efdfeb0f3bf058c2bf9c98a470604d446f79ca7c3d1ac9a35c8c2efae6878c9fef8d1dea90e334559bb89befebfb29006b31c8091e5d54d39ba1a5a4bcfac7045f832c73ecc8431d3b6c810de8c33b5974d7f3f3519da317af5c81ede2268d31f198497ccb92067fa1a7078bbe437b2dcd5623db5d413d5a41f7435ef156926c149bffd549a0458a9e925c1ca80d13a55e4950d135e6be4ae24ecf794d1b7a98a1e126656a908132091f79e9523362649475ab8196653e59dd6fd601c66f2f6213e4e3029f921eb684b845d7fb4c7ac8e9afdb1d69cfb02cf64abdbb1c25574a483fae2c0b087e1599f50494faac4b3af5a00c20f3dd69728e9c0cc14cf137f982b7d802945fd2e54b8a352559dfe4a5ddd6fc7fc96e5e0115ac81e1e1295c03d69f265e3197ffa27fb25d108ed5c53da7b60efee94d5544da8767941c7bed27c8cfd62e01379203a0eb20fec878b65a0f53336f59ce5215e4061a5d4ff647c3bdc06ebf95917c9360963c9709bf4b072b5753405db1fa1c0508bf00513ad1c91b76791110efd17ebb542fef3fa41fae776abdabfc1bd3973db7a89feffc33f1f69523f2c3481cb63eda320036a077b794134511ca04660ae45a7158aaa856fb1b7c2bbc9bb16a9ddd879110b4c15c80e3ccbc321d5fa205edc17cde127dc7a27b168a08c8fa7e1870198bccf7f931ce15249c4faf263e19f67562b9770e7b4f80eed57e552bc2a14e642acc5efa45eeac6ac978a33ec0060da38a430f25365148c449e584875aa3a1a39e78ec2f3fe7516cf5967078ebc0a7f7b387c145e2a387a38a966790d804154255b7b0fc7e0e36e3aac9228bd5d5d39824ee5d52ada539fa626e60b19012b17cab8bbe9c3ab73c873cabda5e35d8208e91221e955e3a954842e323920695d5a1f7abfb7b3a3cfae37f986f65c26c2060f8ebe906a87e32a4dda9743f390f03bfc490632b55a7c8ea897490675fcb12bfc71427c3d1684fdd8f11a4d18307b2ece5309b26d523513e5788fdd90cab9420e68267462d711ce2a205d362e940974ade25eb252226ebcce8bfef874460674093d9e77291d3b03c8a06df31584839705fb5ecda7210c52b706ce393849f102465f13b8e5d59d3906c680bc1f444bf527a858f89ed1f0123e2b3b434b351ee5f5fba9d447a8826ff98009fef8d85b6ab8cae340c80d84394c37d73d10267a02204a2a9e7f601c60fe63f28f571216008be7ece41f78b7c367a2cdcbeb3a6be335e8cb41aa0115663e66e43d900b48b7d9f20f7e3d306f1a3462b3078d6e11d3c351326e9a2030cd11281cf01686357405fc1639f61b7d265143777c6551d161e1d1487abee136737aa1e060dfbbf624e57d0d372cbfcc0a21eedc29eee881072ec366a6deff19aca4f6877cf57c7ffc40f252786f5a5dcd98e9e21a7f927f840eacd221f1719bc0ebeac070b3d833a9a40c9795f2925e6f64d550a453c3da2abc8095d42d58d8cf0e70b1d4e316127a2341ab2980e402690c389c7adc7e2063c318c02572b68368b2caaad334d246b7a2b56b3ce128fadc34e4827dd0884fb186504bcb05c00c7191218a9367250cbcbee629cefd6a36b9087897ee8fc7ec4ea4bcda30493404fc61cfeb4376255495cab4bbcf401f27d4bf956e62f9aa8ac3e046065da875aa97b39aebb097cec2473f4e510a4f8d8e6b79a350da5d63cfb7c2ebc1311459bb235d474e908d80799c1a9dbb0c2622b9aa4e2847d3be61b4ef371756532ad60440286417fc934c32a081ee8b1a4aaead51a62becd3a3b7728f8aff82cd0052749ba8302de5ab6fde6bcd14df877c6e00345834f1366d7504202ae678d4ac779037507f1268e4dee2987db6330336626cce479e5e429f9c5820d259b60e00a2b22c89597ebb1ee5f2de4611cb2247d17341e4b1c32f294b564fe5313c845a1c3cb38ca2e797f2641f45ace51de2ec0212b3786f6ac2dd6837531bc2af1fa48a934d7f8924a732dbbd13f6fdb57912394643279d032688850b4a817488f377d28f1164c994574b5505438ed396de5b2cbee6cf9ad80be701d0e28169dcd06a5bfe7ccf6c32b7ec73645bafafdfd0b9cc1d12c61b1339cae973af84e5ef651d3b88e8013265e7eef7199ed13685938389e038b2eb7b956aa52ff601b44d153a7b6bce89b32c0369d93b887b912988d88d78d5df1fac93377cd1b03d158f8e68a2e17ad64895c0f26399f99d282da5846871b2163ca9014175d6115be45d1202400f01b4df1b53cf1f98991334c225685e604b167b63ee5d8e69f18b1833cca3e3925f3ca52286f75cf4fa4c8cc72f26a87b9198dd474b5bdc8ecbc642c94b3bc4d121343a344dd8ffd25a94b6fc3003a6f39f761c03f115633f702cc713282fa592090dd2703808df4cadfffcb17a2c72aeb405f73774df8b069b93da9e9c9e679e50185a2e3f30f3ce8fd8bb38ca3aa114f6f5575ac27fd8c2191879e01914bec87ed2a16e895f1f7f3e6430b52f743500487d7fa55f8269cb09e4e7943e193e21a3d3aeac03642cfc6f3462ce9ca2c8e6d561ea8d896729910e744cd23dd283a0d61d2db03a13b118ec5de811b5b1125d3f932e1c5422a742d100f38b587b98b89a262e394c5d741657ffd6fea7b0afa1b53da1a2bf1b31af2398a601c287ecfa087b34611f5e2bea37166aafb03aa417fa842deb9ffbfb7d1fd0c5516396b6efdc10bb463c1a4e650c720945ffada88318bf928cd3ea3110b4a45ac4fcd2b5d38cf8f4d712d708418591f7e96b0992f786bad0f199735f1f21ef3c810b9659263b56fd8f39d8fed0b380b1bd8a9ea12b16bf732d0ba77846da5287cadd54ddee94801a0e8d9e3cecb906cde302426af1e01be5d7e71e6a5a00b2fd342cf20356750211c6e0a497bd49dd7bb5ff5ac824e13eabba8315351f7dc9013338f89145a641949279fcdb7530be442d9c09efa666e120577b1397509dc23d4d3ee13a0a6e620905fb4b3c36240796971ed26bc17b7591c393f17d7a181c4cfc39131c6e2b6859a50c9846ca2ab4c22eda4000c2d92827c7988c3fdc174ca5f918631c1efe3329eeddf395e51a480e6ad5dc1878f618b9bc97a1f05fc0e0df1b484fbcba37e7dae64bf372da33f976802d5b3300e9f86ce324914109ccadc5b49d4eabf2243bed57e8e668496baea65ba7b411facf18ae38eb0667ba96f649fcf94f6fc25f40f3c0f5fb79c2eb815eb7ce84486d64a0841b23f0ddad097019f612a7e4640fb28c1dd0b65b1859fd6467509fa0c76c6c4986a67bbb3341246c084456f9183d4b5ceaeb86d3c4e828f1db6dda0d983b0d9c570242bee48dba9e5d325ad26e89085fb9b69a92d5c4ce876cc163f17277de1758986506362b0babc4a04cf41fa52a11a527b0edecbe8aead99f01f9e1d005f5e31c3629453e67970ff16de0d6dff6e851eb59951c3a0f6e5baa3ac05bb21c4f7e11853666e61dc366e66e94b29f2442061a1bb8585fa7ef76dbf7e161e7e99a89f18d92a672d9fb39180a554b7c2e597c41508b7810274d85ef3166968652177d53e463882a210019f25e93ee0b7a5eda53297b643ca04c49aaa1c28881f1ddc7ab371c3e7746465b8a7457c5666987a6f23c32533f0169850fb59f7b2ee0a425912fd58cf7867e7ffdb9c5dc1e59fb835f954c6ec402e1e696f5721fc7b068588263ddbe177fe3df203bc89228451c29f53f2f67fb5bad90af9d5cb27a6ee046c820e49388b202a46ec4ca668499a4f80d3012500396b19b2f7871e54e50d4a4ba6cd05bb5bfbe13c23047a03374986fdff7ab69f372853309e11457c8005e537572aa32ee675c9d3cd4352ecdbb224ac94dcb6a7e8ca4d2395230003820f7d5f79785d0649c942899e8661cca418ea7224857cd6b3508d58918cd2e73a3e5f1f8712c92b4c62055e90b4054d9a040f560f9c98dc0389be5e61ac799f6c536f68c53894c550bcb8499575c0a705ce829cb2e115027edc673b6cd7541cdc34cac4833460ef104c5f6c3aba7b3a70c489d1c0979413bade216340fb484e4cc92d699c75fd3551dffeb2606c7d150bb716e540c26c93f7627a25368a93d32bc50302ad2ec38e81551b04894016c75068cb10d23494e90fd1953441f9c26d2de104b63b86363747f9f05f21890af20ab3bc03b9e21c884a79b2bfdcfd872adcfdbaaa28eec392491cfc78ddc4f9d6027ca14fe18486f0165d41e012e56bcfcd513babfdf83e6662a41552f3d61e53a59d61f96d574345b5f66332a93da3612c024aaed5b8d8624f234fa4379ffad255c05d14b9d9d56a21311ca80a9670271192e527aa760bf9b839f72447acd66ce48db410244abd8e43482978c8ab933e41ae6d9b76dc4843a2326de8e0c08f160274f8dfcc3bb56364e8aa5282a423e05be89ac717f8193623bb7d474d7fdb00f43a6f600052b8c8", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000001380)="88f49d33e831ca5704aae0f85c1a226bb3e1f96ca53527c5d262b4a519a5175d80f204d293c2de0d2a040d50f7d171d09ebaa80de517fe0a01727766666360b6428585f9903ce24195c49386886bb67b661f0b7c9f9d0e9d1f6d784c2327f54da9ec9fc406e9235d2bbd111041a32e2cb94eb46a1cd10ead22f977d27b560dd9122b0360f0e908c773129f41963387362340dbabb2ff49298b580f8ba254eeb57c1b7bd73bf8b43f5c07bcdfeb04eaeb5d824bd9363e7a03601ef3c4065d8d4848af597b61ec2d888151075885d1c8") timerfd_gettime(r2, &(0x7f0000000000)) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001480)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r2, &(0x7f0000001740)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x88400}, 0xc, &(0x7f0000001700)={&(0x7f00000014c0)={0x230, r4, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x34, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7ff}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x4}]}, @TIPC_NLA_MEDIA={0x44, 0x5, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_MTU={0x8}]}]}, @TIPC_NLA_BEARER={0x28, 0x1, [@TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xe5e9}]}, @TIPC_NLA_BEARER={0xb4, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'ipddp0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x800}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x3, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x17}}, 0x4}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x15, @mcast1, 0x3f3}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xcf6}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x8000, @loopback, 0x8f4b}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x5, @mcast2, 0x8}}}}]}, @TIPC_NLA_MEDIA={0x6c, 0x5, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}]}, @TIPC_NLA_SOCK={0x2c, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfffffffffffffffb}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1ff}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x401}]}, @TIPC_NLA_MEDIA={0x30, 0x5, [@TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}]}, 0x230}, 0x1, 0x0, 0x0, 0x200008c0}, 0x20000000) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000000)='security.selinux\x00', 0x0, 0x39, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1567.419953] binder: 14146:14150 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.422244] binder: 14146:14150 ioctl c0306201 0 returned -14 [ 1567.429819] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.444420] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.444429] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1567.444474] binder: 14152:14153 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.456163] binder: undelivered TRANSACTION_ERROR: 29201 08:14:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1567.481296] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.481305] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1567.481350] binder: 14142:14147 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.482200] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.512563] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.512573] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) 08:14:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOC_PR_RELEASE(r2, 0x401070ca, &(0x7f0000000000)={0xffffffffffffffff, 0x7}) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) syslog(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1567.512661] binder: 14149:14157 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.518890] binder: 14149:14157 ioctl c0306201 0 returned -14 [ 1567.523835] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.523844] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1567.523891] binder: 14149:14157 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.529241] binder: 14149:14160 ioctl c0306201 0 returned -14 [ 1567.549422] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="292956a53d5227c97d4da7e2dbf3342145f64bd93b0f39ebf0ad0064bee980fb9cf632569aa30dfdf62e9fde98c9128888f0e448be2c45c53cfa3e5b15b335b6ad01b4975f824677096a29ea3867cb940cb9310d0c7031e56533554f7fcca735a8086fa68f4bbaf661afbcc0520f3221cb8ec4e0dd8fbe0936aff5661f9b159c84004e637afeb7bbd5c6e36155550f67e73f84b796361943c9f145af991f74c488b4dfdb8f2f239b7ec8b7ab7a9e0d30165c7e0441257c23b95474fad9c97ca355a4b9b40353468fcbb43030b327ec165783858220d6701ad6364f2ab8b7517165f4949cf6b5dc7f6bdf176a1b1c3e20d0919ac7a7da20439f5ced11ed2f5a3655b86d6b192ee3c62533f329b06fcea38130ea8313c6021915177bde8f11abdb406177298b0c099c81158b7c113351f77436cfbf938a296b02503ae535ab4d9f39e35adbc125b9af5fdcf7eade4cb34fd27a15f8b8abeb1b2dbc", @ANYRES64=0x0, @ANYBLOB="0000f2ffff6b671d1f84dbf96c0698000000"], 0x0, 0x0, 0x0}) r3 = add_key(&(0x7f0000000040)='id_resolver\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)="fcaa9f6de68c4d2cc0ac60ea0df42fff4f6151162f518ae6c8f934858eddd332a17b298d", 0x24, 0xfffffffffffffff9) r4 = request_key(&(0x7f0000000180)='user\x00', &(0x7f0000000280)={'syz', 0x2}, &(0x7f0000000380)='eth0$cpuset\x00', 0xfffffffffffffff9) keyctl$dh_compute(0x17, &(0x7f00000003c0)={r3, 0x0, r4}, &(0x7f0000000400)=""/204, 0xcc, &(0x7f0000000540)={&(0x7f0000000500)={'sha224-ni\x00'}}) request_key(&(0x7f0000000580)='id_legacy\x00', &(0x7f00000005c0)={'syz', 0x0}, &(0x7f0000000600)='id_resolver\x00', r4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1567.549431] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1567.549483] binder: 14158:14161 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.554120] binder: 14158:14161 ioctl c0306201 0 returned -14 [ 1567.554202] binder: BINDER_SET_CONTEXT_MGR already set [ 1567.554210] binder: 14158:14161 ioctl 40046207 0 returned -16 [ 1567.578155] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.578624] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.581198] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.595949] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.595958] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1567.596008] binder: 14148:14165 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.622025] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.622035] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1567.622083] binder: 14163:14166 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.641677] binder: 14163:14166 ioctl c0306201 0 returned -14 [ 1567.683960] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.686491] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.697044] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.697054] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1567.697102] binder: 14170:14172 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.720976] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.720987] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1567.721053] binder: 14171:14173 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.733755] binder: 14171:14173 ioctl c0306201 0 returned -14 [ 1567.747418] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.751472] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.751481] binder_alloc: allocated: 12264 (num: 499 largest: 32), free: 24 (num: 1 largest: 24) [ 1567.752289] binder: 14174:14177 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.753084] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.772418] binder: 14174:14177 ioctl c0306201 0 returned -14 [ 1567.818531] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.828184] binder: 14138:14139 transaction failed 29201/-22, size 0-8 line 3199 08:14:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x4000000000002, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000269c02000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000005b9a5154b8753a30000000000000006872cc60ee5a3ba747d59c2d800d145f6d58331cdbe2e5042adae5d7e692d7486445fbf50f5118cb5a0c9000c97c117dbb09629c8614426842437d0cd705c599d4543456ec1cea7ddc240f8c9f1df6664c51b4e425ed6", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="001e0b976d6d238e5e6c00000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$P9_RFLUSH(r2, &(0x7f0000000040)={0x7, 0x6d, 0x1}, 0x7) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1567.845571] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.873287] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.884409] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1567.889289] binder: 14190:14192 transaction failed 29189/-22, size 24-8 line 3014 [ 1567.891825] binder: 14190:14192 ioctl c0306201 0 returned -14 [ 1567.907109] binder: undelivered TRANSACTION_ERROR: 29189 [ 1567.916272] binder: 14191:14194 got transaction to invalid handle [ 1567.925884] binder: 14187:14195 BC_INCREFS_DONE u0000000000000000 no match [ 1567.931555] binder: 14191:14194 transaction failed 29201/-22, size 0-8 line 3014 [ 1567.935751] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.936049] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.936060] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1567.936125] binder: 14184:14188 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.936200] binder: 14185:14186 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.941159] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.941167] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1567.941213] binder: 14181:14182 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.946830] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.947145] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1567.947162] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) poll(&(0x7f0000000000)=[{r0, 0x2021}, {r0, 0x201}, {r0, 0x400}, {r0, 0x2005}, {r0, 0x4280}, {r0, 0x2200}, {r0, 0x5423}, {r0}], 0x8, 0xd0f) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) geteuid() ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r2}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(0xffffffffffffffff, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1567.947267] binder: 14187:14189 transaction failed 29201/-28, size 24-8 line 3137 [ 1567.947781] binder: undelivered TRANSACTION_ERROR: 29201 [ 1567.995698] binder: 14187:14189 ioctl c0306201 0 returned -14 [ 1568.022710] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.060461] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1568.068690] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.078725] binder: 14204:14208 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.079190] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1568.079229] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.079288] binder: 14203:14207 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.079664] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1568.079674] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.079719] binder: 14205:14210 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.080264] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.098817] binder: 14205:14210 ioctl c0306201 0 returned -14 [ 1568.127617] binder: 14206:14213 got transaction with invalid offset (0, min 0 max 0) or object. [ 1568.127711] binder: 14206:14213 transaction failed 29201/-22, size 0-8 line 3199 [ 1568.141108] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) getsockopt$inet_udp_int(r2, 0x11, 0x67, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1568.141116] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.141161] binder: 14214:14215 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.141745] binder: undelivered TRANSACTION_ERROR: 29201 08:14:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x200, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r4 = getuid() getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) fstat(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r1, &(0x7f0000001b40)={&(0x7f0000000680)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000019c0)=[{&(0x7f0000000700)="e6ffb5280a67230dc6942ff7e589d9c9bd54e31eff1847b2bc303da547970fecfc49ccc53f4db57f884f77dc63ff8d3c6ede59225bd621b58c3e79fd3fbd11db63aa11205a4d7fb912fcdd8979781f77510e21ededa98debf657140e88ebafed34c45a43311e1e4eb7806535c7628c36d5395bbd7ce0208ea0a5e4cd69b0480548bb17f84ebc6e7775b48356d78ecef3ceb643c2c2aa2ca27c660025ec76c7d17284fb53a160a38af7751327500105ed3c", 0xb1}, {&(0x7f00000007c0)="7540d71485f0c5cc2ec18ee871497fa6ee33bb0c1f072f14863a61fc62048df2e4944810feb259251b256e7280ceee7330f36eb015fddde45c8149251414911f305d47a7f658206bb704a5ebfc3d5372bf3f8097d3f540b5eada3b6510a64faa39961dc3d7c6a0c7b9fc658a5fe61d4463269c6cea8dfead02a135542f41b88d93e62b77bf811969bbc9635257bc21b8f80b7e980981e569094c97eaa0023fb6a2095d42ab07b1ffd25e095b8ed158d338a4887abca245c6ac44f01b996846efacedc802d6508f5221ea837314c038dc7b987c00dc5cd6e17d497c0c6506351992b8877c17985f7b38dab0741bf4cd018ad341f172bcb4dfc99629cca35a28d3600ba3414730309d594ae84152dadc99206557b565376a6d7228ddadf32fe37613f069d67c8ee61afa8ff0fe27aa6f8800bf29dfecd8e1d0615828b1f36ad7c969c9349a75552017f54ec464f33964416f1a6116d17ecdf9a2513a42beb21d787d157960d403e9967c23d9f811919391eff81ebad5ec2a693725c38e63878fbc0f53848b24477bd3fd9f8983d76ace5b60be83c0c02a67d817d0436fd80b4e10f5e22f165a553e4a1e2afe7dea552a491ec61723d7dbfe9688ab28c7af72f058eb805644aafa488d5ebb30ec65652e853d626d50524d2cf351ae26f2526de293b39c4d093e555a169f8e24e0b77726906611729a78f522d9f3575202823ce2bbaa18bf384987ca3cca78835e90fe9d5af17e5a5ac2ad65f7ffe681be7aad97587a41f3f75b4904d41dba2e25690b2731338167de8a00e4bda8c882beb46b6c32322d62a545ecfece4629299a36efbe79290c542b10897d7118fa3c01d718c2d981472ee707974afbbb303aab8b3d590bab39219867041870d0dd203cfd9f84782638091c6c2e11468fa698445c51fbbfb07e049a89012cd75446c49d97698afeb9a8657919e1961fdcbcbc3fad2c7e0d50757a020b9a0a282559900e233a0064e03c89efea78a3b893ed3588adcdb7547e88ec40d2a9a84b2e9410602d1df2c16c68da2dd26cb7e8bdb5017eae7325db9f3134578b23bf63633679c5e3f72dc99ac4541ea12af4f438fdb3e0d3db101a6032927cda8e4d7781bb941cc7d6ee4a48ba8131ab51ff87e1835a957eb38912f0f641cf54322b811d99c7932c9f25b9eabafd7f76ea7b1c98593c9eb2826cf705731fd462faccc76470f5cdf55fc21e85cc4d9b5c4026d6bc013b8edbb3b2e33fd8fd931e7104bd2498de2edb6eb36cfc150f9d264e1e1200c1dc48e66c2785374f17f5f44eff739eb7588bae341b6488e41979efaa18212618abb8d7fbaaf9181bbe37f8e6da387117fe7af2caa4fc23c9d54e06f531864cff52a1a0b7cbef5dfef65fdb14e2dade577b98103d89c7a7031310884d7ca5eab717e8cbfb79527fef299a573945ceb90025da89fd841bbdce488eacc96edd8e61b3641a0e404c8fb2e72bfaa0c17da060c46352c433fb9ab6773d76231bac33b2a7f981f55c2bacb50ad47fd74451360875ac0260463dae3e008025ae49ca10427a7e0b522f8ccb5c55767499c36f74ea5bbfdb953e170fc4ab685b2c36963fe8ce85cb92b9b49de0270f48c23726bd3dbfb63b720c2c2532d059dc2346217752be483903a0e6ed63f39a9d0b0bc7db837f91b3529e5ab299f55de1f21d469dc8528e7b6cad4570dc1029026c1b311b621983d099d52b414603c5ce43e29569acc38ab74bd6503545623d531f6602646d3b5041242ff128661a638eed5a7180769cd8ea0bfc3945ab9d9c12b425d1ecaf54ae5155fa33fbe569427bee59218b753fd206080bd49138d15429b6f193371e70d79e1b73218919a2d1a49d58556ad6e972300918b28387f74ae71f6e49414313d51773b7c89486e3dd4136c001063787241f283ce66fe3958ba3e512ac008a075e75391cc9501f7bf6a0698dfb6d27cb2f9aebb09e4aa14186f6a9a3b851d404965cbadd016e1f11d260484919a917d23d69c585fd236602248b07a563bb3fe6eae75ebd8ba1ebe26a851927a420172232142049a4cdd16e5757adb982b7929647ed3d8a3312bd786c692943d73357f1f536827c14043fda2237d300062e47da9ef86bb8d26544e3888b713266c340b521bd68aa67413f5b0fb28d61f928d8024a0c0670851e5e248d462bd54be998682caafb4e134eb91c62295626ca3989ef329daa042e9d6786d7495a3d3d928abf108f6a0ad01f7f797ee6867837ace66ff9afbad0c0b597987f9863c55901582bded190c637b8bd213b16860579012c121021a343fab4b772415412c2a00eb4ee226cb685ab7c374b759761e62d5c318a1ef4cee64a55c2deb8aa1256d66bf9cd868bb9e68ab779f390aaa5997f221ec3d59eb002343b23e728d2d4d1b5a636bef13d17ea88e8f661560348889c8f7cd6fdc7523759697939c9848e44f96a851861daa6f2281339cdc12fa14f0015f20d2d6743afa147d498b6457df47859ec9013a19952a63658df809496390dea42d268745cc25c00369c3d02d0d3ffc27a677db7ba4be0622f8727fa625df0ae031b38c68027905a527feba50beb8f76fc13a77e74fb3973ffa4daf7af5da1aacdda0035be5b32363ae3076b40f7f9ad48bf5905acf4166b5334aa34bd35b20956077d33cbc3c11c22009c2970a790ee41fe18192c78d532860b9cf846a5f9be7e8c8d3ddfd80ec51e09f012f0b6510345a4bb280c806ad24d0cc5d7195b971a7ecee5f942827a109b5634c76aa7a0b7a942e3feda967117d0af8b0ee581d140ae94342a59e03aa863ed02bf9044f5c35aac71e977f181faaa003072274696cd6f1c751cb7a86047240c2d0978baf917e83076f2ec40d2084af824beeae1b0b73fd677725e24f39118c2649abc3b5a250c75e688be00902e6f8ef4eabc528a9158c154bb42ed5d9edb9cf1513e3a9047a0f952bb42952bcf3474b7bea51219d7519b0c133647617e57882f4b291620e260ef9769df269d72914a9694cd3a1fd2af93cb5f7532127490e17bd609091f4a7182b17882de127b39842af34f3ae119de749bc31d5a163cb95d55f7358337837e8f1bf748b0f78e3e9cef768b276338723f5475f9cc36026acda4299c725cf0465d9f75c0793b3732d66dbacce4a8ccc9ba648642d54b298a12039dd0858f862fd101eab0045c72f4d88563a6bda1274e78a03fd0c24743d963ab42c9feb18f9bf5a72e024160da3ab5b7d3a3f8dc18dbbecf26f5207bf5f073cbf890a088e77531138e5ce70ceaf36fc5ad2258cad6fc0a3d38c0176a0a683812822fb6bd10aab99cfaad6a00966b9ccb92a03f508355cd60956ae4dcff68ebb934b31d6c0667643ca665dc7db95dd81dc685370063b4c864f32c3c27d40fce4c6668ccfc9a392d4a85ab569441fcb7dbde33fab72266aa48319f133864fb252935dedeb1dd2d85f210be57ce16e093550554d72e055e7fc5da537be632724508306d84d4acf7cc4500690f388a361401615e4e7cb2f7c3906b3982965d38ceffdd625cd2eacbe2d390ff1707d134270a4942ca440e12bc0fe1c3bfca7b7be4eb751af7c0e7cc09a1acc03a94944f9e3ac49e6019305e80efe9b17c52fb306f7d227a43b0865bbebcaabd66384ca47b81b07a62e0367ba95c6d6f978f6fd7f52f56f2181c24826df3b42a4112140a99ab3ac9c5832d2c20d653a30eb125a399a6444d9a5638b3cbbf4dd53ced27f88ca9a41664d5acdcdfd79bca586e967cc272d901df5c0dd89b5123f3bc6b966203b909b9f25e545c8de88c7208f470ddee081a18c442571bb9668bc7cbe36dd8b2e4cf48f8b602783a9829571fd5269e0fdf7e1c74ba8ef5f5e8a400f0ee787c09d9d56a8d56843fc22cbb337b84c86bb1ea0a6a7d99ed35a93c134a4bfdd0e262c14e184376b05f67a5f0eb1553c02f8a1e40cd7a4ec29d2db35791ba4e08176a5a769c7d2f3327207f9a79f73cfe61f4c8d737fb515f8dfef6b063ecb484d19e2a490623107a40bf45ff7f088fc35ea818523609e80f087c940c72cc0983485c59d51393406a9d23adc3777185eb77b5db74387a551f22d44fd89503e8ecdb5a6c493d2ab232f683f2b46e5132dd9bc38539449e4b4addf06e3482d7426205426f9531cbb6581715d3113b5dc7d4ce7486e9bf7703090ef88895f7739f5f0ca981a959684797247c4ed06fa3ca4b5892e798edb4ff1d67b5e0fd06d4d933febbd664b51cd86f5759e914e127c4fd47c86f41a2662790b18a48d711c8bd818047901e0422a0ff987edbdc2683aff8f50c98a02dca21a43652776347ba2b3453848f7218fc7fac41620807d378edc04d1f9bc7fa712a26ff6c21e8aab281731363552625b3ae48231d6a2f32f94aec53d07b8ca6d80edb5c144f441686d9c4ea69f25b1c7b17facc175e57cc3c47856733d174cdd47a0c743ed06dfd0b06d589b27a7ad551abb4a012bd0054e8fe195b587ce78dedb00df0b32daf1ba79ed7581c74ff9b25d5c7f4395eddcb11471a58359861ad4df039c60acafe534d72d16d7aae4fae43a43029e44c2ba4a89942f9b3edce44b0a1fb62e4ca240d5dcbc3d80136fdfcc260dcfc3e50ab56746a56f57095d843122ab10aa97cddd14cbe260101d2293401ba841d9a17bbdf05389b6f8862a8e2477abcb9fe09a2a709f088abd9dbe199e3cd99decf7bce831de0ca443202abe7d28b74a22a0708f7c1f069c927f4055551f669e92b2754642e7aed25fe6dc0a4bfa1e3f25f31b47b2fc92c4f151f93d01d896d4201043b596a47094f09aac0d56a3eb5287f6fef121a445ef0c2a96ef2fc08a22cf3d94a643a0a67c95289b17526b138b396c221ed096dd0b785a2830a9e67f1cc35b2acb7ab6bfd80716fab098435dd448946d0aad5958f76b10bacf4eeb88e5c73ce4170d938ea8749efe7ca0463c70479bce12f8d95749d66fd2af8f6e2977e55993976403a66865d3b7b9c480d3ecc6a72d28299d770996405c6a3fa6a42c7debab83a99208c9b87ea91a0380ac97da6300e2f7e654445f032bb112ade9f3908cf79467254481a9371c9969801344ebfcd82a35d50de861a97b8c8c042e2ce8b3fe930bcbe38323969976c7de1a8f43202391c21b0fa35b51c72e344bf3961cd3b57372a28bf38e8b64d5ef1c1c0bfba654cf5849f9a8ddf7cc3bc5517801830874267ffdb927e8b89a4e01c23070e4edb83fce6ad1eca1f79af64236fd4561dc6f41a37f6c1a03312495b1879c3051c79c8329170566672cc8b26207e01f5a2e1130cf25afcc24826d8816ffa2ccd2ce1cb4d76aec29c01c3c53975b803d9c27911ca2ea6f0cd1a4d8a18a904d24bab04b5e114189283fb5dd7a0720f02782b483ee4c9b32fa632c5b3149433314c91dc0e05ad6a8e074ad698d5446834adc9d1d4b7c8c05ef732bf766cb3254183032cdcd612352d4a51906e8bf675fe739f6a23f70db4464f1bf2dacaf3714c8c4b681135eee3bf3904639e992601ff420beee23e54bd2083975dffb95d0178376b70e36027b3d49914c950302b8aa08f3b88e96ad64fe3cd908a639648cab9aa1f387f035869a5b97390dff6d7860d3336a23fb276d3d21d38e01d6e0607613387d14124e46345d7c0c7e266e586bcc40a57d333799abf5f1133a1f664d6a7816491f42d50514bbe6cb718d48911271fa676460658de781426b339ebeaad6b9a9ce3661b37fe5e76709d57287f9ad008fd58bc604c119803f2a6665bd54f538bbffbf313795929e1b1debaa2cc228fa51bd34ce73d98", 0x1000}, {&(0x7f00000017c0)="32a09d380c6cad6aab00614c3c5ec4f55db76d4e4aa4961d3da31d1078bc8a85cc2db699354269e671edbcce7e4daa55e196d43535382b4603a3aa567b7f47239603d6a3ef7ea5721a1d60a4990211b5536f2998fc3a8007e4b655b570cd670bdd5fe93260d95f5cbd2b47bbb5d5fe64485323d82b9844ea08693bc2909bdf230afc5cd77f7b40366fbf61637109873aabc3622e3f692f6fde096c4da39c2d8d0d25d327a546762a574d57d214289edbd4f0f70de5eed708a6f9f309e3cfd648119735f8912075fb2a722cb477a9978dd6185c5bbe03896091fe9d11f89f9189b9f970a2439fed81c68b4ed0a2780bd07ecd87d9d744", 0xf6}, {&(0x7f00000018c0)="07e56e751b72078960299cf8f0bc86e620c3950035f49abb6b15553be52f277b752f083d0a78127f7561712195509ad21eb735a3fcb7e75c6d9fc69bad6db12555b770fd24807009f52b086682c90754085115e482c91ebc6b483ed89d477647d1e521039135d02cbf224fd9803eade4bbc88ae2ba1ef87969565e30d479ca80b439fb0104f0f13f13479525b7e4adfb3e571f82c99f42c1a3235dd6c2862e18ae131f83f4a0e539652063a677d59f523f311f213cb0f6de3e505ec73581ff13c123a6b6e2b8293f6b38c1c78f0e1087a951", 0xd2}], 0x4, &(0x7f0000001a00)=[@rights={0x18, 0x1, 0x1, [r1]}, @rights={0x18, 0x1, 0x1, [r3]}, @rights={0x18, 0x1, 0x1, [r1, r1]}, @rights={0x18, 0x1, 0x1, [r2]}, @rights={0x18, 0x1, 0x1, [r3]}, @cred={0x20, 0x1, 0x2, r5, r4, r7}, @cred={0x20, 0x1, 0x2, r5, r4, r9}, @rights={0x38, 0x1, 0x1, [r1, r3, r0, r3, r0, r2, r0, r3, r2, r3]}, @cred={0x20, 0x1, 0x2, r5, r8, r7}, @cred={0x20, 0x1, 0x2, r5, r6, r7}], 0x130, 0x10}, 0x4000) r10 = getuid() getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000280)=0xc) fstat(r1, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f00000002c0), &(0x7f0000000400), &(0x7f0000000440)=0x0) r14 = getegid() stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000540)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$system_posix_acl(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {0x1, 0x2}, [{0x2, 0x2, r4}, {0x2, 0x1, r6}, {0x2, 0x0, r8}, {0x2, 0x4, r10}, {0x2, 0x1, r11}, {0x2, 0x2, r12}, {0x2, 0x6, r13}], {0x4, 0x5}, [{0x8, 0x7, r14}, {0x8, 0x0, r15}, {0x8, 0x2, r16}], {0x10, 0x1}, {0x20, 0x2}}, 0x74, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f00000031c0)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000009d3e27474c274a55421a6b84ed3818d76787c439d8d1ce5c2a603b37e374553f6c9f1f700522ee1439bc461aeabb3cb2a5815131dacb3ec1578587f9b80430c536a70b5159567cab876c46ebcb8e29f326cee5c93ff8fb6b09426a15d87166970ac59f6d19f62d03a92733fff1f781b7b509bc1eabae6d1f529e758010aacd074d72f767bcb084df279d2be027b7363c5c2fbc800692ac0475c9dbd72d478e778ebbb88adc94ca57ce7c500e9a8f4c821362ea429a6681fc1755814e37091ab770519f32fd"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) write(r2, &(0x7f0000000380)="893a8e45954a3e636e93b3454faa3a23af65c235fc48d15e7ce02276695133e9259cc96b71ee72ef44d9e629bc2aef532b34c5a509cb5a134e8fa1e65f9076b39e818a0c872c50ab98439347ae6fb0906d45e41635e41e35556338e029777abb3c41ff51853b89794a81af961ed824df35dd5abf028ddf1115588d53515deb8c31a0354ce3c6241bead71dc7835e70ea096faf60e1e645cbb124bf97f0c614ada60e3b71a5e1616a6c849225eae1b0ef9a4a5fc0b25cf79333d2ed04b2cd4ddd56a63a", 0xc3) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r5 = gettid() r6 = getuid() getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000900)=0xc) fstat(r2, &(0x7f00000032c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r9 = getegid() getresuid(&(0x7f0000002e80), &(0x7f0000002ec0)=0x0, &(0x7f0000002f00)) fstat(r1, &(0x7f0000002f40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r12 = getuid() r13 = getegid() sendmsg$netlink(r2, &(0x7f0000003040)={&(0x7f00000000c0)=@kern={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000002dc0)=[{&(0x7f0000000480)={0x454, 0x17, 0x0, 0x70bd2c, 0x25dfdbfe, "", [@nested={0x128, 0x8a, [@generic="3791d7e3d6c45ba07df67e9e003f4f9c55dca4609e1bcab8d711befb48ec03a9b6478f1a8dc01cbac90fd85c39989e7b0cdcd724c776beb66944740e27aca9c82cb0eddeddab13fed1cce34630a2f3b8d7407a046913732cf7d5dd01504af5d278a2b46675b9ab968c08798602ce609adb45eb641692fb1279eb33d475c926dea8adf611", @typed={0x8, 0x5d, @pid=r5}, @typed={0x98, 0x9, @binary="c558cc78522beb0bff660db6b6a58231a8e3b198a02814e909f3f56f83827ca8ab7a0ce956dfa1f1c6dd51724b9ba6517135db3591ae20155f8352da7f86701a1925597f2dfb4d731e88c0cd7a54ff8069229a80678a151a6dbb7f7c4cda08a6c5b76d75b822cc11afacc854090b89e529802386a8fcc573ac60965653dd5c503721bb607311cdc1aa292491abbbe9301f"}]}, @typed={0x8, 0x5c, @pid=r5}, @generic="89122e5eb379405a72241a81f835e882180d27604362bd5f57ab577efca0a30c9ac9b493aea8bd6a5a4371b49699a00c9c521928abb5f367ea855aa97838b1cec46b872d8103ea8469300cbb9f8651cdfcd82ad701fd5b0c2663950ea710264ffab68362a04bde171e38c9289a3f35095de698100140e384420c19de625b1f5e6dd5e227666e447c6eba053113c7839feb1f333960f353bc6387a429faa3cf20686731e46df926a76dc556a4389d789643889daaad5504cd8b7f9f14967030364726", @generic="c04e1ceae8d06d2e90a6675c1003828dc30ba35c87dcf98e98f7ce01dc4e3762688779591256b2fec71f1a5601795148791de2d2bc089250ae36cffc425e0d7d43e9b446ba1569ce46322a27e0afe3c1d669dfa0a78dda267c6d795afce4ebbbe4dfb4ddf6ac96cd99f67fb1fa67d05d6680ce29558c5eb83f50e79cb7dfd945667e034047bef3", @typed={0x18, 0x54, @str='security.selinux\x00'}, @generic="57b86467b202bbdab6d6ea00cf28f06c93380260e767cafe1f96d5cd42b3f52089131e6cb8d8bec35c51bb98ccecfdc90fe83efd366549d1eb742378e830af432fce58f16f3195fd7b27c9130769c2cf4854bfd3e9e62240fbf597356cc52d0218e86a906af1e96f74a9a91362bb843102d0bc7922c8d7", @typed={0xc, 0x13, @u64=0x9}, @typed={0xfc, 0x83, @binary="2e2e6bc3742c5fb0fd6496e5bb61f9df8270cb23219e47514eed70d139eb5d26bb89fc7348b7368758797a38c3650021c2bb2f85b4a7e34aadc1926e9fbde9ac317204a7a0f32156c157971c7a3507bb52fcceee5556f2c2c8297b868b117ae43fbc7d1f77712b72b152bd30b8b41cb6d43c7984b7cea0d447e6772c92df5313f94fee4ceaca10e23afa38a75f26d347ea90d8a56c82317f91cd3f93389df766d41facbe79552ad7ec0707af00b77258738821f0cbfad1d1ff6c780dfd5160bcffce54aabf6c0ac0d47c2425202dcd58ddf064e622e49da5a29c40754d8afdf62bb2289f9ac7d7818075e98d97a5c79e0f642bdcd78f9eb9"}, @typed={0xc, 0x2f, @u64=0x30c5}, @generic="7805932228d13ae4dc9491946a5dbc8c28275083bb0e44b96427e5fcfb43749fc56afc3b52fa2c"]}, 0x454}, {&(0x7f0000000100)={0x18, 0x12, 0x100, 0x70bd25, 0x25dfdbff, "", [@typed={0x8, 0x84, @uid=r6}]}, 0x18}, {&(0x7f0000000940)={0x245c, 0x42, 0x800, 0x70bd28, 0x25dfdbfe, "", [@nested={0x1064, 0x92, [@typed={0x8, 0x6b, @pid=r5}, @generic="44c6f4cdf6de185c3d1c80ddb829cf241d7d984fef34c06261f383c48d5efda5160c0ab1326d86b240ff304bba7c657e71e304cfeba4e53cf7c9b874633606ac7a47c096bf7df34d10996190e0504c4eede2bc3c7869832942ab8609491fe177588a33d33b0eb67a956fd6864e6262422161892ebb19b645a768a773f769afcddd852a183f25ef06ea484ee7e2fbbb21061c8f862b9fc981ba2a3f38ed4c7835a2d49b8ea60fa63023f76ccdf8cb1cf58100180b1c59ef87f61bb349a799e866aa4e69db15a59a1c00f473f410827f28d551cdd424087c818fb3cacf3974e48c50fca65a84e2dc83c684890c7403b26b24fb0b03fa67590be52030ec50273753922a5c124a775c9ef5dfb853f2c76c4fe89a884c6513584e63f86e7caca77f2517e046c1ca76bfd2dc46334042acd66ed188be5c6e62263acff7d36dc43f34331f462bea461837c48f0ac30863b020d1bc5d82bacf67dc19215784f16985bdce7f6c748a7b0ca22021a97fa6b6079836a130773bdaeb0e6eecede25ea73e2d5c13f260f6a7c91608a6636776c8a2291cd89e5aa73c64451dd342263f4cc81e9fbeacbf2cc7a1ec547fb056f2618ce6400d2454117833a64bf7c106d1f8d4a3ab933b98b9d9305114ff9bbb2b8943e070169cc37bc4b2cd132194169cc54b665bbc67e63832e095a4a8df3685de7d2d49b336f8a19df881a2eec2bfdb06a1ae4249d148ea3cc3bd0759b7ae21382614490b79f69797e88958e4bb85775eed3d0e205828ab0d84a92c96c266bf409ab02a7d84f4576463df1da05fbec3aaf79b4b215b07edf2144725a8001875f071ee14e270fd34a727246a4b6ff9e3d4bf766498b12b7898e7c31935a1353d1b38aada4c18bc64be3b6e0313a46d0d05b3adae43ace1a9a9619e4f6d1d389cdb0dbd9f4018c14c9b8c050dd25ed8cbacce4ea3639935192430b256b735d2068f98170b827be837964aca2fff06b99f1142043fcb41f7901f2eae3cbbce4854335a16c50d1d6a53d28f76f97ca70fb3953911bef640b403a1b3b9b75b707bf897816c6d784cee12d7fb624fcfe71824d157b3d01e4ec49eb04428a5995a90b7a722962f4262dc65442c4bb3230d0156ba208dbf9774540c3d3104894c58b095f9dd151360ee2d4cb4890638df60919f332426012724df783a41e6a6a1296c32c75d63bf472d5e02554b202d45d9ec689d27c4803e3f8248ab04c61a4a04c3ebab410f5eff20fe908bf1362712a41de1e49a5dc1bb92da86da7e0d4b4a46e5b0b9db217e370208500ccf9b6d46408afddc1040dde56c030864d351951895663c7bcda00b01e55304800049d3ad3b263b8b4d679677f6056444386bebd87fac6fa7aa79a570427cd27c2d9d9b2a9d2cef9360b72ab76d14111de9971c5ce31dd755be55ea5c50e7f168e7d18cfa81afc8c1b5202b1a3778b5b3c450e10025d979b1b897c1f5735f3dd2578f2066a02c898c4bce2a6bda1cb59696404a4ede388a999b90a35b5bf018be0a45261d63f476e16039d17a47265f2d4a2eae1716e66f1d616eda3720c57d71bce4d469600472d3759fad9190189bc512527ae4f4fb248fb170d0fa35d61930345caad6cf7b21d9e9502fb728cb0b15351dcce978635d7b94c5db46afea3eeaba9badab090a8fa7552742d93feffb6553f4446d5eb67a6fca25234de3a0aa30893d9d0511793bfbf23239bc2c5eecec441a7f75e27942733628b3ae335bc4a0b33c7f90458cb1235459bd5152ec26331a7c0ab8633a08fd5100f84279b9af9d23f66a7b35afcaa6a362b983916a0c211a3d88c2cc873f61d8c1a3a6026f0f007ef34fe8b9c5ebbcb5f86202ed047f6b81944aeeaef55fe4a210dc48d52eef450c8fbdf15d91cec4ab5986e40f5e91cc77c2a096995c8cf74dcdb11e695afe5b8f9afd96303ab8c6d1318d28fcbe76c19a617d2ff918ab956aa5e20f6df55cc710c57587e54ab5451d7008444e42134b35bea902866575ffeefcb01de57480951b6dfd2d7b179782a295ecff25282480d0603cd7173bd2ec0b146e703841444685813a1e5ac753a2334b6362cf2b4caff6a487a1c8fd257c0b513159babceade226b2c2392c45dddd1f7e34688ba3543aefe87c675f6468d44d390bf5aa2f8f5cf87c34b426016183d2ee56445811e82efb80fffe1712a9746af639ed796ea0d6beeebc4e808138cc86f389aac67b3476c6acbce94296c95365b68a47fbf80ac091cbee81b9e89c09bcdc7495ce64cd8dd29eca10e35e68c1a95b5d7cc01c6789d04bc2145621e421879e7e9971e0ec2ab719a2370a9eb715e922700883991ce51bbc71e5b82a4f6649511bd2b238cf3075b1454c070e451d5c1cc633567011e905bdc0df7fd46d538c077f84445a2cac3ca851313eb35f8f17ccd0cc5a29ae065a5c99ddb8a0f488cb8a5ff88d307569900662e197f56051304459938e85c810ba07b561dead60ecd3a085a25c6d21ffbef54a587f040f2a2ad3e9230c7a5f0de5baa90d0059e9bb487accfaf55084cea13f42101bdd0e13d617bc905f0b1a8c08dbd21791d6d1cc9806b8ffcc4822e27ea63ce3d2b7b49b47c1d6cf571076684ebfb115b464dc0eef3adbb90a5f39a2913d52122239bdac0940f40030b846fcf47a42150d9db89eed3194741d822e1b625c789a984c3f603bb1fea58a61f8cb5fb5a54e85b66a169c095140508a512629ca97613ba66470740dde6ec1b689982c44c71e58e358faa5ca5dcc2c63379e130f1766983f494a3eadfe05242a03164c160b54eccb206297ea5c9cb3c643541e3d5c2b587207aed6fc713f5e59a181c0f884c78cfc474761b4994db4c349140b5a302bc92e9c50a7e58edcea55cee8cf81cd0bc1e73e2888fac63bb554875501b32c2cba3f2a9b023f7e411f39c8ecd24324ee9555f042ca1c34bf4519fa74c472e861e9e99786dfbd9264ce6a2a59a540ef6929a084d4197c2a6272bb4b6650bb17107a1d391937eb3075e899bc221ec5f1782393bd908a6f955c2228e7328de4786927a7022385272f0dd2ce58dcfa1e9af91bd108b663c55cc520cee8bf781c9ee7d54f19cfcd26514d485b4ae2f2084c4159c7b0214ce8a39cd38f345c26e665ba7cb1b4f25603472dd893fd07e9e5237d887c50c0d8bd376ff60044ca3fee4d15f3a3d1098507f2e035d0bb5f0090130455a7e840fff2cf33681d8a273306348bc5c209a35427e7efbdc6bc4ec1dc29aff0267218682769c32707020b8120c30bbf217655e559c72065535ad1b1ab80e4cdbeb7f6156237fb8184a368e33524bce405b7208723afc3450d3ab48c89e4b70f5ac67b37655ffed1e059d94eef996e7d28caafa7f2af36ecc1b92110f9b8276a53c8818404e625d66d585d6160e61d5521a793a846ffe4574ca4e00e6ffc0a3ff973aa2a4e16eb55f5b0d77336f26da0d07c50884a94b3d5a727277f2922434ca15df90a98df5b9c720dec20442a7e8b0763b97240f8d4552a7c28c6690b635825509233fa7754bff6af5f64527fcbc9c7ec9c82d762b1c1fedba47fd52cd2dc5dba7d02e658536a8706d519a8014ebaba185c5ece6180e9f1a5b67c0a248d6f2eccbf7db1e41452e554cf5de942c1ef3960b0c6562c8ded3a2d5e119c75afc6df841e4041f67ae6b8a7790f0dd6e956c55d9ee2969186552306645167fca1b92b4d18e5106164868e21361ecca5add59bab7e50b6424a4490d9296b0bfb6b55bb4153aa7e3e548b6426bae44d26725694fedab10255f56faf4a2a90865f7b63456471afecf6350e51b17962f6c1e5f3d7705357ccb2e555705f561862901c1e35b495ccb2ad176f110d87d29639ac6075ca85e44b1eb7f548a42ca211cc4e0238a7fe19079d2afd3c6cfa1d4ec2230a5a58e5c953085a1318c3a97e0f4b9bacd27e4061ef9c8370aaae43b11ecd0211e62d77a3542390aeb579f8ed65f95b066adb5544f26b35002e4ddcacd1c4914f141112c2b4dfbca84ffd3ea48156cb4e400a396dfdb6229e32046d4c6eb26953a7e9191633222c5b9207b81912122c814f164d81b1ca09a3df5a496a95f3c273c2ce9140dcf01f3b42dce302486c95d457b403a5ba89795156ac6a4a3e07aa8ccc0136ad619ea3b7e645d8666531e4211e9b043ce90dd77a13083d6fc54333812a75eb955fa04b4239164df357bdc130ca42a7b8b7bb94d5bf499e45b1c10d44e8e55c986be999d918422e719abda40039075e9aca70e5254da6158d982f116fb9dc504508fbf467a22c7b5a1948f22c8df47333d04e5e5fc3e046d0606cfc7c1923069af693622aa7c22d7ce36209b36fdf281072bfc002bc919a4d07d474527a244d963dd6b05f8c571445a8351cb69fb6551d4a099fb3479f6181245d10932adc9d00c0af781169d6744279318ec70e14ebff7e968cb3527721501a60cce6a99b751be342b3fb5995c6439f1362f130823c5334e1430480023acc550a5bcf35087a69d24866b37ea4be06cfedde8a10da4178a3ec855c5f6f44e63d5e98b97ead7d9ade7f530a807759a56c76fc5ece335afbf6c436c9737f250a98f5936cdc48936e0af20035aed8b4aa311d16b8863c8fdac6b064fe0fd3267b980d1448ff03c850e0cfd0946f6846abdd139266c42b7c3d4b4e0a46191b8f622bff4cd9acd15c3fe6c593ceaf1a08b9608c8b2220aeefb9380df283382fa4b3a69fc28f8df5c3732f3aa518b6d943ac0945e6bd0a783d553358d3fcbc86645307db4f770f857fa815942ca886e10d60dcbff9e3117b4e7cad542022cfbd97930f7b5364e485b840130f35322d4b648749656737c1fed067772842d24926329818206277025344f122e1899301ceb6bc2310589bd96e76681ff4d6a8b7ebe12cb93931766329f0849ad0382764177866f859efd7dfcc2f3f64d8133254c9e1ff993eeacf2d6f8427fc15ff799656816d772ed9eb10efee4de7744356d20922f2b1dba9d2c9ccd9e1697a684b43e8399bad8c3e22d3f340b16ec839f39cacd80bef1094bcdcafb0dbed8690335c670ed71fed20071c548a03eb7b9b53184d5fba7a7dc164077d375b92d1e71ac556a13f715a900b96dc909de4145ff2becc66dbdb2aa590895abd464127b0761937e07dac09f7cd7b82b95fe663e3e088ddc17dddd92c1306180635001f7ec7f4ed2a8af5193eb3440c963b0fe311f1d3b7886c5bcdc7e15c1f950e4e3787df295d6bdadd34e6f23d67609efab2a4d132635fdb1933b38378667f47179806408f3c3e5a5e47f04f8b4f296f1b27838a9e856792c7c530896344d8127218d36cc81b1d7102fc202b4169b2b9094f1a8f8bc122d677c2fe0ef39b49b0965e27c1fb800ff2d08055babd0b358dddfed6c7ba88ce66ea4645bcd0519e1f20b1c2ca6af6424482eb6f62f037abb790144003b2817197dcb35a0c4fafb28505eba13a3bccf780d79136479097580e1c07cfe6edebc2494c85938f0f5f3d715dc4a8cf6b056843ef7d8179cc0587f8844b7dd981989a0c7ce8d3949ed7c290158a22930a918721fa590b4cc1f5c14e430292b6f79990d11ac7a8bcb9177fc565b4fbc8db176391b2427ac2599964d867122444659db073a61cabf677bd0f7633176b2bc24fd42c8b0326c4feb6d31c9b47bad60e16cf4dd5a1acd4c5439f3c6e5069b0d5f30cb0f82f0cf28843bc5f3ac4fb1c82faa335a17573327e965ae5aa92d21c4e328d45f6c05ed77d7a0369b57cf6dfadecacc92c01f6b8e4ad8fd05e06163adf22efc6c0ca1e1578ff80f2f73", @typed={0x4, 0x4e}, @typed={0x8, 0x74, @u32=0x7}, @typed={0x14, 0x8d, @ipv6=@loopback}, @typed={0x4, 0x1e, @binary}, @typed={0xc, 0x2a, @str='self\x00'}, @generic="0009c3997b8356c33015754742a6e298cd1658f248eca40907fb9f99cefffe928dbae1bb0d"]}, @nested={0x10bc, 0x8c, [@generic="164102a1d680d98d9122baad34f9949a563d9c5a7aa8531e34ebc67e3041d06dfb5f027884d7c560b5c8dadda2779311ce5da2707f3f983bda205b7263cdd04fbe32c1a1fafb328a1c4671464f0e16b7eaf2f70423d786e6f687ec01059021d51fa86b2942469fed5806a8867a099df2555a84f64047fae0d9689aa53d73dfcb12af1cbcd761bec470b012c5182080e0caaf7d18", @typed={0x24, 0x27, @binary="31bca90bc22a1ddf8c7a398fc06853d68e6d80f19b78d0a66abc4b5920645e"}, @generic="10b4e0353419039b23c20fb49f846b05f4c0d9c9d8e61b61b2798c9106f215dfc52232bae779432c3d72a95c5347189cf28415bb2384c6d43a92f9fabbdd199cceb0907c7fb2392d6036daa12075d6be000fb53dfd215a7cf39e29ec6caf328828502affd75d2bc3dd1af19a50f64016e0119e606627845613278ff3bc132600cba128580b5b80b00f3e822ae533ee5cec1074953f9bc9c1fc11e086120e4641b492d54dbf011aaf99269f276e5b90cbaf709b21a628b9d067eef6d9955687d036b264453da98a9a06f428e11094c62bc91cb9cdb2a1cacbe0116d5a74a7afb619266b7cd07bde698f3dbc516a04cb806d723b6d5d77f6e3ad60782516ad7fbc8f45d5c44d301370a9c231c09af9400ff00b92ab01c7da2307b10ce8b1a565cc69a2b308c544f3bd430a0884a0356654203e6701179fb01ed60a9aef57d01f117b592754a9afef30bcea55d9d45b72aec402e67d77157a516c617e812d38fe1cef3d012db4fa7905036bc329f62f48ad0c7f145b144da56e69bfb2bfb0a8e98903841aa55c05c1525512b91dae9ece34d479a7cd1825563d813cde174026368f326ce90126625676f5f6a67add4faba0bc5ce5f481abc898e0daf70d22ce5e094f8635fcd76f029673df8107a8f3f8f74f764aa0205d04fcfdd3c577a043566726c54e43eaf812111aef272544669eb4daf0ac51735868df6f205f9171126ff5c2b41128c5631f7c5eb7fe6b7a713176fdd73fb59db5cab8ae1da1fcd24a15fce751c9561bb1d99f3c2732edb361237ed8b6a71e633f0408f659af19a4d2f11060e36984e0a419e9ad9672edc6e63da00317d2f8fa146b3a8adc4eb4c214de8362a4371a967ab19e137c151e06983ef3dcc906d914d05b2c7e8ffcc91c0c0f0dcf3e39fcd5587ae3e0131c0606c845dc0d183f3d2a22dafce54f0c74fbc83a9ce465f6267f5252b7735bdefe8d17e5379ee7a9e72380de49141ee2122a0fd8d4f1e75cbd51ad6fa5b3d174470363e43e1aede79b245bc516bd02d33e1acff4c39877ce55fba00d143a80fdaaab8ea042779a5a8edfb3b90f23fb7539348aa75246af3e6c538e0701050f48ceed01dd1f655ed6b8517e34876b549093c101416828621c7c5f2850d0add6feb2919976de18a11f7bf8e67db9b0a981a69462183ca44333779a42a99446b2ab191d6f535f829b50c6fcd687c74926bb899a46a2cce6d8db1f280e8515fdbb9de9ad0224cf8ef45039e2709eb84f2065c7c36c65a8968fd2cc1d078e9e3687139dfe8261304c3740519b857650ed7b0273d626dac035346ce9ed195396e63b28e1d06d76fe9fcae26e3cfaa3bf19f1dd0b378b33d4749f145ee19c86e1b4d748d94272bde4530643700bf61bd965669025f0ecece8c2359243a1e5ae1a28771f81dce803c83d3f45e67b52de8f5018983ed0e11dd2af619c81f03529ae05c9765389df2b63af2ca4c0171b27e8dbfc1c6b9c4b0b2da69b5aad275315a866ed5c3987b9f991de73023cda63244ea4724e9ef6e7009ca367e409740bf797a8d8cec60c3317f22c5195a6d0022119b4a5441c2c8d65161394c4152a1b53e67e489136faccbca0a3258e79d5f3c733329eb87034c3fe0b20584b6bebbb0fdae0810d1829e6ea3d5e3dae360b221084f7e5a1b76ff093c113b5bc20f5b56e23e66068c85914c7ddd7072d67fe5954dd7334efeaf5aef0d8a3d7e579e8ed98b73c2e0fe4a4767e0f9e7a79282f3cc80571b1a065e552808c238c0218c885d9fbec816c96ee35c8f9010273bc667ce2946935eb1b4a1785e82e3366c438ce0951ea2e172655b619bcb95948bf02cf7e3ecde8dca06261b31d4b0be9f56d87c1dab950441fce8189261a8d367e09ec69d3aa392b77097b7d9208acc9fedde7775fcfa21cfa2d962a7836fef5c3bc2d1a1b931e120350b4855ea26bbde834d7032728fc74321e0aaccb74e94d15945fa2be3b0fdb52383c34e502c0a2eda125c3740a31514909aaa117ac3fd443526875c0836228a27b41228e8191b54878b4b65737a3ffbe27c24f155d637cb8f67d7cb84aa1ea030ffce0adb6b3275676846e5199101e9dec1a7d7fcdf310c8e987a6e8d7a1f6d3500a1f149f70479630bddbfe8d854e9fe84682ccc463dd9e9d3fd5c777eff543bdc8f6fe2e6dec60d6ba12c8cf9116bb88c11625b311a1a2bfdc8e2243c83a4fb1888a8d5cceb7295c88b0331516c11e121f4606238e7cf5ec886026404976340cba6a4c5cadd1d864b707914bcabb08600c43bad24e934450bb77c77867e0eddc4b68d9d9d380e6f9e6dc20e409719ce27c18358a462bd5045bc0df234467117d29375366ce967469aa0709ab9748630c32cd125905fc7c50c67468e759d047310946457e9149484e4a001e99522834d592334fdf1638854b99cd6afd7bbf2b4c8cd862aa2279a7d44a63fa00dbd8e4cfcb9c84d2442cfc493db8a1ef51815260eb259ed7195ffc84f961866ae5b91fb93a477d524da652b84141d3e42e3cbe907b0795828083d3530b63bb27e0b84f5784a6ce055cd5ebba2a9886fdbf7c0c6a789abafc988a8a905793ca5153acdec530982908d5f7e766258e22e4b67ba77093ac699325a6457ac5844ca8ade06469d5b46b4fcf6a3854464c70c736e50520e6f572ee3812cc135a0c61f68f8d35a3f5082232219282b67724a908c0a9d4fe96996341743b995cc536793067643692075052e19d4da061d27eb242d70f51de89c4d6bf2203d964c825430a0354fdde5b827d44745506766965933dac5579e95bf0d5bb9dfe6d5d4fc0f56771aedd36f9584d4cf7370e0677099e09dc2e112103b09f447532cd220db1c3d2419b8afd0203d2deac5db264f9bae5e892883461dcc9c80f08961e076f987876e4ed6481e09165f9fe397a50cfc4ad5d12e3c74b38315d812cb24b6f297b31971b5c6926e7f767ad0d607411363f6b6b4826fce8e44537994f6c27a442231ba7335664edf36071cc71c343844f8dfb3c9df09d2d60d3e3d93b3040f3670f1b02ddf26ec7360ba8838fdbd1a8a17d502930df3fbd2e8364f1ea4bef0b67aa3ac0cadfbcf4449dbcf1be692821bceb77c3a79b71f1fc54acffb275b2586864c97dfedf6f5e2244962452675494db909eaaeaf1304847345b50c45b4eec52894a9dae4838f601907b1ce67302c81d2fe43acf822c076e4cbe1ce36ba1b80e80b435523f3b43ee160aa441f282939675981da289cc944348826427f4acfc6518543811c75dc7942ca9de478de2b8d5da95f4360f39f15a433b8773a50dc4b3cac48835f7b392e8bd04a1ad28fb8927ca6b83186ebd544c85cf810d0ae46d73bca9512568df37306297853fa22568e6150849e4f2e6dff588e2f14f44174fe70ab4dbf4ec4821d42ed93fae26eb6b8bed0cdb7ee95ce661f008410d1a6b293c6bcea3d60fa47055578b3ae8d1b21499898ef03b715050a0ad31e29803e3eda6099425a30c0546a568a37c69ebcaf9a4d92bff6203ff55549432cf371f7aaea13d862e381f9526516a667de34711c611fc920b478347cf8f64d1ef5780cfc8ff97604c9e06153358c02d5c6983cd7336c0c38c44a41dc407c4d52ca71b564bb9d9809c719f672816c18df7ba2d6b1562f955008e8bb0b8b86ae746ddb4eb3278ca4106a313463349a78f32bf81ac85cd51d4a1b74718b643870279d47a4b093beb9cad1ea26bbf581e637bdebf6ede2858a53cd95ac9bc00f9729f1b5da994015f8cec374873c6705a82e12bca95e6139467c6bfbb38805232af06f2fa9614e6bc842837e70f44dec89e16a1822ba168a8d717c9d2f889b58df0dba61075f538b430c2469f5e43b01279a2a5db88327ba2453215413a651a8941dfacaade3108c0db09f2d0cb3661fc18c2aa08c81b2bf267b60d78ddc3a9b55b50c8d25278704bbc5cea04778b6d4c568f5980a18cb4765a07e70ff7128804bfe0d21bdb35d8ff3dc16cb4023f099ee92894fbaf32db58846a8ea2e8af5c71125252081abe9fac960349c681b1483386cdb9e07d09615d051188cf1bb47f08c3729e603aba06828726e0f28a06cd4d2b436b560ee17ed3083f36eb37af07da838b708abcd4f67c90b70336225de8a9d8ba2dfe157e6e9654c2fc703ace09ace2f587388f48b1d81d9dbe724e213d56d45d2fee83bdde52409c96f43c5ccaae49ac2086ef9f5e12f9fd7fa90a29eb4d12307ecc795b0a40fe14b42c7f54cc9203c9e7bc2b6f3d2f7e391e5e620f93f4c9ef069715691f149b5af24fb72c27693d26dc16320587fa953dc6b1e8331b35f044227be6eb01ff3bf8ce3b5418399e2eee933c6d4896489bfe14ed569d7a2c8029cc9c15800e03ffa0c56c0957d43b6d20470eaa51706186bd8a23c83919c3eef59964ce2bbb31b7de87909611161a22de4d89a87da0c2a9a3179e027375ac642df66bd3707bc90fcccafeb792cba27ad35ec2a2c8bafe7079de9e144d7094d13db8dc9f1ecd4b7d1f42b4efdac8cff0b66e19308e49b09df7d643a3837699dea17633be5d9a8579d5e4d62991a83fd0a8d87af7bea97bff5f3f01b4957a2d29286b8e6418f7034fd35748650b225dec2e8e28607aba972d355c27f3f0af4e742e947ca33e04a5f63df557deb54143fabbea9cacfb26a43cd342029396f5c67fdfa808b79bad5e115f10be3b9ec00c11975597701e9f31c182982d7e042ab341d3ca1b6fe9eadb7ab13f4e527126bb0b2dd3aace1d40ea0df27190a26a53ecfe1829102ad543d718943567e772ef7514b7c7ebdd3f76788ea2e2fe1c035d6caa7c5eef155cf3fbca91b30fb08b78358d3649d1a1ac70b98b7b80cd3ec031b4cb0ece0ef57d203f69fe1cc74d71bf82e72446d29a3fca644fc6e5c465380d4e9daa96ec2292ec4fc226c6f1f7238b390b7d01b0eec4e022ac59c76fdcf6dfd4833cffe65b7692b1ba364b76b0bc6ffeb99ab227635b9488bb530a7aa64eb4fb171a2ca4a7cf100f5a29a596f6fd9c9143fb6724c555172242b4b043781c0c15a029a96d5a8b4e6741d2c87f5e5e443f729f6598a715ada75b90091ae726ebd23c8f63cef37b5e9e4575af18814a972e7d2890f58bad1968159910a25de665f0ab12c5e814ed31db44ff4128bccad49112da2e5b15b1cfd915de461e9a02a8dfba3633aed7de3eb2705cdd361655a28b5b3db8cc38aba48ffade7e0aac2ab7f85e59d25e51b0b0705950e78a2412fc9ed4131d786065dea7fcf322e5016635ae78808815fe55718242d6567cd57c52302ceb333e69c35495f3dac4c9656dd0f06702e9d521698defee76587f01a89959a7e2fea1af1675032b99d45fc42151413b7176524630a611a7fd07f9546e1da5b186335d32f17fad06306c491a6c967b32ba2f26815fda90f7278bd9d4215cddbd78a3a02c03064ec680d47c14d98c6e67de2ecab09e19fd7ab3d96f250a84d701cbb8c449ae138cd3a29da20830980b5d12a534348f5210a60af1ee589e2a5fab95ae71e43b916eae8602d5bfb1915370bbe2e5f6c210e138259d81bc5a0fb9770fcea4cc7710003409895c3a4009e35f255928b523871f413a2cd17bd3e6c3263104a17b929abd62cae18af578fffab7fd23474ea43df63b325b0957f0db4966406c655474ceff2524d5728032e9fdac8bdb499b5dbf1e27a6e97454dda25d26b0d38a819222196b6f449640325d656876f0f31ed055de01476121d083a43865824411911094f6d88dc26d3161bcba4f477355ef1f4041d4cc21646da6a6a2f8"]}, @generic="ea618186eabf9668d0b4f5df19bc5fff16bfb4c18411f7853884d74508", @generic="254527d450852d7fbdda059cf22e6f5f935abd6db5793993a0a5c1dc07c4366a894cb295c4564d690b65b3cb88550309fc32a2d2417605613303f004f2d65389fba46a6c72414084a8a72d4c49dadec11f2b155676e3220ba6d26f860cef1be4d5ce8b9cb851dd8ab8e1c391d5ec1a188ead6ddfbda4f39d55c90a12d5e55939f81e7d52d58150f50c00d0958099ee4344", @generic="5c025aebc822bd443b655713f540edb9fca5b1969f0bd600b6f90f253a31027c6952fa69a83cd1317885ef5159fc7752d2232c628805321cb8ee97436702", @nested={0x124, 0x78, [@typed={0x8, 0x20, @uid=r7}, @typed={0xc, 0x1b, @u64=0x2}, @typed={0x90, 0x2d, @binary="c513b77f6c4cc1cc56cfd2577f82edda7fb723258ba2501208c39d22c353003720f49736ebb7ca64dcaabc5030228b684270442cf6300c0381695316f31a3abf7158e321a1032814a1e51f4bb0668f2c7f2f17019f277032b7e8f913862a3b3fdecc98b124507427de32a7a9403528e2406f27835eff54201c1c66bf7ab34fe61d7acdb7cb4ffc0900"}, @generic="020d501bba47a54e3dbaba55945b48e65e952cd2051d6a948d0d367c5f2ef329772d6985cffc32ba9a8bb8d5ee65464adcf0e2a837882f9ccc3df596f3b3852d2d8453644f985c2454ecb73502b8faa2a18acad2813e7581cc213bd861dbda050cea64739abcbe786c8a1fa991bce042d87e", @typed={0x8, 0x84, @pid=r5}]}, @nested={0x9c, 0x0, [@typed={0x8, 0x59, @pid=r5}, @generic="54dc90bf8730faa6da19280354d5194cebc66953b801d780475b2da42b0defc1c4057a4b9b2b9e12057a72e9b2c7484fe9f16a4dcb6e4095c9715d866132812da06d6132a726cffd1ce591ce1bae9c26bda388f4134c9bdcaec9c52b8c5a32f7f35d936b20aeb640ea10512041c6f3667572f8b8f7abb47e68032283105de6cfab0a3e6af205679b58110c867962dbc2"]}, @generic="d0b32f0e2d16a4e84dd3293825b4ab0a3ae831baecba0d6e88d5c55c73e8c834d623398524f9d0324a679980de745fbb558e6aac8817bda4cc94c16128915e818b9babf63a7451b6ce9ea7bc2225fb0fdbac81bb9d9f48fc0103657856bd3ce8541e024772687a192d3ff700f12c905d672cae3576943b52857395bd76c47074"]}, 0x245c}], 0x3, &(0x7f0000002fc0)=[@cred={0x20, 0x1, 0x2, r5, r8, r9}, @cred={0x20, 0x1, 0x2, r5, r10, r11}, @cred={0x20, 0x1, 0x2, r5, r12, r13}], 0x60, 0x8000}, 0x1) accept4(r2, &(0x7f0000000000)=@xdp, &(0x7f0000000080)=0x80, 0x80800) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000003080)={{{@in6=@mcast2, @in6=@remote}}, {{@in6=@empty}, 0x0, @in=@empty}}, &(0x7f0000003180)=0xe8) wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r2}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(0xffffffffffffffff, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1568.224833] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1568.247290] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.252979] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.275466] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.287879] binder: 14219:14225 BC_INCREFS_DONE u0000000000000000 no match [ 1568.294673] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.302644] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1568.310100] binder: 14219:14228 ioctl c0306201 0 returned -14 [ 1568.317955] binder: 14219:14221 transaction failed 29201/-28, size 24-8 line 3137 08:14:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 1568.318061] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.318100] binder: 14230:14233 got transaction with invalid offset (0, min 0 max 0) or object. [ 1568.318146] binder: 14230:14233 transaction failed 29201/-22, size 0-8 line 3199 [ 1568.320422] binder: 14217:14223 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.359676] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.364327] binder: 14236:14238 got transaction with invalid offset (0, min 0 max 0) or object. [ 1568.365013] binder: 14236:14238 transaction failed 29201/-22, size 0-8 line 3199 [ 1568.385490] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.392702] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1568.402968] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.412550] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.425530] binder: 14229:14231 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.443661] binder: undelivered TRANSACTION_ERROR: 29201 08:14:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000000)) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) open(&(0x7f0000000000)='./file0\x00', 0x1, 0x101) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x8000000000400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$int_out(r1, 0x5462, &(0x7f0000000040)) 08:14:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) flock(r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="a4a39a7d32bbeca0372beaf1306f41acb6f00def50d2d246abfb12d1f83cdbe9ffebf0fbec48382c8d58d80c6621729dc8b5db0a3c968d851f4b"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$RTC_UIE_ON(r2, 0x7003) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/full\x00', 0x20980, 0x0) ioctl$EVIOCSCLOCKID(r4, 0x400445a0, &(0x7f0000000500)=0x7) gettid() ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f0000000380)=[@reply_sg={0x40486312, {{0x4, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x78, 0x10, &(0x7f00000000c0)=[@ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x4, 0x3e}, @ptr={0x70742a85, 0x1, &(0x7f0000000040), 0x1, 0x1, 0x1d}, @ptr={0x70742a85, 0x0, &(0x7f0000000080), 0x1, 0x2, 0x31}], &(0x7f0000000140)=[0x48, 0x28]}, 0xd9d}}, @increfs={0x40046304, 0x3}, @enter_looper], 0x84, 0x0, &(0x7f0000000400)="c3bc2c22f1d6c380ea0f3f4bd141a53a7d02035cb448da12ac796c01c7310fb9f6cdf341886569ddc63d81d56f96cdded7a5a48aa32a98ccc170855f4319d2e9c3c9d17385b901e6a3aeb7a4637e9f000a0276e71c36b861b842b8664c34bc705f5b7022b86e19bcd5585ffd13d38074a09c096e41bc36c5f16e608d1d2169b5d031440a"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r2}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(0xffffffffffffffff, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1568.476733] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1568.485077] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.494112] binder: 14244:14245 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.505671] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.533635] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1568.543770] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.553189] binder: 14248:14253 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.553582] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1568.553591] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r1, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r2}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1568.553668] binder: 14250:14252 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.553845] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1568.553853] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.553921] binder: 14247:14256 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.554464] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1568.554473] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:19 executing program 3: r0 = socket(0xa, 0x4000000000000001, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f00000004c0)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @local}}}, 0x104) r1 = socket$inet6(0xa, 0x1000000000000002, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x6}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x4008080, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) [ 1568.554559] binder: 14249:14255 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.568646] binder: 14247:14256 ioctl c0306201 0 returned -14 [ 1568.569118] binder: 14247:14256 got reply transaction with no transaction stack [ 1568.569127] binder: 14247:14256 transaction failed 29201/-71, size 120-16 line 2922 [ 1568.641243] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1568.641252] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.641304] binder: 14259:14263 transaction failed 29201/-28, size 24-8 line 3137 08:14:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r1, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r2}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1568.676464] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1568.676473] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.676521] binder: 14262:14264 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.704464] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.710003] binder: 14251:14254 got transaction with invalid offset (0, min 0 max 0) or object. [ 1568.719227] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.724866] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.732491] binder: 14248:14265 BC_INCREFS_DONE u0000000000000000 no match [ 1568.739646] binder: 14251:14254 transaction failed 29201/-22, size 0-8 line 3199 [ 1568.747753] binder: 14248:14272 ioctl c0306201 0 returned -14 [ 1568.755919] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.766246] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1568.777679] binder: undelivered TRANSACTION_ERROR: 29201 08:14:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup2(r0, r0) ioctl$VT_RELDISP(r1, 0x5605) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0xfffffffffffffdd3, 0x0, &(0x7f0000000000), 0x0, 0x0, &(0x7f00000003c0)}) 08:14:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r3, &(0x7f0000000000)={0x2000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r1, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r2}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1568.783231] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.790061] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.799570] binder: 14270:14273 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.814741] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.822418] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1568.848933] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.870184] binder: 14281:14284 ioctl 5605 0 returned -22 [ 1568.876309] binder: 14275:14277 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.884741] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) connect(r1, &(0x7f0000000000)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x80) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000001a0000000000000000000000000000000008000000000000000000000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$random(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom\x00', 0x4000, 0x0) 08:14:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1568.901017] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.914300] binder: undelivered TRANSACTION_ERROR: 29201 [ 1568.928101] binder: 14282:14283 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.928172] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1568.928182] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1568.928229] binder: 14285:14286 transaction failed 29201/-28, size 24-8 line 3137 [ 1568.940825] binder: 14285:14286 ioctl c0306201 0 returned -14 [ 1568.972835] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1568.986892] binder: undelivered TRANSACTION_ERROR: 29201 [ 1569.006500] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1569.019017] binder: undelivered TRANSACTION_ERROR: 29201 [ 1569.041343] binder: 14292:14295 got transaction with invalid offset (0, min 0 max 0) or object. [ 1569.051109] binder: 14291:14293 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.061852] binder: 14292:14295 transaction failed 29201/-22, size 0-8 line 3199 [ 1569.077422] binder: undelivered TRANSACTION_ERROR: 29201 [ 1569.106495] binder: undelivered TRANSACTION_ERROR: 29201 08:14:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) write$FUSE_OPEN(r4, &(0x7f0000000000)={0x20, 0xfffffffffffffff5, 0x8, {0x0, 0xe0505d866f979901}}, 0x20) 08:14:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x12d, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1569.132703] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1569.141182] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1569.151307] binder: 14288:14300 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.168913] binder: undelivered TRANSACTION_ERROR: 29201 08:14:20 executing program 3: 08:14:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000080)={0x20, 0x0, 0x7, {0x4, 0x4, 0x9, 0x1}}, 0x20) [ 1569.189693] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1569.214169] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1569.224534] binder: 14302:14303 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.224603] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:20 executing program 0: 08:14:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1569.224613] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1569.224686] binder: 14305:14308 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.245940] binder: 14309:14312 got transaction with invalid offset (0, min 0 max 0) or object. [ 1569.245990] binder: 14309:14312 transaction failed 29201/-22, size 0-8 line 3199 [ 1569.273065] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1569.280795] binder: undelivered TRANSACTION_ERROR: 29201 08:14:20 executing program 3: [ 1569.286310] binder: undelivered TRANSACTION_ERROR: 29201 [ 1569.294345] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1569.303552] binder: 14302:14315 BC_INCREFS_DONE u0000000000000000 no match [ 1569.312840] binder: 14302:14316 ioctl c0306201 0 returned -14 [ 1569.319747] binder: 14304:14307 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.328947] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:20 executing program 0: 08:14:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$KDMKTONE(r3, 0x4b30, 0x3) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000000)={{{@in=@dev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f0000000100)=0xe8) setsockopt$inet6_IPV6_PKTINFO(r2, 0x29, 0x32, &(0x7f0000000180)={@rand_addr="381f515795c3b207ca94b58d57d9d756", r5}, 0x14) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1569.337418] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1569.346475] binder: 14317:14319 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.355453] binder: undelivered TRANSACTION_ERROR: 29201 [ 1569.375681] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1569.385524] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1569.419852] binder: undelivered TRANSACTION_ERROR: 29201 [ 1569.452595] binder: 14323:14330 BC_INCREFS_DONE u0000000000000000 no match [ 1569.459877] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:20 executing program 3: 08:14:20 executing program 0: 08:14:20 executing program 3: [ 1569.461096] binder: 14323:14324 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.475461] binder: undelivered TRANSACTION_ERROR: 29201 [ 1569.482802] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1569.501738] binder: 14331:14338 BC_INCREFS_DONE u0000000000000000 no match [ 1569.509038] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:20 executing program 0: [ 1569.517137] binder: 14327:14328 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.526600] binder: 14331:14339 ioctl c0306201 0 returned -14 [ 1569.532752] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1569.550974] binder: undelivered TRANSACTION_ERROR: 29201 [ 1569.562139] binder: 14331:14332 transaction failed 29201/-28, size 24-8 line 3137 08:14:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:20 executing program 3: 08:14:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1569.565790] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1569.565800] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1569.565848] binder: 14334:14337 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.600996] binder: undelivered TRANSACTION_ERROR: 29201 08:14:20 executing program 0: [ 1569.617622] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1569.626357] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1569.635962] binder: 14344:14345 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.654523] binder: undelivered TRANSACTION_ERROR: 29201 08:14:20 executing program 0: [ 1569.670142] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1569.703028] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1569.728792] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1569.736478] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1569.746934] binder: 14348:14350 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.756951] binder: 14354:14355 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.764976] binder: 14354:14360 BC_INCREFS_DONE u0000000000000000 no match [ 1569.769806] binder: undelivered TRANSACTION_ERROR: 29201 [ 1569.785611] binder: 14354:14355 ioctl c0306201 0 returned -14 [ 1569.798594] binder: undelivered TRANSACTION_ERROR: 29201 [ 1569.814134] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1569.822385] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:20 executing program 3: 08:14:20 executing program 0: syz_open_dev$evdev(0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) creat(0x0, 0x6857b21ff1155d90) r0 = open(&(0x7f0000000440)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RAUTH(r1, &(0x7f0000000180)={0xfffffffffffffe8d}, 0x14) sendfile(r1, r1, &(0x7f0000000240), 0x7fff) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) sendfile(r2, r2, &(0x7f0000000240), 0x7fff) 08:14:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r1, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r2}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="0000ffff0000000080987459d650e009d7fe7dd329102c06e441580340960e78d2a9da3678d761e355d6855831bfe57ee96a415d1df9d974766c8830dcd76fdd85f6e82be37dbcd02af719e2d1f6a82060060adaa84370c21140b6044be647e3b97527d3113b05ae04496262fdfc4216c699536687932f9ce9ed574e0bd880d0a0b242601f688c3df4301839b6a16d9b3e666e48551d16477546"], 0x0, 0x0, 0x0}) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$BLKSECTGET(r4, 0x1267, &(0x7f0000000100)) syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:20 executing program 3: syz_open_dev$evdev(0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000000440)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RAUTH(r1, &(0x7f0000000180)={0xfffffffffffffe8d}, 0x14) sendfile(r1, r1, &(0x7f0000000240), 0x7fff) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) sendfile(r2, r2, &(0x7f0000000240), 0x0) [ 1569.831926] binder: 14362:14363 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.842501] binder: undelivered TRANSACTION_ERROR: 29201 [ 1569.861434] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1569.876478] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r1, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r2}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1569.892763] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1569.900812] binder: 14367:14369 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.909248] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="3759ee494bfadfeb"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f0000000180)) socket$nl_route(0x10, 0x3, 0x0) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') sendmsg$FOU_CMD_DEL(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r4, 0x400, 0x70bd29, 0x25dfdbff, {}, [@FOU_ATTR_IPPROTO={0x8, 0x3, 0x3b}, @FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0xfe}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1569.952750] binder: 14368:14374 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.952906] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1569.952922] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1569.952980] binder: 14372:14375 transaction failed 29201/-28, size 24-8 line 3137 [ 1569.984721] binder: undelivered TRANSACTION_ERROR: 29201 [ 1570.004927] binder: undelivered TRANSACTION_ERROR: 29201 [ 1570.023389] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1570.041853] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r1, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r2}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1570.062946] binder: 14387:14391 transaction failed 29201/-28, size 24-8 line 3137 [ 1570.063015] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1570.063025] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1570.063073] binder: 14388:14390 transaction failed 29201/-28, size 24-8 line 3137 [ 1570.095407] binder: undelivered TRANSACTION_ERROR: 29201 08:14:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) [ 1570.118307] binder: 14387:14393 BC_INCREFS_DONE u0000000000000000 no match [ 1570.128267] binder: undelivered TRANSACTION_ERROR: 29201 [ 1570.163644] binder: 14387:14397 ioctl c0306201 0 returned -14 [ 1570.189200] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:21 executing program 3: r0 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x400806e, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), 0x4) [ 1570.206840] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1570.216283] binder: 14400:14401 transaction failed 29201/-28, size 24-8 line 3137 [ 1570.228864] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1570.242098] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1570.251274] binder: undelivered TRANSACTION_ERROR: 29201 [ 1570.257116] binder: 14398:14402 transaction failed 29201/-28, size 24-8 line 3137 [ 1570.269215] binder: undelivered TRANSACTION_ERROR: 29201 [ 1570.310117] binder: undelivered TRANSACTION_ERROR: 29201 08:14:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x1f3dddb76a563e90) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="dcab2f6bc12e0adc0f6673d07f000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:21 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r1, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r2}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1570.383054] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1570.390746] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1570.400866] binder: 14414:14415 transaction failed 29201/-28, size 24-8 line 3137 [ 1570.411514] binder: undelivered TRANSACTION_ERROR: 29201 08:14:21 executing program 3: inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000180)='stat\x00') sendfile(r0, r1, 0x0, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) 08:14:21 executing program 0: syz_open_dev$evdev(0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) creat(0x0, 0x6857b21ff1155d90) r0 = open(&(0x7f0000000440)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RAUTH(r1, &(0x7f0000000180)={0xfffffffffffffe8d}, 0x14) sendfile(r1, r1, &(0x7f0000000240), 0x7fff) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) sendfile(r2, r2, &(0x7f0000000240), 0x7fff) 08:14:21 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r1, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r2}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1570.430510] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1570.444437] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1570.467058] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1570.474934] binder: 14417:14419 transaction failed 29201/-28, size 24-8 line 3137 08:14:21 executing program 3: 08:14:21 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r1, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r2}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BLKBSZGET(r2, 0x80081270, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1570.483090] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1570.495453] binder: 14417:14430 BC_INCREFS_DONE u0000000000000000 no match [ 1570.505036] binder: 14417:14419 ioctl c0306201 0 returned -14 [ 1570.523860] binder: 14418:14426 transaction failed 29201/-28, size 24-8 line 3137 08:14:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:21 executing program 3: [ 1570.538150] binder: undelivered TRANSACTION_ERROR: 29201 [ 1570.601252] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1570.628649] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1570.661779] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1570.679429] binder: 14437:14443 transaction failed 29201/-28, size 24-8 line 3137 [ 1570.688690] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1570.688706] binder: 14445:14449 BC_INCREFS_DONE u0000000000000000 no match [ 1570.709595] binder: 14445:14449 ioctl c0306201 0 returned -14 [ 1570.715564] binder: undelivered TRANSACTION_ERROR: 29201 [ 1570.724230] binder: 14445:14447 transaction failed 29201/-28, size 24-8 line 3137 [ 1570.752957] binder: undelivered TRANSACTION_ERROR: 29201 08:14:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:21 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:21 executing program 3: socket$inet(0x2, 0xf, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) inotify_init() inotify_add_watch(0xffffffffffffffff, 0x0, 0xfe) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) eventfd(0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='stat\x00') setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) 08:14:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) sched_setscheduler(r5, 0x7, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="c27e000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) pread64(r6, &(0x7f0000000380)=""/211, 0xd3, 0x5a) 08:14:21 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000001000)={0x1, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}}}}, 0x108) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='net/mcfilter6\x00') preadv(r1, &(0x7f0000000340)=[{&(0x7f0000000240)=""/134, 0x86}], 0x1, 0x100000) 08:14:21 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1570.803637] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1570.812107] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1570.821509] binder: 14454:14455 transaction failed 29201/-28, size 24-8 line 3137 [ 1570.831410] binder: undelivered TRANSACTION_ERROR: 29201 08:14:21 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000001000)={0x1, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}}}}, 0x108) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000540)='net/mcfilter6\x00') preadv(r2, &(0x7f0000000340)=[{&(0x7f0000000240)=""/134, 0x86}], 0x1, 0x0) 08:14:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:21 executing program 3: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) write$cgroup_type(r0, &(0x7f0000000340)='threaded\x00', 0xa7571fbb) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_misc(r1, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r2, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51) bind$inet6(0xffffffffffffffff, 0x0, 0x0) [ 1570.875099] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1570.891684] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1570.904930] binder: 14462:14464 transaction failed 29201/-28, size 24-8 line 3137 [ 1570.907991] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="152200000000000001cd981d9bc35044939add9472f5d6fb38d727e1827c14bd86ce9087bfd27f2362b6457980cb79596805e989eec682e9889c811389c579a7d1e317c8689ad9cfbe37dfa9a208188e05374e9b0a909d58918605f8777b61def7cbad2356f1bf376283160267f0e6d573024872198fcfc367839393480ea665ff20b18a73b8e9430c057552b5430121b9da6e5944b63de8afa175c87eb101fc2f0276717076afde092e8d2bb53eb0281e369ae6687ed2b03e4fb59308efa587c1"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1570.908002] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1570.908051] binder: 14457:14467 transaction failed 29201/-28, size 24-8 line 3137 [ 1570.936938] binder: undelivered TRANSACTION_ERROR: 29201 [ 1570.946675] binder: 14462:14464 ioctl c0306201 0 returned -14 [ 1570.961442] binder: undelivered TRANSACTION_ERROR: 29201 08:14:22 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1571.013098] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1571.058351] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1571.073819] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1571.082315] binder: 14480:14484 transaction failed 29201/-28, size 24-8 line 3137 [ 1571.088972] binder: 14478:14493 BC_INCREFS_DONE u0000000000000000 no match [ 1571.089924] binder: 14478:14493 ioctl c0306201 0 returned -14 [ 1571.105117] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1571.114673] binder: 14478:14483 transaction failed 29201/-28, size 24-8 line 3137 [ 1571.125072] binder: undelivered TRANSACTION_ERROR: 29201 08:14:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(0xffffffffffffffff, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:22 executing program 0: syz_open_dev$evdev(0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) creat(0x0, 0x6857b21ff1155d90) r0 = open(&(0x7f0000000440)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RAUTH(r1, &(0x7f0000000180)={0xfffffffffffffe8d}, 0x14) sendfile(r1, r1, &(0x7f0000000240), 0x7fff) write$P9_RAUTH(0xffffffffffffffff, &(0x7f0000000180)={0xfffffffffffffe8d}, 0x14) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000240), 0x7fff) 08:14:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) clock_gettime(0x7, &(0x7f0000000000)) 08:14:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) [ 1571.191396] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1571.199830] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1571.209768] binder: 14498:14499 transaction failed 29201/-28, size 24-8 line 3137 [ 1571.246414] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1571.266797] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1571.288718] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1571.297004] binder: 14503:14506 transaction failed 29201/-28, size 24-8 line 3137 [ 1571.305134] binder: 14503:14510 BC_INCREFS_DONE u0000000000000000 no match [ 1571.308644] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1571.308813] binder: 14504:14507 transaction failed 29201/-28, size 24-8 line 3137 [ 1571.329089] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1571.336732] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[@ANYBLOB="852a62730000000073014a5bed8ac02846cc887c9dbf1e134bc9cb1430839e52247b5a195ebb92eaec8d062d83a8e85f63f8f2d491a9c8cbd187c57eb9af8ea877567382272374b4d5eeda426de143b3eb2c480bda4b408a79d124fc81a06647d606a916351c56524f99b67b2c45218e6f0a", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="0d0000000000000028063d0351b67626c3d99ede2cb30e04bb0c8fa8c23c67f1039ffaafe2c11249d3aeee1201593bc11af0c1c38843ff4dab98c253b1a5e58bed6888b8503304a3268e7a8a4a4f14c5422754a90d39f573b8265244d98208745e9660d539cd"]], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCGPROP(r2, 0x80404509, &(0x7f00000000c0)) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0863102152839b61205035e6ce8b0fd1e62273db9b0dba1e7dbe3a85968d6fa2ae816c82ed13926c51cf382b34cbf7745b1d56f39815d5ff8365f2f700f8902352ce2467e296572ef1d5f67322a469cf4d8a95af6a5eec6aacb71b28557a253851fa6e35c63d2bd9ff9ef8fc0f6b32015733cad194c2b12ae48bfe750d904b503a0b98bfda766b692d306ed344e7d926ebc8681f89e60deb63dacb114b09007f5214a5a32b", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r4 = gettid() fcntl$F_SET_FILE_RW_HINT(r2, 0x40e, &(0x7f0000000000)=0x3) wait4(r4, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) [ 1571.348371] binder: undelivered TRANSACTION_ERROR: 29201 [ 1571.351776] binder: 14503:14506 ioctl c0306201 0 returned -14 [ 1571.410029] binder: 14502:14508 transaction failed 29201/-28, size 24-8 line 3137 [ 1571.410170] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1571.410178] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1571.410225] binder: 14514:14515 transaction failed 29201/-28, size 24-8 line 3137 [ 1571.412877] binder: 14514:14515 ioctl c0306201 0 returned -14 [ 1571.426589] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000380)=ANY=[@ANYBLOB="0900000000000000ff0100000000000001000000020000000500000000000000080000000000000000000000000000000d0e96040000000000000000000000000000000000000000040000000000000000000000000000000800000000000000ffff00000000000000000000000000000000000000000000000000000000000000080000000000c000000000000000000900000000000000fffffffffeffffff018000000000000000000000000000000000000000000000020000000000000000000000000000000000a0000000000007000000000000000100008000000000000000000000000000000000000000000101000000000000000000000000000000000000000000008000000000000000e1000000000000000000000000000000000000000000000084000000000000000000000000000000"]) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="083420659ddcf779fdf96f0b8531c5631040", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r4 = gettid() wait4(r4, 0x0, 0xfffffe, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000000040)="8e41e449e9a0d48d027ed5e390d91f50", 0x10) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) [ 1571.426599] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1571.426645] binder: 14516:14519 transaction failed 29201/-28, size 24-8 line 3137 [ 1571.472283] binder: undelivered TRANSACTION_ERROR: 29201 [ 1571.478558] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1571.490767] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1571.501658] binder: undelivered TRANSACTION_ERROR: 29201 [ 1571.510409] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1571.519050] binder: 14521:14523 transaction failed 29201/-28, size 24-8 line 3137 [ 1571.529576] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1571.546157] binder: undelivered TRANSACTION_ERROR: 29201 [ 1571.552272] binder: 14521:14527 unknown command 1696609288 [ 1571.559345] binder: 14521:14529 ioctl c0306201 0 returned -14 [ 1571.561820] binder: undelivered TRANSACTION_ERROR: 29201 [ 1571.576724] binder: 14521:14527 ioctl c0306201 200002c0 returned -22 [ 1571.584559] binder: 14522:14524 transaction failed 29201/-28, size 24-8 line 3137 [ 1571.601166] binder: undelivered TRANSACTION_ERROR: 29201 [ 1571.624871] binder: undelivered TRANSACTION_ERROR: 29201 [ 1571.658662] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1571.666473] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1571.675867] binder: 14533:14534 transaction failed 29201/-28, size 24-8 line 3137 [ 1571.688881] binder: undelivered TRANSACTION_ERROR: 29201 08:14:22 executing program 3: clone(0x802122001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r0, 0x0, 0x0) 08:14:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) r3 = getgid() fchown(r1, r2, r3) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r4 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r4, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) gettid() wait4(0x0, 0x0, 0x80000000, 0x0) socket$nl_route(0x10, 0x3, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) 08:14:22 executing program 0: syz_open_dev$evdev(0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) creat(0x0, 0x6857b21ff1155d90) r0 = open(&(0x7f0000000440)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RAUTH(r1, &(0x7f0000000180)={0xfffffffffffffe8d}, 0x14) sendfile(r1, r1, &(0x7f0000000240), 0x7fff) write$P9_RAUTH(0xffffffffffffffff, &(0x7f0000000180)={0xfffffffffffffe8d}, 0x14) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000240), 0x7fff) 08:14:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(0xffffffffffffffff, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) [ 1571.901728] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1571.928794] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1571.944082] binder: 14537:14540 transaction failed 29201/-28, size 24-8 line 3137 08:14:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1571.944141] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1571.944151] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1571.944212] binder: 14539:14541 transaction failed 29201/-28, size 24-8 line 3137 [ 1571.944319] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1571.944328] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1571.944380] binder: 14542:14544 transaction failed 29201/-28, size 24-8 line 3137 08:14:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1572.007015] binder: undelivered TRANSACTION_ERROR: 29201 [ 1572.016653] vmalloc: allocation failure: 0 bytes [ 1572.021612] binder: 14537:14552 BC_INCREFS_DONE u0000000000000000 no match [ 1572.032986] binder: 14537:14554 ioctl c0306201 0 returned -14 [ 1572.038925] binder: undelivered TRANSACTION_ERROR: 29201 [ 1572.046306] syz-executor.3: page allocation failure: order:0, mode:0x24000c2 [ 1572.056580] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1572.059650] CPU: 0 PID: 14553 Comm: syz-executor.3 Not tainted 4.4.174+ #4 [ 1572.059665] 0000000000000000 b05a625b11d5638d ffff880094dbf9f0 ffffffff81aad1a1 [ 1572.059676] 1ffff100129b7f41 ffff8801bff25f00 00000000024000c2 0000000000000000 [ 1572.059687] ffffffff82895080 ffff880094dbfb00 ffffffff8148c0cb ffffffff00000001 [ 1572.059689] Call Trace: [ 1572.059706] [] dump_stack+0xc1/0x120 [ 1572.059718] [] warn_alloc_failed.cold+0x78/0x99 [ 1572.059729] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1572.059738] [] ? sel_write_load+0x9e/0xf90 [ 1572.059748] [] __vmalloc_node_range+0x365/0x650 [ 1572.059757] [] ? check_preemption_disabled+0x3c/0x200 [ 1572.059765] [] ? check_preemption_disabled+0x3c/0x200 [ 1572.059773] [] ? task_has_security+0x130/0x270 [ 1572.059783] [] vmalloc+0x5c/0x70 08:14:23 executing program 3: r0 = socket$inet(0x2, 0x80001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") sendto$inet(r0, &(0x7f0000000140)="b2", 0x1, 0x0, 0x0, 0x0) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 08:14:23 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0xfffffffffffffc88) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) mknod(0x0, 0x0, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) eventfd(0x0) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000000240)=""/246) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, 0x0) 08:14:23 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x0) r2 = memfd_create(&(0x7f0000000140)='\x00\x00\x00\x00\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x1260, r2) [ 1572.059790] [] ? sel_write_load+0x119/0xf90 [ 1572.059798] [] sel_write_load+0x119/0xf90 [ 1572.059806] [] ? sel_read_bool+0x240/0x240 [ 1572.059815] [] ? trace_hardirqs_on+0x10/0x10 [ 1572.059823] [] __vfs_write+0x116/0x3d0 [ 1572.059833] [] ? sel_read_bool+0x240/0x240 [ 1572.059841] [] ? __vfs_read+0x3c0/0x3c0 [ 1572.059849] [] ? check_preemption_disabled+0x3c/0x200 [ 1572.059857] [] ? check_preemption_disabled+0x3c/0x200 [ 1572.059876] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1572.059886] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1572.059896] [] ? __sb_start_write+0x14f/0x310 [ 1572.059905] [] vfs_write+0x182/0x4e0 [ 1572.059912] [] SyS_write+0xdc/0x1c0 [ 1572.059921] [] ? SyS_read+0x1c0/0x1c0 [ 1572.059932] [] ? lockdep_sys_exit_thunk+0x12/0x14 08:14:23 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x0) r2 = memfd_create(&(0x7f0000000140)='\x00\x00\x00\x00\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x127c, r2) [ 1572.059942] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1572.059946] Mem-Info: [ 1572.059971] active_anon:149901 inactive_anon:23612 isolated_anon:0 [ 1572.059971] active_file:5455 inactive_file:18140 isolated_file:0 [ 1572.059971] unevictable:0 dirty:283 writeback:0 unstable:0 [ 1572.059971] slab_reclaimable:6664 slab_unreclaimable:71863 [ 1572.059971] mapped:58910 shmem:34594 pagetables:14719 bounce:0 [ 1572.059971] free:1275906 free_pcp:588 free_cma:0 [ 1572.060005] DMA32 free:2331628kB min:4696kB low:5868kB high:7044kB active_anon:275828kB inactive_anon:43912kB active_file:10584kB inactive_file:33132kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:588kB writeback:0kB mapped:107072kB shmem:64220kB slab_reclaimable:12540kB slab_unreclaimable:131380kB kernel_stack:18336kB pagetables:25592kB unstable:0kB bounce:0kB free_pcp:1264kB local_pcp:700kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1572.060015] lowmem_reserve[]: 0 3504 3504 [ 1572.060047] Normal free:2771996kB min:5580kB low:6972kB high:8368kB active_anon:323776kB inactive_anon:50536kB active_file:11236kB inactive_file:39428kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:544kB writeback:0kB mapped:128568kB shmem:74156kB slab_reclaimable:14116kB slab_unreclaimable:156072kB kernel_stack:22304kB pagetables:33284kB unstable:0kB bounce:0kB free_pcp:1088kB local_pcp:612kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1572.060055] lowmem_reserve[]: 0 0 0 08:14:23 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x0) r2 = memfd_create(&(0x7f0000000140)='\x00\x00\x00\x00\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x1269, r2) [ 1572.060116] DMA32: 157*4kB (UME) 81*8kB (UME) 276*16kB (UME) 106*32kB (UME) 65*64kB (ME) 31*128kB (UME) 19*256kB (ME) 9*512kB (UME) 15*1024kB (UME) 12*2048kB (UM) 553*4096kB (UM) = 2331708kB [ 1572.060172] Normal: 181*4kB (UME) 95*8kB (UME) 271*16kB (UME) 136*32kB (UME) 72*64kB (ME) 36*128kB (ME) 16*256kB (UME) 6*512kB (ME) 19*1024kB (UM) 15*2048kB (UE) 658*4096kB (UM) = 2771900kB [ 1572.060175] 58188 total pagecache pages [ 1572.060178] 0 pages in swap cache [ 1572.060184] Swap cache stats: add 0, delete 0, find 0/0 [ 1572.060186] Free swap = 0kB [ 1572.060188] Total swap = 0kB [ 1572.060191] 1965979 pages RAM [ 1572.060194] 0 pages HighMem/MovableOnly [ 1572.060197] 313294 pages reserved 08:14:23 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000), 0x10e755) clone(0x800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x2000000000000015, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x6, 0x0, &(0x7f0000000040)) 08:14:23 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000140)={[], 0x0, 0x800007, 0xb}) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) [ 1572.520108] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1572.529260] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1572.536911] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1572.546204] binder: 14549:14550 transaction failed 29201/-28, size 24-8 line 3137 [ 1572.554633] binder: 14559:14560 transaction failed 29201/-28, size 24-8 line 3137 [ 1572.564066] binder: undelivered TRANSACTION_ERROR: 29201 [ 1572.569652] binder: undelivered TRANSACTION_ERROR: 29201 08:14:23 executing program 0: r0 = syz_open_procfs(0x0, 0xfffffffffffffffe) getdents64(r0, &(0x7f0000000000)=""/224, 0xe0) getdents64(r0, &(0x7f0000000180)=""/76, 0x99) getdents(r0, &(0x7f0000000ea9)=""/407, 0x197) 08:14:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1572.655994] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1572.676281] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1572.686389] binder: 14598:14599 transaction failed 29201/-28, size 24-8 line 3137 [ 1572.705693] binder: undelivered TRANSACTION_ERROR: 29201 08:14:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(0xffffffffffffffff, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:23 executing program 2: r0 = socket$unix(0x1, 0x2, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x0, 0x0, 0x0) 08:14:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:23 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_emit_ethernet(0x74, &(0x7f0000000100)={@local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x2b, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 08:14:23 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r0, 0x7, &(0x7f0000002000)) fcntl$lock(r0, 0x6, &(0x7f0000000140)={0x2, 0x0, 0x0, 0x80}) [ 1572.760269] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1572.769056] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1572.778108] binder: 14603:14609 transaction failed 29201/-28, size 24-8 line 3137 [ 1572.790989] binder: undelivered TRANSACTION_ERROR: 29201 08:14:23 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000400)={@ipv4={[], [], @remote}}, 0x14) [ 1572.860442] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1572.873810] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1572.883849] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:23 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0x80041284, &(0x7f0000000080)) [ 1572.906005] binder: 14616:14620 transaction failed 29201/-28, size 24-8 line 3137 [ 1572.914277] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1572.925491] binder: 14618:14622 transaction failed 29201/-28, size 24-8 line 3137 [ 1572.934547] binder: undelivered TRANSACTION_ERROR: 29201 [ 1572.971982] binder: undelivered TRANSACTION_ERROR: 29201 [ 1572.992989] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1573.002131] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1573.021366] binder: 14626:14627 transaction failed 29201/-28, size 24-8 line 3137 [ 1573.031512] binder: undelivered TRANSACTION_ERROR: 29201 08:14:26 executing program 3: clone(0x7ff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair(0x0, 0x0, 0x0, 0x0) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000000c0)) ptrace(0x10, r0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ptrace$getsig(0x2, r0, 0xffffffffff600003, &(0x7f0000000280)) 08:14:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:26 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0x80081270, &(0x7f0000000080)) 08:14:26 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0x1268, &(0x7f0000000080)) 08:14:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:26 executing program 0: syz_open_dev$evdev(&(0x7f0000000280)='/dev/input/event#\x00', 0x20, 0x0) execveat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0) 08:14:26 executing program 2: r0 = syz_open_procfs(0x0, 0xfffffffffffffffe) getdents(r0, &(0x7f0000000280)=""/407, 0x2e0) [ 1575.624132] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1575.636771] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1575.646678] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1575.656388] binder: 14642:14646 transaction failed 29201/-28, size 24-8 line 3137 [ 1575.664734] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:26 executing program 3: eventfd(0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003500)=[{{0x0, 0x0, &(0x7f0000002580)=[{&(0x7f00000012c0)=""/115, 0x73}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r0, &(0x7f0000000480), 0x100000000000021c, 0x0) 08:14:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1575.690181] binder: undelivered TRANSACTION_ERROR: 29201 [ 1575.699583] binder: 14644:14647 transaction failed 29201/-28, size 24-8 line 3137 08:14:26 executing program 3: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCGMASK(r0, 0x80104592, 0x0) 08:14:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r1, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r2}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1575.738057] binder: undelivered TRANSACTION_ERROR: 29201 08:14:26 executing program 0: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f00000001c0)=""/191) 08:14:26 executing program 2: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGMASK(r0, 0x80104592, 0x0) [ 1575.793260] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1575.818510] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1575.831531] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r1, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r2}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1575.839923] binder: 14669:14673 transaction failed 29201/-28, size 24-8 line 3137 [ 1575.851146] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1575.871394] binder: 14671:14676 transaction failed 29201/-28, size 24-8 line 3137 [ 1575.880091] binder: undelivered TRANSACTION_ERROR: 29201 [ 1575.885601] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:26 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/tcp6\x00') preadv(r1, &(0x7f0000000300)=[{&(0x7f0000000140)=""/251, 0xfb}], 0x1, 0x0) 08:14:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1575.895042] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1575.907665] binder: undelivered TRANSACTION_ERROR: 29201 08:14:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:27 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000806, &(0x7f0000001180)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='sit0\x00', 0x10) sendto$inet(r0, &(0x7f00000003c0), 0xed5f0dd4, 0x0, 0x0, 0x184) 08:14:27 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000003500)=[{{0x0, 0x0, &(0x7f0000002580)=[{&(0x7f00000012c0)=""/115, 0x73}], 0x1}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r0, &(0x7f0000000480), 0x100000000000021c, 0x0) [ 1575.977132] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1575.988958] binder: 14687:14688 transaction failed 29201/-28, size 24-8 line 3137 [ 1575.997556] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1576.003015] Dead loop on virtual device ip6tnl0, fix it urgently! [ 1576.004906] binder: 14687:14700 BC_INCREFS_DONE u0000000000000000 no match [ 1576.007785] binder: undelivered TRANSACTION_ERROR: 29201 08:14:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x56, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="030000ffaf1fd52232de18e74017eb9f74b15424a7e2df868128d264b4f3107c1f7e0dd9475d56d617cc5037dc5c69a38de4777b895cd83a9a9adde459bdbe41c967c792d436c4a2c0f351ae723b095a9390607d70e7"], 0x0, 0x0, 0x0}) socket$key(0xf, 0x3, 0x2) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = fcntl$dupfd(r1, 0x3, 0xffffffffffffffff) add_key(&(0x7f0000000100)='blacklist\x00', &(0x7f0000000200)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x4082) r4 = memfd_create(&(0x7f00000001c0)='/delo\xff\a\x00\x00\x00\x00', 0x0) pwritev(r4, &(0x7f0000000480)=[{&(0x7f00000004c0)="2bd83b0010947db9", 0x8}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(r3, 0x4c00, r4) sendfile(r2, r3, 0x0, 0x2000006) syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r1, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc000001}, 0xc, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x20008000}, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1576.034125] binder: 14689:14690 transaction failed 29201/-28, size 24-8 line 3137 [ 1576.034341] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1576.034351] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1576.034408] binder: 14695:14696 transaction failed 29201/-28, size 24-8 line 3137 [ 1576.036048] binder: undelivered TRANSACTION_ERROR: 29201 08:14:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r1, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r2}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1576.088893] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1576.096266] binder: undelivered TRANSACTION_ERROR: 29201 [ 1576.125719] binder: 14715:14717 unknown command -16777213 [ 1576.136546] binder: 14715:14717 ioctl c0306201 20000140 returned -22 [ 1576.151497] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1576.161620] binder: 14708:14709 transaction failed 29201/-28, size 24-8 line 3137 [ 1576.161689] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1576.161699] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) 08:14:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) [ 1576.161746] binder: 14718:14719 transaction failed 29201/-28, size 24-8 line 3137 [ 1576.165657] binder: 14715:14722 unknown command -16777213 [ 1576.165668] binder: 14715:14722 ioctl c0306201 20000140 returned -22 [ 1576.182585] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1576.182594] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1576.182651] binder: 14716:14724 transaction failed 29201/-28, size 24-8 line 3137 [ 1576.194838] binder: undelivered TRANSACTION_ERROR: 29201 08:14:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x62, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="030000ffaf1fd52232de18e74017eb9f74b15424a7e2df868128d264b4f3107c1f7e0dd9475d56d617cc5037dc5c69a38de4777b895cd83a9a9adde459bdbe41c967c792d436c4a2c0f351ae723b095a9390607d70e77176e1e39476750e5af830db"], 0x0, 0x0, 0x0}) socket$key(0xf, 0x3, 0x2) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = fcntl$dupfd(r1, 0x3, 0xffffffffffffffff) add_key(&(0x7f0000000100)='blacklist\x00', &(0x7f0000000200)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x4082) r4 = memfd_create(&(0x7f00000001c0)='/delo\xff\a\x00\x00\x00\x00', 0x0) pwritev(r4, &(0x7f0000000480)=[{&(0x7f00000004c0)="2bd83b0010947db9", 0x8}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(r3, 0x4c00, r4) sendfile(r2, r3, 0x0, 0x2000006) syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r1, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xc000001}, 0xc, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x20008000}, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 1576.208473] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1576.208481] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1576.208528] binder: 14726:14727 transaction failed 29201/-28, size 24-8 line 3137 [ 1576.222087] binder: undelivered TRANSACTION_ERROR: 29201 [ 1576.278764] binder: 14731:14733 unknown command -16777213 [ 1576.284261] binder: undelivered TRANSACTION_ERROR: 29201 [ 1576.290187] binder: 14731:14733 ioctl c0306201 20000140 returned -22 [ 1576.303909] binder: undelivered TRANSACTION_ERROR: 29201 [ 1576.315411] binder: 14731:14733 ioctl c0306201 0 returned -14 [ 1576.323461] binder: 14731:14735 unknown command -16777213 [ 1576.337725] binder: 14731:14735 ioctl c0306201 20000140 returned -22 [ 1576.356358] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1576.364638] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1576.365554] binder: 14731:14735 ioctl c0306201 0 returned -14 [ 1576.381097] binder: 14730:14737 transaction failed 29201/-28, size 24-8 line 3137 [ 1576.381195] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1576.381205] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1576.381251] binder: 14738:14740 transaction failed 29201/-28, size 24-8 line 3137 [ 1576.412366] binder: undelivered TRANSACTION_ERROR: 29201 [ 1576.437783] binder: undelivered TRANSACTION_ERROR: 29201 08:14:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:27 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000540)='net/mcfilter6\x00') preadv(r0, &(0x7f0000000340)=[{&(0x7f0000000240)=""/134, 0x86}], 0x1, 0x100000) [ 1576.777994] Dead loop on virtual device ip6tnl0, fix it urgently! [ 1576.802629] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1576.811889] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1576.821645] binder: 14748:14750 transaction failed 29201/-28, size 24-8 line 3137 [ 1576.835150] binder: undelivered TRANSACTION_ERROR: 29201 08:14:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:27 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000ffa000/0x4000)=nil) 08:14:27 executing program 2: mkdir(&(0x7f0000001700)='./file0\x00', 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='tmpfs\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./file0\x00') mknod$loop(&(0x7f0000000300)='./bus\x00', 0x2000, 0xffffffffffffffff) 08:14:27 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) r2 = socket$inet6(0xa, 0x3, 0x84) connect$inet6(r2, &(0x7f0000000080), 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) 08:14:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x125, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000fc00000000000000000000000000000000000000000000000018000000000000000800000000000000ed6a6829d6c69e5db95873ece79a1a4143e479bc609300fa830fb851acb2a5e61d3c9e68f327fb5ef0d130d69d7844bf136486dde78eb873f02765eba85691cb5dcead64df8bf3b93b62cc14ec535ba9e4bb161140ee27b58715598d4b51b6825833bc9c509abfc0ea1a40b6ca036c334aa2fe2b02168594a368fc7ecc570b91e8608e8b3608a2e1ba765204b0fd9a3ccbed3dbc56133b99756d627bacdb35da89ea6039409b6b0331ce019cbb0a964b5fbf02dd89c12b3c6101ae5f01e7307e35822d6103275b507094ca0cd47eb283b18e9fbfd017135fdc1f702dc5b1cf245de79fd3869d1135c2", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) [ 1576.870355] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1576.878345] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1576.888527] binder: 14747:14757 transaction failed 29201/-28, size 24-8 line 3137 [ 1576.911685] binder: undelivered TRANSACTION_ERROR: 29201 08:14:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:28 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)={@loopback, @loopback, 0x0, 0x1}, 0x13) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000001000)={0x1, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}}}}, 0x108) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$RTC_PIE_ON(0xffffffffffffffff, 0x7005) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='net/mcfilter6\x00') preadv(r3, &(0x7f0000000340)=[{&(0x7f0000000240)=""/134, 0x86}], 0x1, 0x100000) 08:14:28 executing program 0: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) read(r0, &(0x7f00000001c0)=""/179, 0xb3) [ 1576.920838] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1576.939422] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1576.953948] binder: 14762:14765 transaction failed 29201/-28, size 24-8 line 3137 [ 1576.953985] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:28 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:28 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000800)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1576.953996] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1576.954039] binder: 14763:14768 transaction failed 29201/-28, size 24-8 line 3137 [ 1576.981896] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1576.981904] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1576.982089] binder: 14776:14779 transaction failed 29201/-28, size 24-8 line 3137 [ 1576.996180] binder: undelivered TRANSACTION_ERROR: 29201 [ 1577.033864] binder: undelivered TRANSACTION_ERROR: 29201 [ 1577.066574] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:28 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x1fe) 08:14:28 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='net/mcfilter6\x00') preadv(r1, &(0x7f0000000340)=[{&(0x7f0000000240)=""/134, 0x86}], 0x1, 0x0) 08:14:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, 0x0, &(0x7f0000000800)) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1577.076417] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1577.086139] binder: 14784:14788 transaction failed 29201/-28, size 24-8 line 3137 [ 1577.099116] binder: undelivered TRANSACTION_ERROR: 29201 [ 1577.119334] binder: undelivered TRANSACTION_ERROR: 29201 08:14:28 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = syz_open_dev$evdev(&(0x7f0000000140)='/dev/input/event#\x00', 0x0, 0x0) dup3(r0, r1, 0x0) 08:14:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) socket$key(0xf, 0x3, 0x2) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = fcntl$dupfd(r1, 0x3, 0xffffffffffffffff) add_key(&(0x7f0000000100)='blacklist\x00', &(0x7f0000000200)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x4082) r4 = memfd_create(&(0x7f00000001c0)='/delo\xff\a\x00\x00\x00\x00', 0x0) pwritev(r4, &(0x7f0000000480)=[{&(0x7f00000004c0)="2bd83b0010947db9", 0x8}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(r3, 0x4c00, r4) sendfile(r2, r3, 0x0, 0x2000006) syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 1577.196589] binder: 14800:14801 unknown command 536871488 [ 1577.211765] binder: 14800:14801 ioctl c0306201 200001c0 returned -22 [ 1577.234212] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:28 executing program 2: r0 = inotify_init1(0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f000045fff8)={0x0, 0x0}) syz_open_procfs(r2, 0x0) [ 1577.255232] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1577.284991] binder: 14808:14809 transaction failed 29201/-28, size 24-8 line 3137 [ 1577.306939] binder: 14811:14812 ioctl c0306201 0 returned -14 [ 1577.322588] binder: undelivered TRANSACTION_ERROR: 29201 [ 1577.343767] binder: 14818:14823 unknown command 536871488 [ 1577.350563] binder: 14818:14823 ioctl c0306201 200001c0 returned -22 [ 1577.363423] binder: 14811:14820 ioctl c0306201 0 returned -14 08:14:28 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) sendmsg$key(r0, &(0x7f0000000080)={0x1000000efffffff, 0x100000000000000, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000000000d30000000003000600252000000200006ae00000010000000201000000080012000200020000000000fa0000003000000002030000000000c6a8000000020000000008000092ab000000000001020014bb007d22897fffffde000000000300050000200000020000f3df0000210008000002000000"], 0x80}}, 0x0) 08:14:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, 0x0, &(0x7f0000000800)) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:28 executing program 2: fcntl$setown(0xffffffffffffffff, 0x8, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) unshare(0x0) r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0x40046205, &(0x7f0000000040)) 08:14:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:28 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:28 executing program 3: r0 = timerfd_create(0x9, 0x0) readv(r0, &(0x7f00000001c0)=[{&(0x7f0000000080)=""/14, 0xe}], 0x1) timerfd_settime(r0, 0x0, &(0x7f0000000040)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) 08:14:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) [ 1577.860627] binder: 14837:14839 unknown command 536871488 [ 1577.868118] binder: 14837:14839 ioctl c0306201 200001c0 returned -22 [ 1577.894124] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:28 executing program 2: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) ppoll(&(0x7f0000000100)=[{r0, 0x1}], 0x1, 0x0, 0x0, 0x0) 08:14:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, 0x0, &(0x7f0000000800)) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 1577.913676] binder: 14848:14849 unknown command 0 [ 1577.916175] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1577.916225] binder: 14836:14842 transaction failed 29201/-28, size 24-8 line 3137 [ 1577.950950] binder: undelivered TRANSACTION_ERROR: 29201 08:14:29 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 08:14:29 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = socket$inet(0x2b, 0x80000000000001, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)=0xfffffffffffffd63) sendmmsg(r1, &(0x7f0000000240)=[{{&(0x7f00000001c0)=@nl=@unspec, 0x384, &(0x7f0000000040), 0x0, &(0x7f0000000100)}}], 0x2c, 0x0) 08:14:29 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000080)={0x1000000efffffff, 0x100000000000000, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d000010000000000000d30000000003000600252000000200006ae00000010000000201000000080012000200020000000000fa0000003000000002030000000000c6a8000000020000000008000092ab000000000001020014bb007d22897fffffde000000000300050000200000020000f3df0000210008000002000000"], 0x80}}, 0x0) 08:14:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) [ 1577.966322] binder: 14848:14849 ioctl c0306201 200001c0 returned -22 [ 1578.006462] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space 08:14:29 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000), 0x10e755) clone(0x800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x2000000000000015, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x6, 0x0, &(0x7f0000000040)) [ 1578.043026] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1578.075484] binder: 14863:14870 unknown command 0 08:14:29 executing program 2: eventfd(0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003500)=[{{0x0, 0x0, &(0x7f0000002580)=[{&(0x7f00000012c0)=""/115, 0x73}], 0x1}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') flock(0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000000480), 0x100000000000021c, 0x0) 08:14:29 executing program 0: pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) rt_sigprocmask(0x0, &(0x7f0000000340)={0xfffffffffffffffe}, 0x0, 0x8) close(r0) write(r1, &(0x7f0000000240)='j', 0x1) [ 1578.089544] binder: 14853:14856 transaction failed 29201/-28, size 24-8 line 3137 [ 1578.107732] binder: 14863:14870 ioctl c0306201 200001c0 returned -22 [ 1578.137268] binder: undelivered TRANSACTION_ERROR: 29201 08:14:29 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000eaebc58184ff8f04352f4d4e573e61f648b88d0f6093c190ffcee8cfa530616e047c61cbfc552adac7b31651245570bb90c4622ab62168b63ca1116e415e9b79052416f7cd751f8c0468f875a4fceaeb065facf345ddfae66a6977f1626353e8dec2087c92638d79c4afac", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) 08:14:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000040)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000840)={@ipv4={[], [], @multicast2}, r3}, 0x14) setxattr$security_selinux(0x0, &(0x7f0000000140)='security.selinux\x00', 0x0, 0xfffffeae, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000dfbe5fb902b142caec8805172484d464ab04ed189f2b8b0997939422b8bd6655f6eb16a9c423257ea78e44490d8ceac52956a1e4a8756177a34294753dd87a7c81bc75886fe24b547f81b674c068bcd91ecc63ba6ce96c54af7706f653b65e9528025690b6c5ad214ca584cf6df163a96ff3c87f91f4e652ee37a7aa72139f5c1e3aec9879e7e2a7f328999b1bebf9f19d4c2ef7420555003de3e797b9b4", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="00000000000000007adf279be4d5281e9333133f2847ac96a06dbb5a4e79ebd2d63aff3a5026df9e16e604550814262e4ceaf5636dd074bd9f97904006bee10c6127e1ecaaee95928fc6c6d5997c17e3eeaf65fde275417ed7a43172d78bc0783032aa8a41c898fc2327640bf07e1a0dbbd263b0da5f3035966eb8569a13bfd8053c52b9d1e6c597ed4f34b1c165980e9f11c2be32991f7b03550c4f4036d37ba5fdabd4297a870433891f2cf0a15bb51e1f7f98d7775e0415948f331563ef415d1330f7dc97f3e91bd99c5b06844f0da2400000000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 08:14:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) 08:14:29 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCADDDLCI(r0, 0x8980, 0x0) 08:14:29 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) lseek(r0, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20}, 0x1b) listen(r0, 0x1ff) syz_emit_ethernet(0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="5000030000003e901709003cca02ec00"], 0x0) 08:14:29 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r0, 0x0, 0x61, &(0x7f0000000840)={'filter\x00'}, 0x0) 08:14:29 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) write$binfmt_elf32(r1, &(0x7f0000000400)=ANY=[@ANYPTR64], 0x8) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000340)='veth1\x00', 0x10) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000100), 0x4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) sendto(r2, &(0x7f0000000000)="a1", 0x1, 0x0, 0x0, 0x0) connect$unix(r2, &(0x7f0000000240)=@abs, 0x6e) [ 1578.285414] binder_alloc: 6448: binder_alloc_buf size 32 failed, no address space [ 1578.294661] binder_alloc: allocated: 12256 (num: 498 largest: 32), free: 32 (num: 2 largest: 24) [ 1578.305551] binder: 14889:14896 unknown command 0 [ 1578.325285] binder: 14889:14896 ioctl c0306201 200001c0 returned -22 08:14:29 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000340)='veth1\x00', 0x10) ioctl(0xffffffffffffffff, 0x0, 0x0) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000100), 0x4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) sendto(r2, &(0x7f0000000000)="a1", 0x1, 0x0, 0x0, 0x0) connect$unix(r2, &(0x7f0000000240)=@abs, 0x6e) 08:14:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 1578.360570] binder: 14890:14895 transaction failed 29201/-28, size 24-8 line 3137 [ 1578.412161] binder: 14909:14913 unknown command 536871488 [ 1578.418340] binder: 14909:14913 ioctl c0306201 200001c0 returned -22 [ 1578.432979] binder: undelivered TRANSACTION_ERROR: 29201 [ 1579.209514] ================================================================== [ 1579.216943] BUG: KASAN: use-after-free in tcp_init_tso_segs+0x1b9/0x200 [ 1579.223696] Read of size 2 at addr ffff88009a0882b0 by task syz-executor.0/14924 [ 1579.231210] [ 1579.232829] CPU: 1 PID: 14924 Comm: syz-executor.0 Not tainted 4.4.174+ #4 [ 1579.239824] 0000000000000000 14e825704970b683 ffff8800a5317678 ffffffff81aad1a1 [ 1579.247892] 0000000000000000 ffffea0002682200 ffff88009a0882b0 0000000000000002 [ 1579.255926] ffff88009a088280 ffff8800a53176b0 ffffffff81490120 0000000000000000 [ 1579.263961] Call Trace: [ 1579.266554] [] dump_stack+0xc1/0x120 [ 1579.271928] [] print_address_description+0x6f/0x21b [ 1579.278606] [] kasan_report.cold+0x8c/0x2be [ 1579.284571] [] ? tcp_init_tso_segs+0x1b9/0x200 [ 1579.290822] [] __asan_report_load2_noabort+0x14/0x20 [ 1579.297567] [] tcp_init_tso_segs+0x1b9/0x200 [ 1579.303716] [] tcp_write_xmit+0x1ae/0x4570 [ 1579.309600] [] ? kasan_kmalloc+0xb7/0xd0 [ 1579.315315] [] ? memset+0x32/0x40 [ 1579.320410] [] ? mark_held_locks+0xb1/0x100 [ 1579.326406] [] __tcp_push_pending_frames+0xab/0x2b0 [ 1579.333074] [] tcp_send_fin+0x15b/0xa90 [ 1579.338718] [] tcp_close+0xcc8/0xfa0 [ 1579.344090] [] ? ip_mc_drop_socket+0x1d6/0x230 [ 1579.350329] [] inet_release+0xff/0x1d0 [ 1579.355873] [] __sock_release+0xd5/0x260 [ 1579.361581] [] ? __sock_release+0x260/0x260 [ 1579.367541] [] sock_close+0x1b/0x30 [ 1579.372942] [] __fput+0x246/0x710 [ 1579.378038] [] ____fput+0x16/0x20 [ 1579.383132] [] task_work_run+0x202/0x2b0 [ 1579.388844] [] do_exit+0x8ea/0x2c60 [ 1579.394135] [] ? futex_wait_setup+0x350/0x350 [ 1579.400282] [] ? release_task+0x14a0/0x14a0 [ 1579.406581] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 1579.413344] [] ? recalc_sigpending+0x74/0xa0 [ 1579.419423] [] ? dequeue_signal+0xc8/0x550 [ 1579.425316] [] ? check_preemption_disabled+0x3c/0x200 [ 1579.432148] [] do_group_exit+0x111/0x300 [ 1579.437855] [] get_signal+0x517/0x1570 [ 1579.443436] [] do_signal+0x9c/0x1840 [ 1579.448796] [] ? exit_robust_list+0x220/0x220 [ 1579.454932] [] ? trace_hardirqs_on+0x10/0x10 [ 1579.460982] [] ? selinux_msg_queue_alloc_security+0x2e0/0x2e0 [ 1579.468506] [] ? setup_sigcontext+0x780/0x780 [ 1579.474667] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 1579.481416] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 1579.488164] [] ? SyS_futex+0x247/0x340 [ 1579.493729] [] ? exit_to_usermode_loop+0xf2/0x170 [ 1579.500217] [] exit_to_usermode_loop+0x127/0x170 [ 1579.506907] [] syscall_return_slowpath+0x25b/0x2e0 [ 1579.513483] [] int_ret_from_sys_call+0x25/0xa3 [ 1579.519702] [ 1579.521327] Allocated by task 14922: [ 1579.525019] [] save_stack_trace+0x26/0x50 [ 1579.530981] [] kasan_kmalloc.part.0+0x62/0xf0 [ 1579.537337] [] kasan_kmalloc+0xb7/0xd0 [ 1579.543001] [] kasan_slab_alloc+0xf/0x20 [ 1579.548827] [] kmem_cache_alloc+0xdc/0x2c0 [ 1579.554856] [] __alloc_skb+0xec/0x5d0 [ 1579.560442] [] sk_stream_alloc_skb+0xa3/0x5d0 [ 1579.566936] [] tcp_sendmsg+0xf8a/0x2ab0 [ 1579.572689] [] inet_sendmsg+0x202/0x4d0 [ 1579.578438] [] sock_sendmsg+0xbe/0x110 [ 1579.584086] [] SyS_sendto+0x201/0x340 [ 1579.589664] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1579.596381] [ 1579.598001] Freed by task 14923: [ 1579.601352] [] save_stack_trace+0x26/0x50 [ 1579.607542] [] kasan_slab_free+0xb0/0x190 [ 1579.613479] [] kmem_cache_free+0xbe/0x350 [ 1579.619413] [] kfree_skbmem+0xd9/0x110 [ 1579.625072] [] __kfree_skb+0x1e/0x30 [ 1579.630550] [] tcp_connect+0xafa/0x31b0 [ 1579.636305] [] tcp_v4_connect+0x1060/0x1930 [ 1579.642396] [] __inet_stream_connect+0x2cf/0xc70 [ 1579.649096] [] inet_stream_connect+0x55/0xa0 [ 1579.655273] [] SyS_connect+0x1a5/0x2e0 [ 1579.660965] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1579.667670] [ 1579.669303] The buggy address belongs to the object at ffff88009a088280 [ 1579.669303] which belongs to the cache skbuff_fclone_cache of size 456 [ 1579.682657] The buggy address is located 48 bytes inside of [ 1579.682657] 456-byte region [ffff88009a088280, ffff88009a088448) [ 1579.694613] The buggy address belongs to the page: [ 1579.699771] kasan: CONFIG_KASAN_INLINE enabled [ 1579.704202] kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN [ 1579.717217] Modules linked in: [ 1579.720562] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.174+ #4 [ 1579.726817] task: ffffffff82e151c0 task.stack: ffffffff82e00000 [ 1579.732891] RIP: 0010:[] [] debug_object_deactivate+0x16f/0x360 [ 1579.742331] RSP: 0018:ffff8801db607ce0 EFLAGS: 00010006 [ 1579.747815] RAX: 1ffffffff0817848 RBX: 0000000000000003 RCX: 0000000000006c6a [ 1579.755096] RDX: 05ccd86baba82b8b RSI: ffffffff82eafea0 RDI: 2e66c35d5d415c59 [ 1579.762396] RBP: ffff8801db607dd0 R08: 0000000000000001 R09: ffffffff840bc248 [ 1579.769679] R10: 0000000000000096 R11: 0000000000000000 R12: 2e66c35d5d415c41 [ 1579.776961] R13: dffffc0000000000 R14: 1ffff1003b6c0fa0 R15: ffff8801d6a97df8 [ 1579.784242] FS: 0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 [ 1579.792479] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1579.798368] CR2: 000000002001f13f CR3: 00000001c1c6f000 CR4: 00000000001606b0 [ 1579.805646] Stack: [ 1579.807805] ffff880100000002 ffffffff83a80a10 ffffffff840bc248 ffffffff82eafea0 [ 1579.815908] 0000000041b58ab3 ffffffff82c76921 ffffffff81b0c500 ffffffff82c4d560 [ 1579.824004] ffffffff811ff5b0 ffffffff00000001 ffffffff00000000 ffffffff83a821b0 [ 1579.832105] Call Trace: [ 1579.834690] [ 1579.836760] [] ? debug_object_activate+0x470/0x470 [ 1579.843660] [] ? trace_hardirqs_on+0x10/0x10 [ 1579.849732] [] ? trace_hardirqs_on+0x10/0x10 [ 1579.855812] [] __hrtimer_run_queues+0x1bd/0xfc0 [ 1579.862149] [] ? hrtimer_fixup_init+0x70/0x70 [ 1579.868317] [] ? kvm_clock_get_cycles+0x9/0x10 [ 1579.874567] [] ? hrtimer_interrupt+0x121/0x450 [ 1579.880832] [] hrtimer_interrupt+0x1b6/0x450 [ 1579.886918] [] local_apic_timer_interrupt+0x76/0xa0 [ 1579.893613] [] smp_apic_timer_interrupt+0x79/0xb0 [ 1579.900124] [] apic_timer_interrupt+0x9d/0xb0 [ 1579.906275] [ 1579.908353] [] ? native_safe_halt+0x2/0x10 [ 1579.914563] [] ? default_idle+0x56/0x3d0 [ 1579.920304] [] arch_cpu_idle+0x10/0x20 [ 1579.925861] [] default_idle_call+0x48/0x70 [ 1579.931774] [] cpu_startup_entry+0x6d1/0x810 [ 1579.937851] [] ? complete+0x18/0x70 [ 1579.943156] [] ? call_cpuidle+0xe0/0xe0 [ 1579.948797] [] ? schedule+0xab/0x1d0 [ 1579.954194] [] rest_init+0x190/0x199 [ 1579.959581] [] ? trace_event_define_fields_x86_irq_vector+0x2c/0x2c [ 1579.967666] [] start_kernel+0x64a/0x67e [ 1579.973316] [] ? thread_stack_cache_init+0xb/0xb [ 1579.979741] [] ? early_idt_handler_array+0x120/0x120 [ 1579.986517] [] ? early_idt_handler_array+0x120/0x120 [ 1579.993291] [] x86_64_start_reservations+0x29/0x2b [ 1579.999893] [] x86_64_start_kernel+0x137/0x15a [ 1580.006130] Code: 48 c1 ea 03 42 80 3c 2a 00 0f 85 8e 01 00 00 4d 8b 24 24 4d 85 e4 0f 84 e9 00 00 00 49 8d 7c 24 18 83 c3 01 48 89 fa 48 c1 ea 03 <42> 80 3c 2a 00 0f 85 3f 01 00 00 4d 3b 7c 24 18 75 c0 49 8d 7c [ 1580.034355] RIP [] debug_object_deactivate+0x16f/0x360 [ 1580.041646] RSP [ 1580.045283] ---[ end trace d508202cda250343 ]--- [ 1580.050044] Kernel panic - not syncing: Fatal exception in interrupt SeaBIOS (version 1.8.2-20190204_181744-google) Total RAM Size = 0x00000001e0000000 = 7680 MiB CPUs found: 2 Max CPUs supported: 2 found virtio-scsi at 0:3 virtio-scsi vendor='Google' product='PersistentDisk' rev='1' type=0 removable=0 virtio-scsi blksize=512 sectors=4194304 = 2048 MiB drive 0x000f2a00: PCHS=0/0/0 translation=lba LCHS=520/128/63 s=4194304 Booting from Hard Disk 0... [ 0.000000] Initializing cgroup subsys cpu [ 0.000000] Initializing cgroup subsys cpuacct [ 0.000000] Linux version 4.4.174+ (syzkaller@ci) (gcc version 9.0.0 20181231 (experimental) (GCC) ) #4 SMP PREEMPT Fri Feb 8 11:15:16 UTC 2019 [ 0.000000] Command line: BOOT_IMAGE=/vmlinuz root=/dev/sda1 console=ttyS0 earlyprintk=serial vsyscall=native rodata=n oops=panic panic_on_warn=1 nmi_watchdog=panic panic=86400 workqueue.watchdog_thresh=140 nopti [ 0.000000] KERNEL supported cpus: [ 0.000000] Intel GenuineIntel [ 0.000000] AMD AuthenticAMD [ 0.000000] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256 [ 0.000000] x86/fpu: Supporting XSAVE feature 0x01: 'x87 floating point registers' [ 0.000000] x86/fpu: Supporting XSAVE feature 0x02: 'SSE registers' [ 0.000000] x86/fpu: Supporting XSAVE feature 0x04: 'AVX registers' [ 0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'standard' format. [ 0.000000] e820: BIOS-provided physical RAM map: [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable [ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved [ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000bfffcfff] usable [ 0.000000] BIOS-e820: [mem 0x00000000bfffd000-0x00000000bfffffff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000fffbc000-0x00000000ffffffff] reserved [ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000021fffffff] usable [ 0.000000] bootconsole [earlyser0] enabled [ 0.000000] NX (Execute Disable) protection: active [ 0.000000] Hypervisor detected: KVM [ 0.000000] Kernel/User page tables isolation: disabled [ 0.000000] e820: last_pfn = 0x220000 max_arch_pfn = 0x400000000 [ 0.000000] x86/PAT: Configuration [0-7]: WB WC UC- UC UC UC UC UC [ 0.000000] e820: last_pfn = 0xbfffd max_arch_pfn = 0x400000000 [ 0.000000] found SMP MP-table at [mem 0x000f2c70-0x000f2c7f] mapped at [ffff8800000f2c70] [ 0.000000] Using GB pages for direct mapping [ 0.000000] ACPI: Early table checksum verification disabled [ 0.000000] ACPI: RSDP 0x00000000000F2A40 000014 (v00 Google) [ 0.000000] ACPI: RSDT 0x00000000BFFFDBA0 000038 (v01 Google GOOGRSDT 00000001 GOOG 00000001) [ 0.000000] ACPI: FACP 0x00000000BFFFFF00 0000F4 (v02 Google GOOGFACP 00000001 GOOG 00000001) [ 0.000000] ACPI: DSDT 0x00000000BFFFDBE0 0017B2 (v01 Google GOOGDSDT 00000001 GOOG 00000001) [ 0.000000] ACPI: FACS 0x00000000BFFFFEC0 000040 [ 0.000000] ACPI: FACS 0x00000000BFFFFEC0 000040 [ 0.000000] ACPI: SSDT 0x00000000BFFFF590 000930 (v01 Google GOOGSSDT 00000001 GOOG 00000001) [ 0.000000] ACPI: APIC 0x00000000BFFFF4A0 000076 (v01 Google GOOGAPIC 00000001 GOOG 00000001) [ 0.000000] ACPI: WAET 0x00000000BFFFF470 000028 (v01 Google GOOGWAET 00000001 GOOG 00000001) [ 0.000000] ACPI: SRAT 0x00000000BFFFF3A0 0000C8 (v01 Google GOOGSRAT 00000001 GOOG 00000001) [ 0.000000] kvm-clock: Using msrs 4b564d01 and 4b564d00 [ 0.000000] kvm-clock: cpu 0, msr 2:1fffd001, primary cpu clock [ 0.000000] kvm-clock: using sched offset of 1893555940 cycles [ 0.000000] clocksource: kvm-clock: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns [ 0.000000] Zone ranges: [ 0.000000] DMA32 [mem 0x0000000000001000-0x00000000ffffffff] [ 0.000000] Normal [mem 0x0000000100000000-0x000000021fffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000001000-0x000000000009efff] [ 0.000000] node 0: [mem 0x0000000000100000-0x00000000bfffcfff] [ 0.000000] node 0: [mem 0x0000000100000000-0x000000021fffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000001000-0x000000021fffffff] [ 0.000000] kasan: KernelAddressSanitizer initialized [ 0.000000] ACPI: PM-Timer IO Port: 0xb008 [ 0.000000] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1]) [ 0.000000] IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23 [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level) [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level) [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level) [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level) [ 0.000000] Using ACPI (MADT) for SMP configuration information [ 0.000000] smpboot: Allowing 2 CPUs, 0 hotplug CPUs [ 0.000000] e820: [mem 0xc0000000-0xfffbbfff] available for PCI devices [ 0.000000] Booting paravirtualized kernel on KVM [ 0.000000] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.000000] setup_percpu: NR_CPUS:8 nr_cpumask_bits:8 nr_cpu_ids:2 nr_node_ids:1 [ 0.000000] PERCPU: Embedded 41 pages/cpu @ffff8801db600000 s130696 r8192 d29048 u1048576 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 1935238 [ 0.000000] Kernel command line: BOOT_IMAGE=/vmlinuz root=/dev/sda1 console=ttyS0 earlyprintk=serial vsyscall=native rodata=n oops=panic panic_on_warn=1 nmi_watchdog=panic panic=86400 workqueue.watchdog_thresh=140 nopti [ 0.000000] PID hash table entries: 4096 (order: 3, 32768 bytes) [ 0.000000] Dentry cache hash table entries: 1048576 (order: 11, 8388608 bytes) [ 0.000000] Inode-cache hash table entries: 524288 (order: 10, 4194304 bytes) [ 0.000000] Memory: 6609392K/7863916K available (23671K kernel code, 3786K rwdata, 5144K rodata, 1320K init, 23156K bss, 1254524K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1 [ 0.000000] Running RCU self tests [ 0.000000] Preemptible hierarchical RCU implementation. [ 0.000000] RCU lockdep checking is enabled. [ 0.000000] Build-time adjustment of leaf fanout to 64. [ 0.000000] RCU restricting CPUs from NR_CPUS=8 to nr_cpu_ids=2. [ 0.000000] RCU: Adjusting geometry for rcu_fanout_leaf=64, nr_cpu_ids=2 [ 0.000000] NR_IRQS:4352 nr_irqs:440 16 [ 0.000000] console [ttyS0] enabled [ 0.000000] console [ttyS0] enabled [ 0.000000] bootconsole [earlyser0] disabled [ 0.000000] bootconsole [earlyser0] disabled [ 0.000000] Lock dependency validator: Copyright (c) 2006 Red Hat, Inc., Ingo Molnar [ 0.000000] ... MAX_LOCKDEP_SUBCLASSES: 8 [ 0.000000] ... MAX_LOCK_DEPTH: 48 [ 0.000000] ... MAX_LOCKDEP_KEYS: 8191 [ 0.000000] ... CLASSHASH_SIZE: 4096 [ 0.000000] ... MAX_LOCKDEP_ENTRIES: 32768 [ 0.000000] ... MAX_LOCKDEP_CHAINS: 65536 [ 0.000000] ... CHAINHASH_SIZE: 32768 [ 0.000000] memory used by lock dependency info: 8159 kB [ 0.000000] per task-struct memory footprint: 1920 bytes [ 0.000000] tsc: Detected 2300.000 MHz processor [ 1.237653] Calibrating delay loop (skipped) preset value.. 4600.00 BogoMIPS (lpj=23000000) [ 1.238920] pid_max: default: 32768 minimum: 301 [ 1.239782] ACPI: Core revision 20150930 [ 1.319283] ACPI: 2 ACPI AML tables successfully acquired and loaded [ 1.320832] Security Framework initialized [ 1.321493] SELinux: Initializing. [ 1.322322] Mount-cache hash table entries: 16384 (order: 5, 131072 bytes) [ 1.323356] Mountpoint-cache hash table entries: 16384 (order: 5, 131072 bytes) [ 1.327408] Initializing cgroup subsys freezer [ 1.328353] CPU: Physical Processor ID: 0 [ 1.328984] Last level iTLB entries: 4KB 1024, 2MB 1024, 4MB 1024 [ 1.329873] Last level dTLB entries: 4KB 1024, 2MB 1024, 4MB 1024, 1GB 4 [ 1.330918] Spectre V2 : Mitigation: Full generic retpoline [ 1.331854] Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch [ 1.333124] Speculative Store Bypass: Vulnerable [ 1.335247] Freeing SMP alternatives memory: 28K [ 1.346385] ..TIMER: vector=0x30 apic1=0 pin1=0 apic2=-1 pin2=-1 [ 1.466802] smpboot: CPU0: Intel(R) Xeon(R) CPU @ 2.30GHz (family: 0x6, model: 0x3f, stepping: 0x0) [ 1.468471] Performance Events: unsupported p6 CPU model 63 no PMU driver, software events only. [ 1.557153] x86: Booting SMP configuration: [ 1.557834] .... node #0, CPUs: #1 [ 1.558786] kvm-clock: cpu 1, msr 2:1fffd041, secondary cpu clock [ 1.563127] x86: Booted up 1 node, 2 CPUs [ 1.563760] smpboot: Total of 2 processors activated (9200.00 BogoMIPS) [ 1.566362] CPU1: update max cpu_capacity 1024 [ 1.568284] CPU1: update max cpu_capacity 1024 [ 1.569588] devtmpfs: initialized [ 1.579707] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 1.581413] futex hash table entries: 512 (order: 4, 65536 bytes) [ 1.586115] NET: Registered protocol family 16 [ 1.613079] cpuidle: using governor ladder [ 1.643071] cpuidle: using governor menu [ 1.644321] ACPI: bus type PCI registered [ 1.645093] PCI: Using configuration type 1 for base access [ 1.731592] ACPI: Added _OSI(Module Device) [ 1.732469] ACPI: Added _OSI(Processor Device) [ 1.733189] ACPI: Added _OSI(3.0 _SCP Extensions) [ 1.733953] ACPI: Added _OSI(Processor Aggregator Device) [ 1.746332] ACPI: Executed 2 blocks of module-level executable AML code [ 1.831532] ACPI: Interpreter enabled [ 1.832618] ACPI: (supports S0 S3 S5) [ 1.833455] ACPI: Using IOAPIC for interrupt routing [ 1.834614] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug [ 2.050110] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff]) [ 2.051189] acpi PNP0A03:00: _OSC: OS supports [Segments MSI] [ 2.052846] acpi PNP0A03:00: _OSC failed (AE_NOT_FOUND); disabling ASPM [ 2.066411] PCI host bridge to bus 0000:00 [ 2.067222] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window] [ 2.068331] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window] [ 2.069278] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window] [ 2.070402] pci_bus 0000:00: root bus resource [mem 0xc0000000-0xfebfffff window] [ 2.071482] pci_bus 0000:00: root bus resource [bus 00-ff] [ 2.157233] pci 0000:00:01.3: quirk: [io 0xb000-0xb03f] claimed by PIIX4 ACPI [ 2.291594] ACPI: PCI Interrupt Link [LNKA] (IRQs 5 *10 11) [ 2.299610] ACPI: PCI Interrupt Link [LNKB] (IRQs 5 *10 11) [ 2.307429] ACPI: PCI Interrupt Link [LNKC] (IRQs 5 10 *11) [ 2.314949] ACPI: PCI Interrupt Link [LNKD] (IRQs 5 10 *11) [ 2.321458] ACPI: PCI Interrupt Link [LNKS] (IRQs *9) [ 2.336053] ACPI: Enabled 16 GPEs in block 00 to 0F [ 2.339221] vgaarb: loaded [ 2.342468] SCSI subsystem initialized [ 2.344658] ACPI: bus type USB registered [ 2.346013] usbcore: registered new interface driver usbfs [ 2.347264] usbcore: registered new interface driver hub [ 2.348482] usbcore: registered new device driver usb [ 2.350503] Advanced Linux Sound Architecture Driver Initialized. [ 2.351466] PCI: Using ACPI for IRQ routing [ 2.356942] amd_nb: Cannot enumerate AMD northbridges [ 2.358034] clocksource: Switched to clocksource kvm-clock [ 2.479849] pnp: PnP ACPI init [ 2.506362] pnp: PnP ACPI: found 7 devices [ 2.518290] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns [ 2.520195] NET: Registered protocol family 2 [ 2.523673] TCP established hash table entries: 65536 (order: 7, 524288 bytes) [ 2.525339] TCP bind hash table entries: 65536 (order: 10, 4194304 bytes) [ 2.531290] TCP: Hash tables configured (established 65536 bind 65536) [ 2.532952] UDP hash table entries: 4096 (order: 7, 655360 bytes) [ 2.542956] UDP-Lite hash table entries: 4096 (order: 7, 655360 bytes) [ 2.545278] NET: Registered protocol family 1 [ 2.546148] pci 0000:00:00.0: Limiting direct PCI/PCI transfers [ 2.548518] PCI-DMA: Using software bounce buffering for IO (SWIOTLB) [ 2.549534] software IO TLB: mapped [mem 0xbbffd000-0xbfffd000] (64MB) [ 2.551382] RAPL PMU detected, API unit is 2^-32 Joules, 3 fixed counters 10737418240 ms ovfl timer [ 2.552755] hw unit of domain pp0-core 2^-0 Joules [ 2.553520] hw unit of domain package 2^-0 Joules [ 2.554432] hw unit of domain dram 2^-16 Joules [ 2.560301] audit: initializing netlink subsys (disabled) [ 2.561516] audit: type=2000 audit(1551514477.442:1): initialized [ 2.661961] VFS: Disk quotas dquot_6.6.0 [ 2.663693] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes) [ 2.678712] Registering sdcardfs 0.1 [ 2.683614] fuse init (API version 7.23) [ 2.704433] cryptomgr_test (31) used greatest stack depth: 28720 bytes left [ 2.718618] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) [ 2.719875] io scheduler noop registered [ 2.720593] io scheduler deadline registered [ 2.723229] io scheduler cfq registered (default) [ 2.734273] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0 [ 2.735519] ACPI: Power Button [PWRF] [ 2.737593] input: Sleep Button as /devices/LNXSYSTM:00/LNXSLPBN:00/input/input1 [ 2.739075] ACPI: Sleep Button [SLPF] [ 2.740261] Warning: Processor Platform Limit event detected, but not handled. [ 2.741404] Consider compiling CPUfreq support into your kernel. [ 2.765909] ACPI: PCI Interrupt Link [LNKC] enabled at IRQ 11 [ 2.766880] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver [ 2.793595] ACPI: PCI Interrupt Link [LNKD] enabled at IRQ 10 [ 2.794500] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver [ 2.801935] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled [ 2.825127] 00:03: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A [ 2.851918] 00:04: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A [ 2.878363] 00:05: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A [ 2.904836] 00:06: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A [ 2.974982] brd: module loaded [ 3.012213] loop: module loaded [ 3.029700] scsi host0: Virtio SCSI HBA [ 3.043730] scsi 0:0:1:0: Direct-Access Google PersistentDisk 1 PQ: 0 ANSI: 6 [ 3.548647] tsc: Refined TSC clocksource calibration: 2300.007 MHz [ 3.551129] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x21273b92eef, max_idle_ns: 440795226594 ns [ 3.608275] sd 0:0:1:0: [sda] 4194304 512-byte logical blocks: (2.15 GB/2.00 GiB) [ 3.608901] tun: Universal TUN/TAP device driver, 1.6 [ 3.608905] tun: (C) 1999-2004 Max Krasnyansky [ 3.619646] sd 0:0:1:0: [sda] 4096-byte physical blocks [ 3.626787] sd 0:0:1:0: [sda] Write Protect is off [ 3.633924] sd 0:0:1:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA [ 3.647080] e1000: Intel(R) PRO/1000 Network Driver - version 7.3.21-k8-NAPI [ 3.649591] e1000: Copyright (c) 1999-2006 Intel Corporation. [ 3.652220] PPP generic driver version 2.4.2 [ 3.655495] PPP BSD Compression module registered [ 3.657008] PPP Deflate Compression module registered [ 3.658921] PPP MPPE Compression module registered [ 3.660271] NET: Registered protocol family 24 [ 3.661967] usbcore: registered new interface driver asix [ 3.663928] usbcore: registered new interface driver ax88179_178a [ 3.665676] usbcore: registered new interface driver cdc_ether [ 3.667631] usbcore: registered new interface driver net1080 [ 3.669738] usbcore: registered new interface driver cdc_subset [ 3.671489] sda: sda1 [ 3.672716] usbcore: registered new interface driver zaurus [ 3.675065] usbcore: registered new interface driver cdc_ncm [ 3.676764] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 3.678905] ehci-pci: EHCI PCI platform driver [ 3.682510] i8042: PNP: PS/2 Controller [PNP0303:KBD,PNP0f13:MOU] at 0x60,0x64 irq 1,12 [ 3.686011] sd 0:0:1:0: [sda] Attached SCSI disk [ 3.686668] i8042: Warning: Keylock active [ 3.688739] serio: i8042 KBD port at 0x60,0x64 irq 1 [ 3.691653] serio: i8042 AUX port at 0x60,0x64 irq 12 [ 3.696123] mousedev: PS/2 mouse device common for all mice [ 3.701679] usbcore: registered new interface driver xpad [ 3.703708] usbcore: registered new interface driver usb_acecad [ 3.705687] usbcore: registered new interface driver aiptek [ 3.707507] usbcore: registered new interface driver gtco [ 3.709481] usbcore: registered new interface driver hanwang [ 3.711425] usbcore: registered new interface driver kbtab [ 3.715334] rtc_cmos 00:00: RTC can wake from S4 [ 3.719360] rtc_cmos 00:00: rtc core: registered rtc_cmos as rtc0 [ 3.721323] rtc_cmos 00:00: alarms up to one day, 114 bytes nvram [ 3.726563] device-mapper: uevent: version 1.0.3 [ 3.730920] device-mapper: ioctl: 4.34.0-ioctl (2015-10-28) initialised: dm-devel@redhat.com [ 3.734299] hidraw: raw HID events driver (C) Jiri Kosina [ 3.751005] usbcore: registered new interface driver usbhid [ 3.752581] usbhid: USB HID core driver [ 3.762348] ashmem: initialized [ 3.788539] u32 classifier [ 3.789274] Actions configured [ 3.790178] Netfilter messages via NETLINK v0.30. [ 3.791764] nf_conntrack version 0.5.0 (65536 buckets, 262144 max) [ 3.797069] ctnetlink v0.93: registering with nfnetlink. [ 3.803686] xt_time: kernel timezone is -0000 [ 3.805008] IPv4 over IPsec tunneling driver [ 3.810410] ip_tables: (C) 2000-2006 Netfilter Core Team [ 3.813414] arp_tables: (C) 2002 David S. Miller [ 3.815317] Initializing XFRM netlink socket [ 3.823390] NET: Registered protocol family 10 [ 3.832308] mip6: Mobile IPv6 [ 3.833276] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 3.839879] sit: IPv6 over IPv4 tunneling driver [ 3.848485] NET: Registered protocol family 17 [ 3.850095] NET: Registered protocol family 15 [ 3.855096] registered taskstats version 1 [ 3.861025] rtc_cmos 00:00: setting system clock to 2019-03-02 08:14:38 UTC (1551514478) [ 3.863858] ALSA device list: [ 3.864716] No soundcards found. [ 3.900530] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input2 [ 3.942820] EXT4-fs (sda1): couldn't mount as ext3 due to feature incompatibilities [ 3.946059] EXT4-fs (sda1): couldn't mount as ext2 due to feature incompatibilities [ 3.966616] EXT4-fs (sda1): mounted filesystem without journal. Opts: (null) [ 3.967850] VFS: Mounted root (ext4 filesystem) readonly on device 8:1. [ 4.006150] devtmpfs: mounted [ 4.011590] Freeing unused kernel memory: 1320K [ 4.012574] Kernel memory protection disabled. [ 5.236986] SELinux: Permission module_load in class system not defined in policy. [ 5.238396] SELinux: Class netlink_iscsi_socket not defined in policy. [ 5.239460] SELinux: Class netlink_fib_lookup_socket not defined in policy. [ 5.240505] SELinux: Class netlink_connector_socket not defined in policy. [ 5.241520] SELinux: Class netlink_netfilter_socket not defined in policy. [ 5.242512] SELinux: Class netlink_generic_socket not defined in policy. [ 5.243428] SELinux: Class netlink_scsitransport_socket not defined in policy. [ 5.244412] SELinux: Class netlink_rdma_socket not defined in policy. [ 5.245551] SELinux: Class netlink_crypto_socket not defined in policy. [ 5.246511] SELinux: Permission wake_alarm in class capability2 not defined in policy. [ 5.247603] SELinux: Permission block_suspend in class capability2 not defined in policy. [ 5.248772] SELinux: Permission audit_read in class capability2 not defined in policy. [ 5.249916] SELinux: Permission attach_queue in class tun_socket not defined in policy. [ 5.251043] SELinux: Class binder not defined in policy. [ 5.251818] SELinux: the above unknown classes and permissions will be denied [ 5.347448] audit: type=1403 audit(1551514479.970:2): policy loaded auid=4294967295 ses=4294967295 INIT: version 2.88 booting [ 5.505838] stty (357) used greatest stack depth: 26176 bytes left